Privacy

Who we are

underway is operated by Personal Works Ltd (PERSONAL WORKS LTD), company number 14013912, registered in England and Wales. We are the controller of the personal data described on this page.

For anything here, contact hello@underway.life.

What we collect, and why

• Your account. Email address, name if a sign-in provider sends one, and the fact of your subscription. Needed to run the service you asked for.
• The free daily email. If you sign up for Document, Don’t Create we keep your email address, your first name if you give it, and which page or advert you came from. If you answer the three questions after signing up, we keep what you tell us about your business, its size and what you find hardest about posting, and use it to make the emails more useful to you. Every email has a one-click unsubscribe.
• Helping you get going. We can see your series’ name, what you type when you set it up, and how far you’ve got, so we can help you get going. We never watch your recordings or read your transcripts unless you ask us to.
• Recordings and transcripts. Video and audio of you, and the text Whisper makes from them, so the interview can happen and an episode can be cut.
• Day context. The note you type, and — only if you connect them — things like commit messages, calendar titles, meeting transcripts, the Slack channels you invite underway to, the Google Drive files you pick, or a payment landing. Used to aim the questions. Never used as footage unless you choose a commentary take.
• Setting up your series before you sign up. On some of our pages you can answer a few questions, type them or say them, and give your website before you have an account. Your answers stay in your own browser, not on our servers, and are cleared after seven days or when you start over. To show you a preview we pass them to the services that write the preview and turn speech into text (listed below), and we read the public pages of the website you give us for its name, logo, colours and words. We keep none of it until you sign up; then it fills in your series and your brand, and it is kept with your account and deleted with it. We also count, without knowing who you are, how many people reach each question.
• How far you get in the app. Which first steps your account has reached and when: signing in, opening Today, playing the welcome film, setting up your series, writing questions, recording an answer, making an episode. Never what you typed, said or filmed. Kept with your account so we can see where new founders get stuck and fix it, and deleted with it.
• Looking around the demo. If you look around underway’s own account without signing up, we count what you open and press there, under a random number with no meaning: the pages, the buttons by their words, the actions the demo stopped, where the visit came from (the page or ad, never anything about you), and the country your connection reads as. Never an email, never anything typed. If you then sign up from the same browser, we link the visit to your account, so we can see whether looking around helps people start. Kept for twelve months, then deleted. Where the cookie rules ask first, the number is kept only after you press Allow (see cookies).
• Technical logs. Brief server logs, including IP address, so the site stays up and we can see abuse.

If we wrote to you first

Sometimes Rich writes personally to a founder whose public post on X or LinkedIn about building their business suggests underway might help. To do that we keep your name, your public handle or LinkedIn profile, that one post and its link, your business’s website, the location, role and company on your public profile, and, outside the UK and EU only, a work email at your business, and the LinkedIn or Instagram profile your own website or bio links to. We use them to write to you: a short email from Rich’s own mailbox and a few follow-ups, and a message on X, LinkedIn or Instagram, all of which stop the moment you reply. Only if you say yes do we set up a private page showing what your series could look like, built from that post and, where we can find or read it, your website, and nothing else. We may also show our ads to the same list of businesses on X and Meta. Our reason is our legitimate interest in telling founders about a product made for them; we never email personal addresses. Replying to say no is enough to stop everything.

The page has an Opt out link that deletes everything about you except your handle or LinkedIn address, which we keep only so we never contact you again. Or email hello@underway.life and we will do the same. The searching is done through treg (treg.to), which relays requests to the services that hold public posts and work emails.

Rich also answers public Reddit threads where founders ask about building in public. For that we keep the thread, its link and the poster’s Reddit username, and nothing else. We never contact anyone found on Reddit outside that public thread.

The lawful bases we rely on

UK GDPR asks us to name the legal reason for each use. In ordinary language:

• Contract. Running your account, storing what you ask us to store, transcribing takes, generating questions and assembling the cut. This is the service you signed up for.
• Consent. Optional connections — calendar, GitHub, meeting tools, Stripe and the rest — only after you connect them. Disconnecting withdraws that consent and deletes the stored key.
• Legitimate interests. Keeping the site secure, short-lived server logs, and stopping abuse. And, when you sign up, a note of which of our pages or emails you signed up from, the pages of our site you opened in that browser tab before signing up, the site that sent you there if your browser says, the kind of device and browser (such as “iPhone, Safari”) and the country your connection reads as, so we can see which of them lead to people actually filming; it stays with us and is never shared. We do not use this basis to send your data to advertisers, and we do not think those limited uses override your interests.
• Legal obligation. Records we have to keep for tax and accounting, if any arise from a paid plan.

