Privacy Policy
Last updated: August 2026
Overview
Crumbs ("the Service") is a thought-capture assistant you use inside WhatsApp, built by PurposeLab Studio. This policy explains what we store, where it goes, and what you can do about it.
Read this part first. Crumbs is different from our other apps. Folio, WaterWise, BP Log and Hushly keep everything on your phone. Crumbs cannot: it has to receive your message, understand it, and store it so it can hand it back later. That means your crumbs are held on our servers and are sent to an AI provider to be processed. If you are not comfortable with that, please do not send anything to Crumbs that you would not want stored.
What we collect
- Your WhatsApp phone number. This is how your account is identified. There is no separate signup, so the number is the account.
- The content you send. Notes, ideas, to-dos, reminders, links, photos, voice notes, contacts and locations, plus anything Crumbs derives from them, such as an extracted task or a due date.
- Account settings. Your digest preferences, pause state, plan, referral counters and similar.
- Message logs. Records of messages exchanged with the Service, used for delivery, de-duplication, debugging and abuse prevention.
Where your data is stored
Your crumbs and account record are stored in Cloudflare D1, a managed SQLite database, and the Service runs on Cloudflare Workers. Data is encrypted in transit and encrypted at rest by the platform. We do not run our own separate copy of your data elsewhere.
AI processing (please read)
Crumbs uses AI to work out what you meant, transcribe voice notes, read text out of images, and find the right item when you ask for something back. To do that, the content of your messages is sent to Google's Gemini API, and images may additionally be processed by Cloudflare AI. This happens every time you send a crumb or ask a question.
We send the minimum needed for the task, and we do not sell your content or use it for advertising. We do not train our own models on your content. However, once content is sent to an AI provider it is subject to that provider's own terms, so please also read Google's Gemini API terms and Cloudflare's privacy policy.
Messaging
Crumbs is delivered over the WhatsApp Cloud API, operated by Meta. Your messages to and from Crumbs pass through WhatsApp's infrastructure and are also governed by WhatsApp's privacy policy. Note that messages with a business are not end-to-end encrypted in the same way as personal chats, because the business (in this case, Crumbs) has to be able to read them in order to reply.
Payments
Paid plans are handled by Razorpay. Razorpay processes your payment details directly; Crumbs never sees or stores your card or bank information. We store only the resulting plan and its expiry date.
Third parties we use
- Cloudflare for hosting, database and image AI.
- Google (Gemini API) for understanding text and voice.
- Meta (WhatsApp Cloud API) for sending and receiving messages.
- Razorpay for payments.
We do not sell, rent or trade your data. We do not serve advertisements and we do not use ad tracking or retargeting.
Your rights
- Export. You can export your crumbs as JSON on any plan, including the free one. Additional formats are available on the Max plan.
- Delete. You can delete individual crumbs, or ask Crumbs to delete your whole account and its contents. Deletion of an account is confirmed before it runs.
- Pause. You can tell Crumbs to stop messaging you at any time, and it will.
- Access and correction. Write to us at the address below and we will help.
Data retention
Your crumbs are kept until you delete them or delete your account, because the whole point of the Service is that it still has them later. Operational message logs are kept only as long as they are useful for delivery, debugging and abuse prevention. When you delete your account, your crumbs and account record are removed from our database; backups and provider-side logs may persist for a short period before they age out.
Security
Incoming webhooks from WhatsApp and Razorpay are verified with HMAC signatures, repeat messages are de-duplicated, and administrative endpoints require a secret. Data is encrypted in transit and at rest by our infrastructure providers. No service can promise perfect security, and we do not.
Children's privacy
Crumbs is intended for adults (18+). It is not directed at children and we do not knowingly collect data from them.
Contact
Questions about this policy, or a request about your data: purposelab.studio@gmail.com
Changes to this policy
We may update this policy. Changes will show in the "Last updated" date above. Continued use of the Service after a change means you accept the updated policy.