Physic Privacy Policy
This policy explains how Physic, Inc. ("Physic", "we") handles information in the Physic desktop app, the Physic web app (team.physic.io) and the Physic for Chrome browser extension (together, the "Service"). Physic is a workspace for companies. A company that uses Physic (a "customer") decides who on its team can use it and what information goes into it.
Questions or requests: sam@physic.io.
The short version
- Your company's content belongs to your company. We use it to provide and improve the Service.
- We don't sell personal information or use it for advertising.
- The outside AI model providers we use may not keep your content or use it to train their models.
- Data from connected services (such as Gmail or Slack) and from the browser extension is used only to provide the features you use.
- The browser extension reads pages only in its own tabs, only on sites you allow, and never reads passwords, form entries, cookies or browsing history.
Information we handle
Account information. Your name, work email address and, if you add one, a profile photo, along with your role in your company's workspace. When you sign in with Google or Microsoft, we receive your name, email address and an account identifier from them. We don't receive your password.
Workspace content. What you and your teammates put into Physic: chats, files you upload, projects, tasks, notes, company context, skills, personal memory files and the results assistants produce.
Connected accounts. If you choose to connect Google Workspace (Gmail, Calendar, Drive), Microsoft 365, Slack or other services, Physic reads data from them only when an assistant needs it for your request. Drafting, sending or changing anything in a connected account requires your approval of that exact action. You can disconnect at any time.
Web search and pages. When an assistant searches the web, the search words are sent to our search provider (Brave Search). When it reads a public web page, Physic fetches that page.
Physic for Chrome. If you install the extension and connect it to your workspace, it opens its own tabs (grouped under "Physic"), and only on sites you allow one at a time. It reads the text and structure of those pages and sends them to your Physic workspace to answer your chat. It does not read your other tabs, passwords, form entries, cookies or browsing history. It only works while you are signed in and an assistant is using it. You can remove allowed sites or disconnect from the extension at any time.
Voice input. When you use the microphone to dictate a message, the recording is sent to our transcription provider (OpenAI) to turn it into text. Physic does not store the recording. We keep only its length, for usage limits.
Usage and technical information. Content-free records needed to run and secure the Service: sign-in events, which features were used, model usage and cost, web search counts, error reports and security logs. These records don't contain your workspace content.
How we use information
We use information to provide, secure, support and improve the Service:
- to run assistants and features you ask for;
- to sign you in and keep accounts secure;
- to enforce your company's spending limits and settings;
- to send service emails, such as invitations;
- to fix problems and protect against abuse;
- to understand how the Service is used and to develop and improve Physic's features, including how its assistants work.
When we use information to improve Physic, we limit who can access it, and we don't share your company's content with other customers.
We don't sell personal information or use it for advertising.
Data from connected services and the browser extension. Information we receive from connected services (such as Google Workspace, Microsoft 365 and Slack) and page content read by Physic for Chrome is used only to provide and improve the features you use, as those services' terms and the Chrome Web Store's policies require. We don't use it to develop or train general AI models, sell it, or use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
AI models
When you ask an assistant for help, the relevant content is sent to an AI model provider to generate a response. Your company chooses which providers are allowed:
- Amazon Bedrock: used only with zero data retention.
- OpenAI: used only under OpenAI's zero-data-retention terms.
- Other providers your company configures.
We don't permit these providers to keep your content or to use it to train their models. Before sending content, Physic checks that the selected provider is set up that way. Providers still receive the content in order to process the request.
Who we share information with
We share information only with service providers that help us run Physic, only for that purpose, and under contracts that protect it:
| Provider | What it does |
|---|---|
| Amazon Web Services | Hosting, storage and backups (United States, us-east-1), Amazon Bedrock AI models, email delivery |
| Sign-in, and Google Workspace data you choose to connect | |
| Microsoft | Sign-in, and Microsoft 365 data you choose to connect |
| Slack | Slack data and messages you choose to connect |
| Brave Search | Web search queries |
| OpenAI | Voice transcription, and AI models if your company enables them |
| OpenRouter | AI models, if your company enables them |
| Twilio, Sendblue | Text messages, only if your company enables messaging |
We may also disclose information if required by law, or to protect the rights and safety of our users or the public. If Physic is involved in a merger or acquisition, information may transfer under this policy.
How we protect information
Each company's data is kept separate. Data is encrypted in transit. Credentials for connected services are encrypted and can't be read back through the app. Access to production systems is limited to people who need it.
Retention and deletion
We keep your company's information while it uses Physic.
Company deletion. When your company asks us to delete its workspace, we remove its live data within 7 days. Data may persist in encrypted backups for up to 30 days after deletion before those backups expire.
Other records. Content-free security and billing records may be kept longer where needed for security, accounting or legal reasons.
Your choices and rights
Your company's administrators manage most of your information: who is invited, which connections are allowed, and what is kept. You can update your profile, disconnect your own connected accounts, remove sites from the browser extension, and delete your own chats.
To access, correct, export or delete your personal information, ask your company's administrator, or email sam@physic.io. We'll respond as required by applicable law, including privacy laws that may give you specific rights depending on where you live.
Children
Physic is a business service and is not directed to children under 16.
Changes
We'll post any change to this policy here with a new version and effective date. If a change is significant, we'll tell customers before it takes effect.
Contact
Physic, Inc. · sam@physic.io