Last updated: 10 October 2026
This Privacy Policy explains how sidething Ltd ("sidething", "we", "our", or "us") collects, uses, and protects your information when you use our website, app, and related services (collectively, the "Service").
By using sidething, you agree to this Privacy Policy. If you do not agree, please stop using the Service.
sidething Ltd is registered in England and Wales (Company Number 16834072) with its registered office at 14/2E Docklands Business Centre, 10-16 Tiller Road, Canary Wharf, London, E14 8PX, United Kingdom.
The full policy is below. In plain terms:
1.1. Data: any information you provide to sidething or that we collect in connection with your use of the Service.
1.2. Data Protection Laws: all applicable privacy and data protection laws, including the UK GDPR and the Data Protection Act 2018.
1.3. User: any person accessing or using the Service who is not employed by sidething or providing services on its behalf.
1.4. Website: sidething.com and any related subdomains (including app.sidething.com).
2.1. This Privacy Policy applies to sidething Ltd and Users of this Service.
2.2. It does not apply to third-party sites or services linked from sidething.
2.3. For the purposes of data protection laws, sidething Ltd is the data controller responsible for how and why your personal data is processed.
3.1. sidething may collect and process the following types of data:
3.2. Device permissions. On mobile, sidething asks for a device permission only when you use the feature that needs it:
4.1. Directly from you: when you register, update your account, use AI-assisted features, contact us, or use sidething's features.
4.2. Automatically: through technical logs and local analytics.
4.3. Through platform features: when you interact with AI tools, create tasks, participate in Inner Circles, or use other collaborative features within the Service.
4.4. Through automated public-web research: when you apply to join sidething, we look up publicly available information about you to verify your application and prepare context for your sidekick. See Section 8.
4.5. Through your device, with your permission: the microphone when you record a voice note, and the camera or photo library when you choose a photo to upload. See Section 3.2.
5.1. sidething uses your data to:
5.2. We do not sell or rent your data.
5.3. We do not use third-party ad tracking or behavioural targeting.
6.1. Our legal bases for processing your data under the UK GDPR include:
7.1. sidething includes AI-assisted features that help you plan and track progress on your side project: the sidekick chat, roadmap generation, task interpretation, task sorting, web research, the narration in our intelligence features, and voice-note transcription. These features use the third-party providers named below. Our native mobile apps request agreement before their AI-assisted features share your content. On the web, these providers process content as needed to deliver the features you use, without a separate AI consent prompt (see 7.3).
7.2. Who receives your data, and what is sent.
| Feature | Provider | What is sent |
|---|---|---|
| Sidekick chat | Anthropic (Claude models) | Your chat messages and any photos you send, the roadmap and task content the conversation is about, and the profile and business context relevant to your query |
| Roadmap generation | Anthropic (Claude models) | Your onboarding answers about your business, and your existing roadmap and task content when a roadmap is regenerated |
| Onboarding growth recommendations | OpenAI | Your onboarding answers, including your desired payoff, available time, project description and stage, plus relevant website and public research facts |
| Task interpretation | Anthropic (Claude models) | The task content you write and the roadmap content it relates to |
| Task sorting | OpenRouter, routed to TypeSafe | Task titles and descriptions, how soon a task is due, the titles, stage, and done-when text of your roadmap milestones, your project titles and target dates, how many open tasks sit in each column of your board, and, when you set a task aside for now, the reason you give and the titles of up to 40 of your other open tasks, so we can sort, file, and prioritise your tasks quickly |
| Intelligence narration | Anthropic (Claude models) | The signals and metrics computed from your connected tools (see Section 18) and the business context needed to write your brief |
| Voice-note transcription | OpenAI (Whisper) | The audio clip only. It is sent for transcription and is not stored by sidething. Only the transcript is kept |
| Web research for your sidekick | Perplexity and Apify | What your sidekick looks up on the public web to answer your request |
When you allow your sidekick to use your connected tools in a conversation, what it looks up there, such as the text of an email, a calendar entry, or the notes or transcript of a call, is sent to Anthropic as part of that conversation.
