Perch privacy policy

The short version

• Perch only reaches the accounts you connect and the phone data you turn on. In the app, Settings → What Perch can reach lists exactly what that is right now, and Perch reads the same list when you ask it what it can see.
• Perch can't read your texts or iMessages, listen to your calls, or look through your photos.
• Nothing goes out as you (no email, invitation, shared file, or purchase) until you approve that exact action.
• We don't sell your data, we don't show ads, and we don't use your data for advertising.
• You can delete everything Perch keeps about you from Settings, at any time.

Perch is Scope's personal agent. Scope (formerly Canvascope) is operated by Noel Jubil Sason. In this policy, “we” means Scope. Perch is in development and isn't on the App Store yet; this policy describes how it works today, and we'll update it as Perch changes.

What Perch can reach

Perch works with the accounts you connect. For each one, it can look things up on its own, and it asks you before it does anything that sends, shares, changes, or deletes.

Your Scope account

You connect Gmail, Google Calendar, Google Drive (with Docs, Sheets, Slides, and Forms), Google Contacts, Google Tasks, Canvas, and your Scope library through your Scope account. Perch never sees your Google or Canvas password. It can search and read your email, events, files, contacts, tasks, courses, and saved course materials. Canvas is read-only for Perch: it never submits, posts, or changes anything there.

Keeping an eye out

So it can text you first, Perch checks your connected accounts in the background, even when the app is closed: new email every couple of minutes, your calendar every few minutes, and your courses, files, forms, tasks, and to-dos less often. These checks only read. Perch has the AI read what's new to decide whether it needs you, and anything it prepares, like a reply, waits for your approval. You choose what it keeps an eye on in Settings → What Perch keeps an eye on.

Gradescope

If you connect Gradescope, Perch uses your password once to sign in and doesn't keep it. It keeps the signed-in session, encrypted, to read your courses, assignments, scores, and graded work. It never submits or changes anything in Gradescope.

Other apps you link

You can link other apps in Settings → Connections. Perch keeps each app's sign-in encrypted. It looks things up in them on its own and asks before anything that changes something.

The web

In your own chat with Perch and in Today, Perch can search and read public web pages. It's instructed never to put your private details, like the contents of your email or where you are, into a search.

From your phone

Each of these is off until you turn it on, in Settings → Personal context, Places, or Automations. Perch never shows any of it to a group.

Location

Perch gets your city and where you are to within about a kilometer, plus whether you're away from home. Your exact location stays on your phone, where Apple Maps uses it to work out travel times and search for places. For places you set up, like home or campus, the place's location stays on your phone too: Perch only learns that you arrived or left, when, and for some places how long the trip took.

Calendar and Reminders on your phone

Up to 10 events in the next day, with their titles, times, places, and which calendar they're on, and up to 10 reminders due in the next week.

Apple Health

If you turn on Health, Perch gets a daily summary: how long you slept and when, steps, active energy, exercise and stand time, resting heart rate, heart rate variability, mindful minutes, workouts, and your week's averages. If you also turn on live readings in Automations, your phone sends new readings as they arrive: weight and body measurements, steps, cardio fitness, walking heart rate, heart alerts, sleep, workouts, mindful minutes, and nutrition. Breathing rate, blood oxygen, blood pressure, glucose, body temperature, State of Mind, and medications are sent only if you turn each one on, and you can turn any kind off. Perch never writes to Health, and never reads clinical records or cycle tracking. Health data is used only to help you, and never for advertising.

Shortcuts

If you set up a shortcut that tells Perch something, like “I got a message” with a sender and a preview, or something you spent, Perch gets exactly what the shortcut passes along, and nothing else.

Dictation and notifications

When you tap the mic, Apple's speech recognition turns your voice into text, and Apple may process the audio. Perch only gets the text you send. Notifications from Perch can show names and titles on your lock screen, like who's waiting on a reply, your next class, or a heart alert.

What Perch can't reach

Whatever you connect, Perch has no way to reach:

• Your texts and iMessages. Perch sees a message only if you paste it in, or set up a shortcut that passes one along.
• Phone calls and voicemail.
• Your photos and camera. The only image the app ever sends is a screenshot you choose to attach to a problem report.
• Your phone's contacts. Perch only sees Google Contacts, when Google is connected.
• Other apps on your phone.

What Perch remembers

Perch remembers short facts you tell it about yourself, like your school, what you like to eat, or how you want it to write. It also makes a few guesses from your accounts, like your name and current courses, and marks them as guesses until you confirm them. Each time it remembers something, you see a note with an undo.

Perch never guesses about your health, religion, sexuality, politics, immigration status, race or ethnicity, criminal history, public benefits, or exact finances. It saves one of those only when you explicitly ask it to. It won't save passwords, ID numbers, contact details, or street addresses.

See, fix, or delete anything in Settings → What Perch knows about you, or turn memory off. What Perch remembers is never shared with a group unless you approve it.

Other people

Perch keeps only a name and how you know someone, and only when you tell it, like “Maya is my roommate.” It doesn't build notes about people from your email or your group chats. Ask Perch “what do you know about Maya?” to see exactly what it has, and delete it in Settings → What Perch knows about you.

Your conversations with Perch can include what other people wrote, like an email Perch read for you or messages in a group you're in. That stays with your account and is deleted with your Perch data. If you don't use Perch and want something about you removed, email us at canvascopeextension@gmail.com.

Messages Perch sends for you

When Perch writes an email, answers an invitation, or shares a file for you, it shows you a card with exactly who it goes to and everything it says. Nothing is sent until you tap Approve, and you can edit it first. It goes from your own account, as you.

