Privacy policy
Updated 17 October 2026 · Caminos personal
Controller and contact
This policy describes this installation of Caminos, signing in with Google, connected Google Drive documents and the read-only bank connection. Francesc Mateu Amengual manages this installation. For questions about your data, access, rectification, deletion or withdrawal of an authorisation, write to pacomateua@gmail.com.
Data and purpose
Caminos processes identification and sign-in data, the content you add and, when you authorise a bank connection, information about the selected accounts, balances and transactions, including available dates, amounts, descriptions and counterparties. They are used to show and organise your information, sync accounts and support personal queries and planning.
Google y Google Drive
Signing in with Google uses your account identifier, name, verified email and profile picture to identify you and control access. It doesn't ask for permission to read your Drive, Gmail or contacts. You can review or remove the sign-in connection in your Google account's third-party connections; this doesn't delete data already saved in Caminos or remove a folder's separate permissions.
An administrator can separately connect a Google account to a space to save files in a folder chosen with Google Picker. This authorisation requests the drive.file permission for files selected or created with Caminos, along with the account's identification. The server keeps an encrypted refresh token to maintain the connection when you close the browser; it isn't handed to the browser or to AI. Saved files record which connection created them.
Reading connected folders also uses a server service account with access granted by their owners or administrators. Choosing a folder in Picker doesn't by itself grant recursive read access to all its existing documents: sources must be shared with that service account. Caminos reads names, identifiers, structure, metadata and, when the feature and permissions allow, document content. It keeps references and may store extracted text, summaries, organised data and search indexes for the enabled features. Storage features can create, move or send files to the trash within authorised folders.
Each space can designate a main folder to store uploads and email attachments added to Caminos, and add existing source folders for the space or for a Path. Sources are read in batches after confirmation, keeping a reference to the original's version; those originals aren't moved or deleted. Unlinking a folder stops reading its references, but doesn't automatically delete text, summaries or facts already added. AI analysis has its own authorisation option.
Access within Caminos depends on the space's permissions and its document and privacy settings. Automatic management of Drive permissions needs enabling and approval per folder; its recipients can open the originals according to the role granted. Other Google permissions, including inherited ones, may still give access even if a person leaves the space.
Google data is used to provide the Caminos features you request. It isn't sold or used for advertising. AI only receives content allowed by the feature's, the space's and the source's controls; signing in or connecting a folder doesn't by itself authorise analysing all its content. Operators with technical access to this installation and its providers can access the information they process. The installation doesn't offer end-to-end encryption of all documents.
You can remove Drive's authorisation in your Google account's third-party connections. Disconnecting from Caminos first requires resolving the folders and files that still depend on that account, to keep their originals. To also stop the service account's access, the owner or administrator must remove its permissions in Google Drive; signing out of Caminos doesn't remove them. Unlinking a folder doesn't by itself delete the originals, external permissions or all the content already added. Ask the contact above to delete retained data or your account. There isn't yet a one-button full account deletion.
Bank connection
The connection uses Enable Banking and requires your authorisation in the bank's service. Caminos doesn't request or store your bank password and doesn't initiate payments. The app's private keys and bank sessions are stored encrypted on the server. The account identifier shown in the interface is masked.
Access to bank data in the app is limited to the owner. Linking an account to an asset doesn't automatically share its transactions with other people. Operators with technical access to the infrastructure can access stored data.
External services and artificial intelligence
Vercel hosts the app and MongoDB stores its data. Enable Banking and your bank take part in bank authorisation and queries. Signing in with Google uses its authentication services. These providers process information under their own terms and this installation's configuration.
