Privacy Policy

Last updated: October 13, 2026

This is our standard privacy policy for Goose. If your company needs a data processing addendum (DPA), write to privacy@goose.pm and we’ll send our enterprise DPA.

The short version

• Your company owns the data in its Goose workspace. We process it on your company’s behalf, to run Goose for you.
• We don’t sell personal information, we don’t show ads, and we don’t use your data to train AI models.
• We use a session cookie to keep you signed in. No advertising or cross-site tracking cookies.
• You can export your workspace at any time, and we delete it after you leave.

1. Who we are

Goose (goose.pm) is operated by Paragon (“we”, “us”). This policy explains what information we handle when you use Goose, visit our website, or receive a message or link sent through Goose. It works alongside our Terms of Service.

2. Two kinds of data, two roles

Customer Data — we act for your company

The clients, contacts, vendors, projects, messages, call recordings, documents and financial records a company keeps in its workspace are its Customer Data. The company decides what goes in and who can see it; for that data we are a service provider (a “processor”). We use Customer Data only to provide, secure and support Goose for that company, as it instructs. If you’re a client, vendor or contact of a company that uses Goose and you have a question about your information, please contact that company first — we’ll help them respond.

Account and usage data — we act for ourselves

For the information we need to run the service itself — your account, billing contact, security logs, and how the product is used — Paragon is responsible (a “controller”). The rest of this policy describes that information and how we treat both kinds.

3. What we collect

• Account information: name, work email, password (stored only as a salted hash), two-factor settings, the workspaces you belong to and your role.
• Sign-in with Microsoft: if you choose it, your name, email and Microsoft account identifier. If you connect your mailbox, the mail and calendar data you sync.
• Billing information: company name, billing contact and plan. Card details are collected and stored by Stripe, never by us.
• Customer Data that you and your team enter, upload, sync, send or receive.
• Technical and security data: IP address, browser and device type, sign-in times, and a record of changes made in your workspace (the audit log). For e-signatures we keep the evidence the law expects: time, IP address, user agent and a fingerprint of the signed document.
• Support conversations when you write to us.

4. How we use it

• To provide Goose: sign you in, sync your workspace, send the messages you ask it to send, and run the integrations you connect.
• To keep Goose secure: detect abuse, enforce rate limits, investigate incidents and keep the audit trail.
• To bill for paid plans and to send service notices (sign-in codes, security alerts, changes to these policies).
• To support you, and — using aggregated or de-identified usage information — to fix bugs and improve the product.
• To meet legal obligations.

We don’t sell or rent personal information, and we don’t share it for cross-context behavioral advertising.

5. AI features

When AI features are on, the content needed for a request (for example, a document being read or the thread being summarized) is sent through OpenRouter to the model provider that handles it, and the answer comes back to your workspace. We choose providers and settings that don’t use API traffic to train models, and we don’t use your data to train models ourselves. Workspace owners can turn AI off entirely in Settings → AI & models.

6. Subprocessors

We use a small number of service providers to run Goose. Each is bound by a contract that limits its use of data to providing its service to us. Some only receive data when your workspace turns on the feature that uses them.

We’ll update this list before adding a subprocessor that handles Customer Data. Enterprise customers with a DPA are notified in advance and can object.

7. Security

• All traffic to Goose is encrypted with TLS. Data at rest is stored on encrypted infrastructure.
• Each workspace is isolated from every other in the database itself, with row-level security on every table.
• Passwords are hashed; sign-in codes expire after 10 minutes; two-factor authentication (TOTP) is available to everyone.
• Links sent to clients and vendors carry random, single-purpose tokens that we store only as hashes and that can be revoked. API keys are hashed too.
• Webhooks from our providers are signature-checked. Every change in a workspace is recorded in its audit log.
• Uploads can be scanned for malware. Our staff access Customer Data only to provide support you ask for, or to keep the service secure, and that access is logged.

No system is perfectly secure. If we learn of a breach affecting your information, we’ll notify affected customers without undue delay and as the law requires. To report a vulnerability, write to support@goose.pm.

8. Retention, export and deletion

• Customer Data stays in your workspace until you delete it or close the workspace. Deleted records go to a recycle bin first so mistakes can be undone; owners can purge them.
• You can export the whole workspace at any time from Settings → Data → Export (JSON or CSV). Export files expire automatically.
• When a workspace is closed we keep its data for 30 days, then delete it from the live service. Backups roll off within a further 35 days.
• Account and billing records may be kept longer where the law requires (for example, tax records). Security logs are kept for up to 12 months.
• Sample data added at sign-up is marked as such and can be removed with one action.

9. Cookies

Goose uses only the cookies it needs to work: a session cookie that keeps you signed in, and short-lived security cookies used during sign-in. We don’t use advertising cookies, and we don’t track you across other sites. Your appearance preferences are stored in your own browser.

10. Your choices and rights

You can see and update your profile in Goose, and change notification and appearance settings at any time. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict certain processing. To use these rights for your account, write to privacy@goose.pm. For information held in a company’s workspace, contact that company; we’ll support their response. We won’t treat you differently for using your rights.

If you receive texts sent through Goose, reply STOP to opt out and HELP for help. Marketing email sent through Goose includes an unsubscribe link.

11. Where data is stored

Goose is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the US. Where required, we rely on appropriate safeguards such as standard contractual clauses, available in our DPA.

12. Children

Goose is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect personal information from children. If you believe a child has given us information, contact privacy@goose.pm and we’ll delete it.

13. Changes to this policy

We’ll update this policy as Goose changes. If a change is significant, we’ll tell workspace owners by email or in the app before it takes effect, and update the date at the top.

14. Contact

Privacy questions and requests: privacy@goose.pm. Legal notices: legal@goose.pm. Everything else: support@goose.pm.