Your recordings stay on your device

Video and audio you record are stored locally in your own browser (IndexedDB) or on your phone. They are not uploaded to our servers for storage, and we cannot watch them.

If you turn on sync so your episodes appear on more than one device, your recordings are stored in our Supabase project for that purpose alone. You can turn sync off and delete what it holds.

Recording is always opt-in

The camera and microphone are only ever active after you press record, and a visible indicator shows when capture is happening. There is no ambient or all-day recording, and the app never listens in the background.

Your face and voice are not biometrics we identify you with

The diary is a recording of you. We do not do face recognition. We do not identify who is in the frame, we do not enrol a face or voice print, and we do not send footage to a recognition service. Optional on-device framing or light retouching may look for a face in the picture so a crop sits in the right place; that happens on your device, it does not identify you, and it does not store a biometric template.

What we send to other companies, and why

• OpenAI (transcription). Audio from your takes is sent to OpenAI’s Whisper API to be turned into text, and an episode with the AI co-host, audio or on camera, is a live conversation with OpenAI’s voice model, which hears your side of it. If you share your screen during that conversation with “Your co-host can see it” ticked, a still of the window you chose is sent to the same model every few seconds while it changes; your camera is never sent. All of it is processed for that request and is not used to train their models.
• Anthropic (the interview). The note about your day, your transcripts and your chosen angle are sent to Anthropic’s API so Claude can propose angles, write questions and assemble the cut. Not used for training.
• Supabase (accounts and optional sync). Your email address and sign-in session. If you turn sync on, the recordings you asked us to hold. If you sign in with Whop, we receive your email address and name from Whop, nothing else, and we never gain access to your Whop account.
• Vercel (hosting) and Fly.io (renders). Standard server logs, including IP addresses, kept briefly for security and reliability. When a render runs on our worker, the media needed for that job is processed there.
• Whop (payments, optional sign-in and the community). Membership status so we know which plan you have. Card details stay with Whop; we never see them. When you sign up with the email box ticked, we send Whop your email address so it can invite you to the free underway community; nothing happens on Whop unless you accept, and unticking the box means no invite.

Help (our support inbox). When you use the Help button, we keep your message, your email address, the page you were on and your browser or app version, so we can answer you. It goes to our support inbox, hosted by AgentMail, and is used for nothing else. We send you one short email to say it arrived, and then a person replies.

Help (Ask). The Ask tab in the Help button sends your question, our help pages and, if you are signed in, your email address, your plan and the page you are on to Anthropic, who write the answer. We do not keep the conversation. Nothing is stored unless you choose to send it to our team, and then it goes to our support inbox as above.

Resend (email). Sign-in links and account emails are sent through Resend, which sees your email address for that purpose. If you join our community, we may also send a short series of emails about building in public; every one carries an unsubscribe link, the series stops when you make an account, and we send nothing else.

Sentry (error reports). When something breaks, we send Sentry a report of the error so we can fix it: what failed, where in the code, your browser or app version and the page. Email addresses, sign-in tokens, cookies and what you typed are taken out first. It never receives your recordings or the contents of an episode, and there is no screen replay.