AI features in a space use the platform and model selected for each use in Space settings → AI and processing: Anthropic, or Fireworks if it has been enabled. The provider receives the messages and the authorised evidence needed for the operation. Web sources may use Anthropic's or Tavily's tools; the latter receives queries and public URLs. Semantic search uses the configured embeddings service, which receives text passages. Dictation with Whisper and the mobile app's speech recognition transcribe audio on the device. Live mode keeps the transcription local. If you choose the AI-finished message, only the text is sent to the correction provider and model configured in that space; the audio isn't sent. This external correction is off by default and the original transcription stays available to compare while you remain on the screen. Dictated text may also be sent to AI later when it's used in another authorised operation. Personal banking, the initial proposal and shared-archive jobs without an assigned space keep the general Anthropic configuration. Bank Guide queries require confirmation: your question, account names and a summary of balances and flows are sent. That query doesn't automatically include transaction descriptions, counterparties, IBANs, private keys or sessions. Detailed transaction analysis has its own authorisation. What you write in a question may contain personal data.
Your data and AI
Your content remains yours
You choose what to add and share. Access within the app follows Space membership, roles and the permissions for each item. Sharing a Space does not make its content public.
Who can access it?
Being a Caminos developer or an administrator of another Space does not grant access to a private Space through the app. The shared family and company portals have their own role-based access.
People with privileged access to the hosting infrastructure or database may technically access stored content. Caminos does not currently use end-to-end encryption that prevents this operator access. We cannot yet promise that the developer is technically unable to read your data.
Fireworks: published privacy commitments
When Fireworks is selected, its published policy says it does not use prompts or API inputs to train or improve its models without explicit opt-in. For open-model inference, it says prompts and responses are not logged or stored without opt-in.
Fireworks still processes the content to answer. Its policy allows usage metadata and temporary in-memory prompt caching. This describes inference content, not the notes, documents and conversations you save in Caminos.
Provider policies reviewed 17 October 2026
Zero data retention describes what is kept. Data residency describes where it is processed. An EU-only processing location or private connection has not been verified for this installation.
Issue reports
When you send a problem or improvement report, it's saved with your authenticated account, the text and the screenshot you choose, the route without private parameters, the screen size, the language and the available technical data about the app and the device: web, iOS or Android platform, installed version and build, web interface revision, operating system, model and manufacturer, browser or WebView. The revision of the server receiving the report is also recorded. These data make it possible to reproduce the problem and reply to you. Serial numbers, advertising identifiers, location and personal device names aren't collected for this diagnosis. The report can be read by its author and by this installation's authorised developers.
Retention and control
To understand and control the cost of AI, usage metadata is kept: identifiers of the space and, where applicable, the Path, purpose, provider, model, dates, status, token or credit quantities and estimated cost. This record doesn't include the content of messages, documents, audio, web queries or access keys. Space administrators can see their aggregated totals; it gives no additional access to private content. These operational metadata expire after 400 days and are deleted when the space is deleted. The short request history has its own 30-day expiry. This record doesn't trigger charges to members.
Reconciliation with providers keeps normalised exports of aggregated costs, comparisons by day and model and the operator's review decisions, with no private content or space identifiers in those comparisons. These operational records expire after 400 days, extended when a review is recorded to keep the associated evidence. Deleting a space removes its usage records, but doesn't delete the provider's historical aggregates; a new comparison reflects the change. They aren't invoices and don't trigger charges.
Funding accounts organise expected costs and don't trigger charges. Their profile keeps the name, personal or company type and the accepted financial roles. When a space's funding is approved, an expressly chosen financial label and the aggregated AI costs are shared with those roles; no access is given to documents, messages or conversations. Requests and invitations expire after 14 days. Allocation and financial activity records are kept for up to 400 days, along with the active agreements needed to maintain the configuration; deleting a space removes its associated records. The global profile and its permissions are kept as account configuration, including if archived, until their deletion is handled through the contact above. Archiving isn't the same as deleting the profile.
Imported bank data is kept until you delete the accounts and their history. Disconnecting a bank stops syncing but doesn't delete the history already imported. After disconnecting you can delete the accounts and remove the stored credentials. If removing access remains pending, check the status in the app and also revoke consent at your bank.
Deletions in the app don't guarantee immediate deletion of backups or provider records. For other deletion requests or information about retention, use the contact above.
Sessions and changes
The app uses cookies for the session, preferences and security checks during bank authorisation. This policy will be updated when the features or data processing change.