When an agent on your team sifts a list for you, the items and the goal it sifts them against are sent to OpenRouter and TypeSafe as well: for example, public posts it found, to work out which are worth your time, or the video ideas it wrote for you and the ones you liked, to pick which to film next. When sidething checks what it knows about your business against your recent work, a short fact and a short excerpt of work you wrote are sent the same way.
If a provider is unavailable. When Anthropic or OpenAI cannot answer a request, for example during an outage, the same request is sent to the same model through OpenRouter, which runs it on Amazon Web Services (Amazon Bedrock), Google Cloud (Vertex AI) or Microsoft Azure. The content sent is exactly what that feature would have sent to Anthropic or OpenAI, as described in the table above, including voice-note audio for transcription. We ask OpenRouter to use only providers that do not retain the requests (OpenRouter's zero data retention setting).
Anthropic does not receive your voice recordings. For growth recommendations, OpenAI also receives the onboarding business context described above. It does not receive your connected private-tool content through this onboarding feature. Apart from the backup requests described above, OpenRouter and TypeSafe only receive the task, milestone, project, and board information described above, plus the items, goals, facts and excerpts described in this section, and do not receive your chat messages, voice recordings, or profile. Perplexity and Apify receive what your sidekick looks up for public-web research.
7.3. Native consent and web processing. In our native mobile apps, the AI disclosure names the providers and data involved and asks you to agree before you use these AI-assisted features. Your agreement is recorded on your account. Choosing "not now" leaves those native features unavailable until you agree. The web app does not show this separate prompt: when you use an AI-assisted feature, relevant content is processed by the providers described in this policy to deliver that feature. To withdraw native consent or request that we stop processing your content for AI features, email support@sidething.com (see Section 20). Some features cannot operate without this processing. Withdrawal does not undo processing that has already occurred. Deleting your account removes your AI interaction data from sidething (see Section 10).
7.4. How the providers handle your data. Providers process requests under their applicable business terms and data policies. Anthropic and OpenAI state that commercial/API inputs and outputs are not used to train their models by default. Retention, security logging, and available data controls vary by provider, endpoint, and configuration. OpenRouter's routing and data policies also apply when a request is sent through it to TypeSafe, or to Amazon Web Services, Google Cloud or Microsoft Azure as a backup. See Anthropic's commercial data policy, OpenAI's business data policy, and OpenRouter's provider policies.
7.5. AI output accuracy: AI-generated content (such as suggested roadmaps, task estimates, and guidance) is provided as a starting point and should not be treated as professional advice. You are responsible for reviewing and verifying any AI-generated output before relying on it.
7.6. Automated processing: Some features involve automated decision-making, such as generating personalised roadmaps or estimating task effort. These automated suggestions are designed to assist you and can be modified or overridden at any time. If you have concerns about automated processing, you may contact us to request information about the logic involved or to request human review of a specific decision.
7.7. Your sidekick on WhatsApp. WhatsApp is optional. You can link it from Connections in the app.
Retention of WhatsApp messages and photos is described in Section 10.
8.1. When you submit an application to join sidething, we automatically run a public-web research pass on the information you give us. We use this to verify your application, prepare context for your sidekick, and shorten our review time.
8.2. What we look at. Only publicly accessible content. Professional profile pages (such as LinkedIn-style profiles), company pages tied to your work email domain, public publications, public directories, and other content an open web search would surface for your name and role.
8.3. What we do not do.
8.4. What we generate. A short research dossier that may include your professional background, current employer and role, location, public projects, and links to your public profiles (such as LinkedIn, X, GitHub, or a personal site). We save the LinkedIn profile we identify so we can complete our review of your application.
8.5. Where it lives. The dossier is stored alongside your application data. Once your account is created, it forms part of your private workspace context and helps your sidekick understand who you are from day one.
8.6. Correcting or removing it. At the end of the application form, you can update anything we got wrong before submitting. After approval, you can edit your profile in account settings or email support@sidething.com to request deletion of your research dossier at any time.
