Privacy Policy
Saturnino is a small companion that organizes your day, on the computer and on Android. It was built so that what you write stays with you: your tasks, what you dump (typed or spoken) and the chats the radar reads are handled on your own device, by BERTunino, a small language model that ships with the app.
Stays on your computer or phone: tasks, dumps, your voice, the chats the radar reads, the distraction warning and what the app learns from your corrections.
Goes online, and only this: reading your Google Calendar (if you connect it, computer only) or the calendar links you add, “Save to pet” (when you use it, computer only), the anonymous usage counts (numbers only, and you can turn them off), the message you send through feedback, and the check for updates.
We do not sell data, there are no ads and we do not build profiles. The sections below explain each point.
English and Portuguese. BERTunino comes in two versions that ship with the app, one per language: with the app in English, the English one reads your dumps and your sent messages, on your computer.
1. Who is responsible
Saturnino is a personal project maintained by Gabriel Goetten, in Brazil. For questions, or to ask for access to or deletion of data, use the contact form on the site. You do not need to give your e-mail: add it only if you want an answer.
2. Data that stays on your device
The app keeps locally your tasks, preferences, postponed items, iCal links, a random installation code and the calendar accounts you connected. On the computer, Google or Microsoft OAuth tokens are stored with the credential protection the operating system offers. Saturnino never receives your Google password.
3. Google Calendar data (computer)
If you choose to connect Google Calendar, Saturnino asks for read-only permissions. It reads the e-mail address that identifies the connected account, the list of visible calendars and the titles and times of events. It ignores all-day events, declined invitations and working-location entries. It does not create, change or delete events.
This data is used to show your next meetings, avoid conflicts in the day's plan and offer alerts related to your schedule. Organizing the day happens on your device (section 4): meetings are not sent to any AI service. They are not sold, used for advertising or shared to build commercial profiles.
Limited Use: the use and transfer to other apps of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
4. Organizing the dump
What you dump, typed or spoken, is organized on your device by BERTunino, a small language model trained by Saturnino, which ships with the app: in Portuguese, calibrated from BERTimbau (an open model by NeuralMind/Unicamp); in English, calibrated from DistilBERT (an open model by Hugging Face, Apache 2.0 licence; part of what it learned comes from public WhatsApp chats of the WhatFutures project, Newcastle University, CC BY 4.0 licence). It works offline. When the model cannot read the text, each line becomes a task.
5. Speaking instead of typing
In Dump you can speak instead of typing. Recording starts only when you tap to speak and ends when you tap done. The audio is turned into text on your device, by a transcription engine that ships with the app (whisper.cpp). The audio file exists only in a temporary folder while it is transcribed and is deleted right after, even if the transcription fails. The text appears in the box for you to check and is only organized, as described above, when you ask. The first time, and only after you confirm, the app downloads a 488 MB speech model from Hugging Face, checked against a signature before use. The diagnostic log and the anonymous counts record only numbers, such as how long you spoke, never what was said.
6. “Save to pet” (computer)
This feature is locked until you allow it. When you trigger it, a picture of the main screen and up to 4,000 characters of copied text are sent to our server and to the Google Gemini API to extract one task. Saturnino does not store the picture or the captured text. Check your screen before using it: visible passwords, documents and chats may appear in the picture.
7. Promise radar (beta)
In short: chats are read on your device and are not stored, and every suggestion goes through you before it becomes a task. You can turn the radar off in Settings → Privacy.
On Windows, the radar uses the system's accessibility API to watch the message field that is active in supported communication apps. It installs no keyboard capture and ignores password fields. A field going from filled to empty may mean a message was sent, but it may also be a deleted draft; that is why Saturnino shows a suggestion for you to decide.
A chat message often depends on what came before. So on the computer the radar also reads the last four visible lines of the open chat, which includes other people's messages. Those lines are used at that moment and dropped: they are not written to disk, do not enter the app's history, and the diagnostic log notes only how many lines were used, never their content. The radar never reads the whole history of a chat. Of all this, the only thing Saturnino keeps is your own message, as evidence for the task it created. If reading fails at that moment, that same message (without the context lines) is kept on your computer for up to 48 hours to try again, and is deleted if you turn the radar off.
Reading is done by BERTunino, on your device, even offline. The radar never takes screenshots. The acceptances, rejections and corrections used to adjust its confidence also stay on the device.
8. Distraction warning
In short: it works only on your device and does not look at your network. You can turn it off in Settings → Privacy.
On Windows, the pet tells you when you spend too long scrolling marked sites, such as YouTube, Instagram or Reddit; you choose which. While the warning is on, a local process checks every two seconds whether the window in front belongs to a browser open on one of those sites, and how many seconds ago the computer last received a touch, click or scroll. The window's title is compared with the marked sites and dropped at once; the titles of other programs are not even read. Saturnino receives only the name of the marked site, or nothing. It does not read the address or the content of the page, captures no keys, takes no screenshot and does not monitor network connections.
Your device keeps only how many times you answered “it's work”, “break” or “see the list” and, in the diagnostic log, the site's name and the minutes when the warning appears.
9. On the phone (Android)
The Android app does the same as the computer's, and what you write and say also stays on the phone: tasks, dumps, your voice (transcribed on the device by whisper.cpp) and what BERTunino reads.