Optional connectors — Google Calendar, GitHub, Zoom, Fathom, Fireflies, Stripe, Linear, Plausible, PostHog, Vercel deploys, Kit, beehiiv, Shopify, Figma, Patreon, Gumroad, Squarespace, Printful, Upwork, YouTube, LinkedIn, TikTok, Instagram and X — only see data when you connect them, and only so the interview can ask about your day or so an episode can go where you sent it. Meeting transcripts are context for questions. Other people’s voices do not go in an episode. A recorded meeting’s whole transcript, each newsletter issue you send and each email you send to your forwarding address are kept with a one-line note in your day log, so your director and the writers can read what was actually said. They are private, used only as context for you, and deleted with your account. Slack reads only the channels you invite underway to: every message there, and as much of the channel’s history as Slack allows, is kept for as long as your account exists so the interview knows what happened, with one line per channel per day in your day log. It is context for your questions only, never public and never footage; removing underway from a channel stops it, and deleting your account deletes what it read. On Underway Calendar, our booking app on Whop, someone who takes calls can connect their own Zoom account (permission to create, update and delete meetings, and to read their own Zoom profile for its email address): for each call booked with them we create one Zoom meeting at the call’s time and length, move it when the call moves and delete it when the call is cancelled. We never read, change or delete any other meeting, and nothing from Zoom is used for anything else. We keep the meeting’s id and link with the booking, their Zoom keys encrypted and their Zoom user id; Disconnect, or removing the app on Zoom, deletes them. Google Drive reads only the files you pick in Google’s own file chooser (the drive.file permission, which cannot open anything else in your Drive): each is read as text when you pick it and again when it changes, the latest copy is kept so the next read can say what changed, and one line a day per changed file goes in your day log. Stop reading a file and its copy is deleted; disconnecting deletes all of them.

Where a connection uses Google data (Gmail, Google Calendar, Google Drive, YouTube, Google Analytics and Search Console), underway’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail is read only to ask about your day, and only the threads the Gmail section below describes; calendar data is read only to ask about your day, events are made only for calls booked with you on Underway Calendar, and Drive files only to say what is in them and what changed. None of it is used for advertising, sold, used to train AI models, or shared with anyone else, and no human at underway reads it except with your consent to fix a problem you have asked us to fix, to deal with a security problem, or when the law requires it. The section below is the full account of every Google permission we ask for and how that data is protected.

YouTube. underway uses YouTube API Services. When you connect YouTube, we use it to upload the episodes, clips and assets you choose, keep them in a playlist and set their thumbnails; to read the views, likes and comments on what you posted, so Reach can show you what it did; and to read YouTube’s public search results for phrases your audience types (the titles, view counts, ages and channel sizes of the top videos), so Promote can suggest videos to film and the clip finder can choose which moments to cut. We keep those search results with your suggestions and refresh them each week; anything older than 30 days is deleted. We also read YouTube’s public search suggestions, which carry no information about you. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s Privacy Policy applies to what Google does with it. You can stop underway’s access at any time with Disconnect on Account, under Connections, or from Google’s security settings; when you disconnect, we delete the YouTube access we held and the search results kept for you.

ElevenLabs, Deepgram, Hume AI, Google and Cloudflare. OpenAI speaks the interviewer’s questions aloud from their text. ElevenLabs writes down what you recorded, with word timings; when it is unavailable Deepgram does, and then OpenAI. Deepgram also times the words in a clip precisely. Hume AI is a standby for the co-host that is not in use. Google’s Gemini API describes a fragment or a moment when video understanding is on, and generates nothing. Cloudflare relays the live picture when your phone is the camera and stores none of it.

The full list, including those optional connectors, is on subprocessors. We do not sell your data, and we do not use your recordings or transcripts to advertise or to train any model of our own. Visit and signup events can go to the advertising platforms named on the cookies page, so we can tell whether an ad brought you here: in the UK, the EU, the EEA and Switzerland only after you press Allow, and anywhere never after No thanks.

How we protect Google user data

Connecting Google is optional, one product at a time, from Account under Connections, or from the step in your marketing brief that needs it. Each connection also asks for the email address on that Google account (the email scope, https://www.googleapis.com/auth/userinfo.email), so the screen can name which account is connected. We do not ask for your contacts or for full access to your Drive. The one restricted scope we ask for is Gmail, described first below, and we say on the Gmail box itself, before you connect, what that permission allows against what underway does with it. The permissions we request, and what each one is for, are these.