8.7. When we cannot find you. If our research is not confident enough to identify you, we ask you to confirm your LinkedIn directly during the application. Our quality bar, that approved members have a public professional presence, applies either way.
9.1. We share data with a small number of trusted service providers who help us operate sidething:
9.2. Each provider processes data under data protection agreements consistent with UK GDPR requirements. You may request details of these agreements by contacting us.
9.3. We do not sell or rent your data.
9.4. We never share your data with advertisers or social media platforms.
9.5. We maintain an up-to-date list of sub-processors. If you would like to be notified of changes, email support@sidething.com.
10.1. We retain your data while your account is active or as long as required by law.
10.2. You may request deletion of your account at any time.
10.3. Deleting your account. When you delete your account in settings, we cancel any subscription you pay for on a workspace you own, and lock the account straight away so no one can sign in to it. A member of our team then deletes your data from the live system. That step is done by a person, not automatically. When it runs:
Encrypted backups may persist for up to 30 days before being permanently erased.
10.4. Payment and financial data are retained for six years to meet legal requirements.
10.5. Images uploaded in chat are automatically deleted after 90 days unless associated with an admin account.
10.6. Conversation history and AI records. We keep your conversations with your sidekick, and records of the AI requests made for you, to give you your conversation history and to improve your experience. When your account is deleted (see 10.3), the records of AI requests made for you, and your sidekick's memory and summaries of you, are deleted. Your conversations with your sidekick are no longer linked to your account. They stay in the workspace they belong to, and are deleted when that workspace is deleted.
10.7. Applicant research dossiers (see Section 8) are retained for the lifetime of your account plus 30 days, unless you request earlier deletion. If your application is declined, the dossier is deleted within 90 days.
10.8. Photos you send to your sidekick. Photos you send to your sidekick, in the app or on WhatsApp, are kept for 90 days so your sidekick can look at them again when you ask about them. They are then deleted automatically.
10.9. WhatsApp. Your conversation with your sidekick on WhatsApp is kept as conversation history, in the same way as your sidekick chat in the app. Unlinking WhatsApp, or deleting your account, removes your phone number from sidething. Our separate record of each message sent or received on WhatsApp is deleted automatically after 90 days.
10.10. Intelligence feature data (see Section 18). It is kept while your account is active, so your briefs, signals and history stay available to you. Your knowledge bank entries, connector configuration and anonymised benchmarks follow the same rule. All intelligence data is removed when you delete your account.
11.1. We use analytics cookies only if you agree to them. Until you choose, and if you say no, no analytics cookie is set and no analytics event leaves your device. You can change your choice at any time on our Cookies page (sidething.com/cookies).
11.2. Authentication: Your login session is managed using tokens stored in your browser's local storage (not cookies). These tokens are used solely to keep you signed in.
11.3. Analytics, with your consent: If you agree to measurement cookies, we use PostHog and Google Analytics to understand how people use sidething: which pages are viewed, and named steps such as viewing the sign-in page, signing up, or finishing onboarding. PostHog is hosted in the European Union (Frankfurt). When you are signed in, PostHog links these events to your sidething account ID, a random identifier. We do not send it your name, email address or anything you write in sidething, and we remove the parts of web addresses that can carry sign-in tokens or invite codes. We do not record your screen or your clicks. If you withdraw consent, we stop sending events and delete the PostHog cookie and local storage entry from your browser.
11.4. Error reports: When something breaks in sidething, a short error report is sent to PostHog so we can find and fix the fault. It contains the error message, where in our code it happened, the page it happened on, and your browser and device type. Without your consent to measurement cookies, error reports are sent without any cookie or local storage, are not linked to your account, and cannot be tied to you from one visit to the next. We treat them as necessary to keep the Service working. The sidething iOS and Android app sends error reports in the same way. If you have agreed to measurement cookies, error reports are linked to your account ID so we can see which faults affect you.
11.5. Consent preferences: Your choice is stored in a cookie called sidething_consent, or in your browser's local storage if cookies are blocked, so we do not have to ask you again.