Accessibility. The promise radar, the distraction warning and the floating pet use Android's Accessibility service. Before you switch it on, the app shows a screen explaining what is read and asks for your “I agree”; without it the service does nothing, even if it is switched on from Android's settings. With the radar on, Saturnino reads the text of the messages you send on WhatsApp, WhatsApp Business, Telegram, Teams, Slack, Discord, Gmail, Outlook, Google and Samsung Messages, Messenger, Instagram and Google Chat, and the chat's name when it is on screen. Password fields and search boxes are ignored, and a deleted draft is not read. Reading is done on the phone by BERTunino and the text is dropped right after; only when it looks like a promise is your message kept, on the phone, next to the suggested task, for you to decide. From other apps the service only knows which one is in front and whether you are using it, for the distraction warning, without reading what is on screen. No text read by the service leaves the phone. You can turn it off at any time in Settings → On the phone or in Android's Accessibility settings.
Microphone. Used only while you record speech in Dump; the audio is transcribed on the phone and deleted right after.
Internet. The Android app uses the internet only to read the calendar (iCal) links you add, to download the speech model once (if you use speech), to send the feedback message you write and, if on, the anonymous usage counts described in section 10.
10. Optional product improvement
The option “Help improve Saturnino” (computer only) is off by default. If you turn it on, we may store under a random code: your dump, the plan produced, the date, day of the week, meeting times without their titles, the number of open tasks and the app's version. Even without a name or e-mail, the text you wrote may contain information that identifies you or other people. You can turn the option off at any time.
Anonymous usage counts. Separately from the option above, the app sends once a day, under the same random code, only numbers about the previous day: for example how many tasks were finished or postponed, how many messages the radar saw and how many failed, whether the calendar and the radar are on, and the app's version. No text, name, meeting title or message content is part of it: the server drops any field that is not a number or a yes/no. The counts also include which parts of the app were used: how many times each tab or Settings area was opened, how a task was marked as done, which pet and look are in use, how many seconds of speech were transcribed. On Android they also include how many times the floating pet and the widget were tapped, whether Accessibility, the floating pet and the widget are on, and whether some part of the app stopped by itself. The counts are on by default and can be turned off in Settings → Privacy → Anonymous usage counts. Test runs (a development build or an emulator) send nothing.
11. Anonymous site metrics
The site uses Vercel Web Analytics to count visits and pages. The tool uses no cookies and records data in anonymized form, such as the page visited, the approximate origin of the visit, country, browser and operating system.
The site itself also counts, with no cookie and no identifier of any kind, what happens in each visit: the page seen, how long it stayed open, how far it was scrolled, clicks on the download buttons, the demo and the questions, the kind of origin of the visit (search, social network or direct, never the address), whether the screen is a phone's, whether the browser's language is Portuguese and whether that browser had visited before (a yes/no kept in the browser itself, never sent as a code). Each visit becomes one row of numbers that is not linked to any other. What you type in the contact form is not part of it. Browsers with Global Privacy Control or “Do Not Track” on send nothing.
Download protection. When you click to download the app, the site may use Cloudflare Turnstile to check that you are a person, not a robot. For that check Cloudflare sees your IP address and technical data about your browser. Cloudflare also uses this data to improve that protection; see its Turnstile privacy addendum. The check is loaded only after that click, and browsers with Global Privacy Control or “Do Not Track” on skip the check. Our server does not store the IP: it only counts, in memory and for up to a day, how many downloads came from each address.
12. Service providers
- Google: sign-in, the Google Calendar API and the Gemini API, used only in “Save to pet”.
- Vercel: hosting of the site and of our server, anonymous visit metrics and technical security and operation logs.
- Supabase: storage of the anonymous usage counts (on by default, can be turned off), of the site's counts (no identifier) and of the improvement records, the latter only with your consent.
- Formspree: delivery of the messages you choose to send through the feedback form.
- Cloudflare: the anti-robot check on the download button (Turnstile), only after the click. It sees the IP address and technical data about the browser.
- Hugging Face: hosting of the speech model, downloaded once if you use speech. It receives only the download request, with none of your data.
These providers may process data outside your country, including in the United States.
13. Retention, deletion and your rights
Local data stays until you disconnect the account, remove the app's files or uninstall it. Disconnecting an account deletes the token saved on that computer; you can also revoke access in your Google Account. Optional improvement records are kept while they are useful for development. To ask for them to be deleted, send through the form the “data code” shown in Settings → Privacy. The anonymous usage counts follow the same rule and can be deleted with the same code.
Depending on where you live (for example under Brazil's LGPD or the EU/UK GDPR), you may have the right to access, correct, delete or receive a copy of data about you, and to object to or restrict its use. Because the counts are stored only under a random code, that code is how we find the rows that came from your installation. Use the contact form for any of these requests.
14. Security and choices
We use HTTPS connections, read-only calendar permissions, local protection of tokens, reading of the dump and of the radar on the device itself and minimization of what is stored. No system is infallible. Connecting a calendar, allowing capture, the radar, the distraction warning, downloading the speech model, sharing improvement data and sending anonymous usage counts are separate decisions, and everything can be turned off without losing the basic functions.
15. Changes to this policy
If the handling of data changes in a relevant way, this page and the date above will be updated before the new practice starts. The Portuguese version of this policy is the reference text.