Perch doesn't add a line saying an assistant wrote it. If you'd like your messages to say so, ask Perch to add one, and you'll see it in each draft before you approve.

In group chats, Perch speaks as your Perch, marked as an agent, never as you. It can reply there on its own, within what you let it share with that group.

Group chats and plans

• Other members see your messages, your Perch's replies, your name, and what you choose to share with that group: when you're free, a rough area, a budget level, or preferences.
• When you're free is shared by default in each group, as times on a half-hour grid, never what you're doing. Turn it off in the group's info.
• Plans start with a private card where you approve what Perch may answer. Perch then answers only yes or no, or puts options in order. It never shares your calendar, your exact budget, or your exact location. A rough area of about 5 km is shared only if you turn it on.
• Scope Mesh, the Scope service that runs groups and plans, stores group messages and plan answers, and we can read them as its operator.
• Leaving a group, or deleting your Perch data, doesn't remove messages you already sent from the group or from other members' copies, the same as any group chat.
• Anyone with a group's invite code can see the group's name, how many people are in it, and their names.

Its computer, saved sign-ins, and purchases

Perch's computer

Perch has a private browser in the cloud that only it and you use. It keeps its sign-ins and files between uses, so you don't have to sign in again. Perch asks before anything there that sends, buys, posts, or deletes, and the first time it signs in to a site. Screenshots of it hide passwords and card numbers. You can watch it and take over in Settings → Perch's computer.

Saved sign-ins

Passwords and two-factor codes you save are encrypted. The AI never sees them: Perch fills them in only on the site you saved them for, and asks the first time it uses one on each site. The app asks for Face ID before it shows or changes them.

Purchases

Perch buys only what you asked for, and only after you approve each purchase, with Face ID in Perch or in the Link app, within limits you set. Payments go through Stripe. When you approve, a card number made for that one purchase is used to fill in the store's checkout on Perch's computer. Perch doesn't store that number or show it to the AI; it keeps the store, the amount, what you bought, and the card's last four digits. If you pay with Link, the card you saved in Link never reaches Perch.

The AI behind Perch

Perch uses Claude, made by Anthropic, to read and write. For each reply, Perch sends Anthropic what that reply needs: your message, the conversation so far, what Perch looked up for it (like an email or an event), what it remembers about you, what your phone shares about your day, and the list of what it can reach.

Under Anthropic's terms for business customers, Anthropic doesn't use this data to train its models. Anthropic may keep it for a limited time under its own retention policy, for example to check for misuse. We don't have a zero-retention arrangement with Anthropic today.

AI can get things wrong. That's why every send, change, and purchase waits for you.

Who else handles your data

We don't sell or rent your data, and there are no ads, ad trackers, or analytics tools in the Perch app or on this site. These services handle your data only to run Perch:

• Anthropic runs the AI.
• Scope holds your Google and Canvas connections in your Scope account, and runs groups and plans through Scope Mesh.
• Neon hosts Perch's database, and Hetzner hosts its servers and Perch's computer.
• Apple delivers notifications, and on your phone handles maps, travel times, and dictation.
• Stripe, and Link if you use it, handle purchases.
• Open-Meteo gives Perch the weather for your rough location.
• OpenStreetMap, or Google Places, finds places for plans, around a rough area.
• Gradescope and any apps you link, when Perch reads them for you.

We may also share information when the law requires it, or to protect someone from serious harm.

How your data is protected

Sign-ins to your accounts, saved passwords, what Perch remembers, what your phone shares, health readings, the activity log, and problem reports are encrypted on our servers, with a key only the server holds. Your conversations are stored so Perch can show your history; they're protected by access controls but don't have that extra layer of encryption. Perch isn't end-to-end encrypted.

The people who run Perch can technically access stored data. We do so only to keep Perch working and secure, or when you ask us for help. Server logs record when Perch was used and for which account, never what you wrote, and are kept for a limited time.

How long Perch keeps things

Deleted data can stay in our database host's backups until those backups expire.

Deleting your data

In Settings → Delete my Perch data. It deletes your account, conversations, approvals, memory, everything your phone shared, health readings and trends, saved sign-ins, connected apps and Gradescope (and signs Perch out of them), your Link connection (and cancels any open purchase cards), Perch's computer with its browser and files, the tools it built, your notification settings, your problem reports, and the activity log. It leaves your groups and any plans still being worked out. Our tests check that nothing else tied to you is left behind.

A few things stay:

• Messages you sent in groups, and answers you gave to plans, stay with the group and in Scope Mesh.
• Daily usage counts (how many requests, how much text, what it cost, never what you wrote), so we can keep Perch's total spending in check. After deletion they're tied to an ID that no longer leads to you.
• How many invite codes your Scope account received, so deleting and starting over can't mint more.
• Backups, until they expire.

Deleting your Perch data doesn't delete your Scope account, or anything in your Google, Canvas, or Gradescope accounts: an email you approved stays sent. To delete your Scope account, see Scope's privacy policy.

Your choices

• Turn each phone source on or off, or tap Forget it now, in Settings → Personal context.
• See, edit, or delete memories, or turn memory off.
• Connect or disconnect accounts and apps in Settings → Connections.
• Choose what Perch keeps an eye on and how often it texts you.
• Change what you share with each group in its info.
• Ask us for a copy of what Perch keeps about you, or to correct it, at canvascopeextension@gmail.com.

Children

Perch isn't meant for anyone under 13, and we don't knowingly collect data from children under 13.

Changes

When this policy changes, we'll update this page and its date. If a change affects what Perch collects or who sees it, we'll tell you in the app first.

Contact

Email canvascopeextension@gmail.com, or use Settings → Report a problem in the app. Back to Perch.