11.6. You can clear local storage through your browser settings at any time, though this will sign you out of your account.
12.1. Under UK GDPR, you have the right to:
12.2. To exercise your rights, email support@sidething.com.
12.3. If you are unhappy with how we handle your data, you may contact the Information Commissioner's Office (ICO) at ico.org.uk.
13.1. We use technical and organisational measures to safeguard your data, including:
13.2. Despite these safeguards, no system is completely secure. You acknowledge that data transmission over the internet carries inherent risks.
13.3. If you suspect unauthorised access to your account, contact support@sidething.com immediately.
14.1. Some of our service providers may process data outside the UK or European Economic Area (EEA).
14.2. Whenever data is transferred internationally, we ensure adequate protection through Standard Contractual Clauses, adequacy decisions, or equivalent safeguards in line with UK GDPR.
14.3. You can request more details about these safeguards by contacting us.
15.1. By default, your activity and content on sidething (such as wins, uploads, and responses) are visible only within your Inner Circle or specific collaboration spaces.
15.2. sidething offers an optional Stealth Mode, allowing you to control visibility or pseudonymise your public profile.
15.3. You can enable or disable Stealth Mode at any time in your account settings.
15.4. sidething cannot guarantee complete anonymity for content you voluntarily share publicly.
16.1. If sidething Ltd undergoes a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction.
16.2. Any new owner will continue to handle your data under terms consistent with this Privacy Policy.
16.3. You will be notified if ownership or control changes in a way that materially affects your data rights.
17.1. sidething may include links to other websites or third-party resources.
17.2. We do not control those sites and are not responsible for their privacy practices.
17.3. You should read the privacy policies of any third-party websites you visit.
18.1. Our intelligence features are optional. When you opt in, you can connect external tools so sidething can read your business data and turn it into metrics, a daily brief, and suggested actions. Your sidekick can use it too: it can see your metrics and signals, and when you ask, it can look things up in your connected tools, once you have allowed that in the conversation. You can also switch on roadmap auto-pilot, an off-by-default feature that reorders your own roadmap and logs every move so you can reverse it. We process this data only to provide the Service to you, including the features in this section and your sidekick, and to produce the anonymised benchmarks in 18.3.
18.2. We only read from your connected tools. We do not write to, change, or delete anything in them. When you connect a tool by signing in to it, the access we ask for can be wider than reading: for many tools, including Gmail, Google Calendar, Google Drive, GitHub and Stripe, it would also allow changes. It is our own systems, not the tool, that keep it to reading only.
18.3. We may use your data, only ever anonymised and in aggregate, to produce benchmarks that help founders compare with their peers. No benchmark is drawn from fewer than twenty founders, and none identifies you.
18.4. You can disconnect any tool at any time and request deletion of your intelligence data by emailing support@sidething.com. Retention is described in Section 10.10.
19.1. We may update this Privacy Policy from time to time.
19.2. When changes are made, we will post an updated version at sidething.com/privacy and notify users by email or in-app notice if the updates are material.
19.3. Continued use of the Service after an update means you accept the revised terms.
20.1. For questions, complaints, or data requests, contact us at:
sidething Ltd 14/2E Docklands Business Centre, 10-16 Tiller Road Canary Wharf, London, E14 8PX, United Kingdom
Email: support@sidething.com
21.1. This Privacy Policy is governed by the laws of England and Wales.
21.2. Any disputes arising from it will be handled exclusively by the English courts.
22.1. We take photos and video at sidething events, and attendees sometimes share theirs with us. We say so when you register for an event, and you can ask us at check-in not to be photographed.
22.2. We use these photos and videos to show what our events are like, for example in event recaps on sidething.com, on our social media and in our marketing. We rely on our legitimate interest in showing our events to people who might want to come.
22.3. If you appear in a photo or video we have published and would like it taken down, email support@sidething.com with a link to it or a short description. We will remove it from sidething.com and our own channels and confirm when it is done. We cannot recall copies that other people have already saved or shared.
22.4. We only publish identifiable photos or video of attendees under 18 with signed consent from a parent or guardian.