Privacy Policy

Last updated 11 November 2026

This describes what Current collects, why, who else sees it, and how to get it back or get rid of it. It is specific on purpose: a privacy policy that could describe any product describes nothing.

What we hold about you

• Your account — your email address, your name and profile picture if you sign in with Google or Microsoft, and a one-way hash of your password if you set one. We never store a password itself.
• Your workspace data — the prospects you import or add, and everything attached to them: companies, contacts, phone numbers, email addresses, notes, activities, follow-ups, and any fields you define yourself.
• Call records — the number dialled, when, how long it lasted, and the outcome you logged.
• Sessions — a signed-in session, stored in our database rather than in a cookie, so signing out on our side genuinely ends it.

Where recordings live

Call recordings are stored by Twilio, on the account the call was placed from — not on Current's servers. When you play one, we fetch it from Twilio and pass it through; we keep only the identifier needed to find it again. Deleting a recording from Twilio deletes it.

If you switch on transcripts, Twilio transcribes the recording on the same account and Current keeps a copy of the text with the call, so it can be read, searched and asked about. It is deleted with the prospect it belongs to.

Call summaries

When a call has a transcript, Current can send it to Anthropic — with the name of the business and when the call was made — so that its Claude models can suggest how the call went, a note and a follow-up, and coach you on the call. The suggestion is saved with the call, and nothing is added to the prospect until you press Apply. Under Anthropic’s commercial terms, this content is not used to train its models.

If you paste text into the import box and choose to have Claude read it, that text is sent to Anthropic, in pieces, so the businesses and people in it can be listed for you to check. Nothing is added until you press Add, and the text itself isn’t kept.

Separately, if you connect an AI assistant such as Claude or ChatGPT to Current yourself, it reads and changes your workspace only when you ask it to, under the terms of your own account with that assistant. Anything it changes is marked in the prospect’s history with the assistant’s name, and you can disconnect it at any time in Settings.

How Current uses Google user data

What we access. If you sign in with Google: your name, email address and profile picture. If you connect Gmail: permission to send email as you, and your Gmail address. Current cannot read, search, delete or change anything in your mailbox.

How we use it. Your name, email and picture identify you in Current and sign you in. Gmail access is used only to send the emails you write or approve in Current, including campaign emails you launch, to the people you choose. Each one is recorded in your workspace.

How we store and protect it. The Gmail permission is kept as an encrypted token in our database. Your profile details are stored with your account. Everything is sent over HTTPS.

Who we share it with. No one. We don’t sell it, use it for advertising, let people read it, or use it to train AI models. Google itself handles the sending.

Keeping and deleting it. Disconnecting Gmail in Settings deletes the token and asks Google to revoke it. Closing your account in Settings removes your profile details. You can also remove Current’s access from your Google account at any time.

Current’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we collect to keep it working

• Failed sign-ins — the email address tried and the network address it came from, so repeated guessing can be slowed. These are deleted after one hour.
• Sign-in codes — when you ask us to email you a code, we use your address to send it and keep only a one-way hash of the address and of the code, so we can check it when you type it in. The code is deleted when it's used or after ten minutes. We also count how many codes an address and a network have asked for, so the form can't be used to flood someone's inbox; those counts are deleted after an hour.
• Errors — when a page fails, your browser sends us the error, where it happened and what browser you were using, so we can find out why. We do not send the contents of the page.
• Server logs — ordinary request logs kept by our host, retained for a short period.
• Where you came from — if the link that first brought you here carried a campaign tag, or another site sent you, your browser remembers that and passes it on once when you make an account. We keep it with your account to learn which places bring people in. It is read from the address you arrived on, by our own code; no tracking service is involved and it is never shared.
• Visit counts — before you have an account, your browser adds one to an anonymous daily count when you first arrive, when you open the sign-in page, when you press a way to sign in, and when you ask for or open an emailed link. Each count records only the campaign tag that brought you, whether you were on a phone, and whether you were inside another app’s built-in browser. Nothing in it identifies you or your browser: no cookie, no ID, and your network address is not kept. It tells us where people stop, not who they are.
• A link for your computer — on a phone, you can ask us to email you a link to open Current on your computer. We use your email address to send that one message and don’t keep it. To stop the form being used to flood someone’s inbox, we count requests per day against a one-way, salted fingerprint of the address and of your network address, which can’t be turned back into either, and delete those counts after two days. You get no other email from us unless you sign up.

There is no advertising in Current, no analytics or tracking scripts, no third-party cookies, and nothing that follows you to other sites.

Who else processes it

We use a small number of services to run Current. Each sees only what its job needs.

• Neon — the database everything is stored in.
• Netlify — hosting and serving the application.
• Twilio — placing calls, and storing recordings if you record.
• Google and Microsoft — only if you sign in with them, and only to confirm who you are.
• SendGrid — sending workspace invitations, if configured.
• Resend — Current's own emails to you: a few tips while you're getting started, a note if you've been away a while, and the link for your computer if you ask for one. Every tip and note has a link to stop them.
• Google (Gmail) — sending the emails you write, from your own Gmail, if you connect it.
• Twilio — calls and text messages, sent through the Twilio account you connect yourself.
• Stripe — taking payment for Pro, if you subscribe. Your card details go to Stripe and never reach us.
• Anthropic — reading call transcripts to suggest an outcome, note and follow-up and to coach you on the call, reading the notes on prospects you've called before to say which look worth calling back, and reading text you paste and ask it to read.

We do not sell personal information, and we do not share it for advertising. We disclose it only to these processors, when the law compels us, or to protect someone from harm.

The people in your list

Most of the personal data in Current is not about you — it is about the people and businesses you are contacting. You decided to collect it, so under data protection law you are the controller of it and we are processing it for you. That means you are responsible for having a lawful reason to hold it, for honouring requests from those people, and for not importing lists you should not have.

Every email Current sends to a prospect carries your business address and a link to stop further emails. Using it adds that address to your workspace’s unsubscribe list and marks the prospect do-not-contact; Current will not email that address from your workspace again. The page behind the link asks nothing of them and sets no cookies.

When someone asks not to be contacted, mark them do-not-contact. That is permanent, it survives re-importing the same list, and it takes them out of every queue.

How long we keep it

Your workspace data stays until you delete it or close your account. Failed sign-in records last an hour, and sign-in codes ten minutes. Error reports and logs are kept for a short period and then expire. Closing your account removes your sign-in and any workspace only you belong to; backups containing it expire shortly afterwards.

Getting it back, or getting rid of it

Both are in Settings and neither needs anyone's approval. You can export every prospect, every logged activity and every call as CSV, or the whole workspace as JSON with every field we store — including ones no screen shows. You can close your account from the same page.

Depending on where you live you may also have rights to correct, restrict or object to our use of your personal data. Ask and we will do it.

Security

Traffic is encrypted in transit. Passwords are hashed, never stored. Access granted to an AI assistant is kept only as a one-way hash and is limited to the one workspace you chose. Every query is scoped to the workspace it belongs to. Repeated failed sign-ins are throttled. No system is perfectly secure, and we will tell you promptly if something happens that affects your data.

Children

Current is for business use and is not intended for anyone under 16.

Changes and contact

Current is run by Mirabal Ventures LLC, which is responsible for the personal information described here. If this policy changes materially we will say so in the app before it takes effect. For anything at all — a question, a correction, a deletion request — write to hello@obramade.com.