• Gmail, through Composio. https://mail.google.com/. A restricted scope, and wider than what underway does. The sign-in goes through Composio, a managed connection service whose Google app is verified for that permission and not for Gmail read-only on its own (Google blocks a read-only request from it), so Google’s screen asks for full access to your Gmail: read, compose, send and delete. underway only ever reads. It never sends, replies, deletes, labels, moves or changes anything in your mailbox, and never opens drafts, spam or the bin. What it reads is narrow and set in code: threads you wrote in, threads from someone at a company on your calendar, and threads from a sender you said yes to; never newsletters, receipts, notifications, no-reply mail or Gmail’s promotions, social and forums. A thread is judged from its headers and snippet first; only one that passes has its messages’ own words read, with the quoted reply and the signature taken off. When someone you have not written to or met emails you, nothing of theirs is read until you say yes on the Gmail card, and a no is kept for good. What we keep is one line a thread in your day log (who it was from as a first name and company, never the address, the subject and the words that passed), kept 30 days, the list of senders you trusted or blocked, and when it was last read. Composio holds the Google token; underway holds only Composio’s id for the connection. Disconnecting removes the connection at Composio, and so at Google, and deletes every line Gmail put in your day log. It is read once an hour, and the moment you connect, to suggest what to talk about in your first episode. Nothing from it goes in an episode unless you say it to camera. Outlook (Outlook.com and Microsoft 365) is read by exactly the same rules, through Composio’s managed Microsoft app with the Mail.Read permission alone, which is read-only; the two share one list of trusted and blocked senders.
• Google Analytics, read-only. https://www.googleapis.com/auth/analytics.readonly. A sensitive scope. We list the Google Analytics 4 properties that account can see, and for the one you choose we read the last 28 days: where visits came from, which pages people landed on, which countries, and the counts of visits and people. One line a day is kept in your day log, visits against the day before, a jump when there is one, and the channel they mostly came from, so your daily interview can ask about it. A milestone can notice a round number, such as passing 100,000 visits in 28 days, or a week that jumped against the week before. The same figures are also used to write your marketing brief on Promote, the plan for where to spend the effort. underway cannot change anything in Analytics. Read-only is the smallest permission that can read those reports. The property you choose is saved with your account. The brief keeps the written plan, and the writing log may keep one line such as how many visits were read and which channel they mostly came from.
• Google Calendar, read-only. https://www.googleapis.com/auth/calendar.events.readonly. A sensitive scope. We read the title and the end time of events on your primary calendar that have already finished, so the interview can ask what came out of that meeting. We do not read a description, attachments, or what was said, and this permission cannot create or change an event. A declined invitation and an all-day entry are ignored. What we keep is one line in your day log, such as “meeting ended” and the title.
• Google Calendar events, for Underway Calendar. https://www.googleapis.com/auth/calendar.events.owned. A sensitive scope covering only calendars the person owns, asked for only when someone who takes calls on Underway Calendar, our booking app on Whop, presses Connect Google Meet. For each call booked with them we create one event on their primary calendar at the call’s time and length, with a Google Meet link and no guests, so Google sends no invitations. We move that event when the call is moved and delete it when the call is cancelled. We never read, change or delete any other event. We keep the event’s id and its Meet link with the booking, so the link can go in the booking emails and reminders. Disconnecting removes our access at Google, and new calls go back to the meeting link they pasted.
• YouTube. https://www.googleapis.com/auth/youtube.force-ssl. A sensitive scope. It is what YouTube requires to upload a video you chose, put it in one playlist on your channel, set its title, description and thumbnail, read the views, likes and comments on what you posted, and take that video down when you ask. We also read YouTube’s public search results for phrases your audience types, so Promote can suggest videos to film and the clip finder can choose an opening. We do not post unless you press the button. The YouTube section above has the terms, the 30-day limit on those search results, and how to disconnect.
• Search Console, read-only. https://www.googleapis.com/auth/webmasters.readonly. A sensitive scope. For the site you choose we read queries, clicks, impressions and average position, so you can see them, so a milestone can notice a change, and so the marketing brief can build on searches you already show up for. One line a day is kept in your day log. The same permission is also used by underway’s own administrator account to read Search Console for underway.life. It is not a second product offered to you.
• Google Drive, files you pick. https://www.googleapis.com/auth/drive.file. This is not a sensitive or restricted scope. It can open only the files you pick in Google’s own file chooser, not the rest of your Drive. Each picked file is read as text when you pick it and again when it changes. The latest copy is kept so the next read can say what changed, and one line a day per changed file goes in your day log. Stopping a file deletes its copy. Disconnecting deletes all of them.

Where it is stored. The tokens, the day-log lines, the Drive copies, the property or site you chose, and the marketing brief are stored in our Supabase project, which is Postgres. Recordings are a separate matter and are described above.

Encryption. In transit, your browser, our servers, Google and the database talk over TLS (HTTPS). At rest, Supabase encrypts the database disks with AES-256. On top of that, OAuth access tokens and refresh tokens are encrypted by the application before they are written, with AES-256-GCM. The key lives only in the server environment, not in the database. Each value has its own random initialisation vector, and an authentication tag, so a modified value fails to decrypt. Tokens are not stored in plaintext.

Who can access it. The signed-in app cannot read a token. Row-level security lets you see that you are connected, and to which account, and lets you disconnect. The token columns are withheld from the browser. Only the server process that calls Google decrypts a token, and only for your account. Access to the database and to the encryption key is limited to the people who operate underway. No one at underway reads Google user data in the ordinary running of the product. A person reads it only with your consent, to fix something you asked us to look at, to investigate abuse or a security problem, or when the law requires it.

What we never do with it. We do not sell Google user data. We do not use it for advertising, retargeting, or building an advertising profile. We do not use it to train an AI model, ours or anyone else’s. Where a feature needs a model, the relevant part is sent for that request only: calendar titles you have kept, and the Analytics and Search Console lines kept in your day log, can be sent to Anthropic so a question can be written. Analytics and Search Console figures can also be sent to Anthropic so the marketing brief can be written. Those providers process the request and do not use it for training, as the list above says. We do not send Google user data to an advertising platform.

How long we keep it, and how to delete it. A token stays until you disconnect or you delete the account. Disconnect, on Account under Connections, asks Google to revoke the token and then deletes our access token and refresh token. If Google does not answer, we still delete our copy, so underway can no longer call Google as you. You can also remove underway from your Google account permissions. Deleting the account revokes any Google tokens still stored, then deletes the account and the data kept with it, including the day log, Drive copies and the marketing brief. To ask us to do that, email support@underway.life from the address on the account. We delete it within one month and confirm when it is done.

Google API Services User Data Policy. underway’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Limited Use means we use that data only to provide the features described on this page, which are the features you see and turn on. We do not sell it, we do not use it for ads, we do not use it to train models, and we do not let a person read it except with your consent, for security, or to comply with the law.

Your CRM and your work tools

HubSpot, Attio, Salesforce, Notion, Asana, Trello, ClickUp and Jira connect through Composio, the same managed connection service as Gmail: Composio holds the token and underway holds only Composio’s id for the connection. Pipedrive and Close connect with an API token you make yourself, kept encrypted like every key. Each of those apps’ sign-in screens or tokens allows more than underway does (most allow writing), and every card says so before you connect. underway only ever reads, and never writes, sends or changes anything in any of them.

From a CRM we read deals or opportunities won and lost (their name, what they were for, the amount and the day), deals that moved stage in Attio, and how many new leads, contacts or companies came in, named by company. We never keep a person’s name, an email address, a phone number, a note or an individual’s amount beside their name. From a work tool we read the tasks, cards or issues you completed or moved, by name, with the project, board or list; never a comment, a teammate’s name or anything still open. From Notion we read only the pages you pick in Notion’s own picker, and of those only the title and when it changed, never what is on the page.

What we keep is one line an event in your day log (kept 30 days), the account name the app reports, and when it was last read. It is read once an hour, and the moment you connect, so your next episode can ask about a deal that closed or the work you finished. Nothing from it goes in an episode unless you say it to camera, and nothing performance-related steers the questions. Disconnecting removes the connection at Composio (and so at the app), or deletes the token, and deletes every line that app put in your day log.

International transfers

Audio and text may be processed in the United States by the providers named above. When that is an international transfer we rely on the contractual safeguards they publish: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, as each provider offers them. We checked each provider’s position on 4 September 2026: OpenAI, Anthropic, Supabase and Vercel each publish a data processing addendum that applies to us through their terms of service, and those addenda carry the transfer safeguards above. Whop publishes no standalone data processing addendum; its written processing terms, including Standard Contractual Clauses for transfers, sit in its privacy policy, a signed agreement is by request to its privacy team, and it acts as the merchant of record for payments under its own terms. This page does not claim a certification status we have not verified.

What you choose to publish

Nothing you record is public until you publish it. When you do, the episode, its cover, its title and its transcript go on your public archive page, may be listed in the directory, and, if you turn the podcast on, are distributed by RSS to any podcast app that subscribes. If you post an episode to your own YouTube channel it is governed by YouTube’s terms from then on. Taking an episode down removes it from your page, the directory and the feed; copies that other services or people have already made are outside our control.

Under Company Record, the company you belong to owns what you record there, as the note you read before your first episode says. The company’s owner and admins see who is a member and how many episodes each person has made, and nothing else: not your private memory, not unpublished takes, not your streak. If you leave, your series stays yours to keep or delete; the company’s bible keeps what you had already chosen to share with it.

How long we keep it

• Recordings on your device stay until you delete the session, clear the browser, or delete the app.
• Synced recordings stay until you delete the session or the account, or turn sync off and delete what it holds.
• Account details stay while the account exists.
• Connection tokens stay until you disconnect.
• Transcription and interview requests are processed for that job. We do not keep a separate copy beyond the transcript in your session.
• Server logs are kept briefly.
• Billing records stay as long as the account exists and for as long as tax or accounting rules require.

Cookies

In the UK, the EU, the EEA and Switzerland the public site sets analytics and advertising cookies only if you press Allow in the bar at the foot of the page, and none without your yes. Elsewhere they load with the page, and No thanks in the same bar stops them. Google Analytics, the ChatGPT Ads pixel, the Meta pixel, and, when an X ads campaign is running, the X pixel. Signed-in use needs a session cookie, and connecting an account sets a short-lived cookie to finish the sign-in safely. The current list is on cookies.

Deleting things

Deleting a session removes it and everything derived from it, the takes, the transcripts and every render. Deleting your account removes your account record and anything synced with it. Because recordings live on your device, clearing your browser data or deleting the app removes them too. Email the address above if you want us to delete the account record we hold.

Your raw footage is downloadable at any time, on every plan. It is your face and your voice; we are not going to hold it hostage.

Requests from the police, courts and regulators

We only disclose your data to a public authority under a valid legal process, we read every request against the law it cites, we disclose the least that satisfies it, we tell you unless we are legally forbidden to, and we keep a record of every request. The full policy, and the count of requests received, is on data requests.

Delete your data

You do not need to ask. Everything can be deleted from inside the app, at once or piece by piece:

• Delete an episode from its page in the vault. The footage, the transcript and every render made from it go with it, on the device and in sync.
• Disconnect a tool (Google Calendar, YouTube, LinkedIn, TikTok, Instagram, X, Kit, beehiiv) from the Connections tab of Account. The stored key is deleted at once, and we keep nothing that came through it beyond what is already in your episodes.
• Delete the account from the Account tab. Every session, render, setting and connection is removed, and synced footage is deleted from storage.

If you would rather we did it, email the address above from the address on the account and we will delete it within one month and confirm when it is done.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold (access)
• correct it if it is wrong (rectification)
• delete it (erasure)
• restrict how we use it for a time
• send you what we hold in a usable form (portability) — your footage is already downloadable in the app
• object to uses we make on legitimate interests
• withdraw consent, by disconnecting a tool or asking us to stop

Email the address above and we will respond within one month. We do not make solely automated decisions that have a legal or similarly significant effect on you. You can also complain to the Information Commissioner’s Office at ico.org.uk. Personal Works Ltd is registered with the ICO as a fee payer, reference ZC208067.

Text messages

When someone books a call on Underway Calendar and gives their mobile number, it is used only to send texts about that call (its confirmation, reminders, a move or a cancellation, and the business's own follow-ups about it), from the business's own texting provider or our toll-free number. We never share or sell mobile numbers or texting consent with third parties or affiliates for marketing or promotional purposes. Reply STOP to any text to stop them, or HELP for help. Message and data rates may apply; more on our texts page.

Changes

If this policy changes in a way that affects how your recordings are handled, we will tell you in the app before it takes effect, not quietly update this page.