How it works

One assistant. Many models. You still know where your data went.

Most AI tools tie you to a single model. Friday doesn't. He reads what you asked for and sends it to whichever model suits it, then tells you which one answered. This page explains how that choice is made, and what kind of company is allowed to see what.

How a message gets answered

1. 1
   Friday reads the request. A quick question and a long piece of reasoning need different models. He decides which this is before spending anything.
2. 2
   He checks what the request touches. If it involves your email, calendar, notes or saved memories, that changes which providers are allowed to see it, see below.
3. 3
   He picks a model and answers. Simple work goes to a fast, inexpensive model. Hard work goes to a frontier one. The point is to stop spending frontier prices on questions that don't need them.
4. 4
   If a provider is down, he keeps working. Rather than failing, Friday falls through to another model that is approved for whatever the request contains.

What happens to private things

Some of what you give Friday is more sensitive than the rest, your inbox, your calendar, your notes, the documents you upload. When a request involves those, Friday restricts it to providers we've approved for it. Providers we haven't approved are not sent the request, and are not offered the tools that could reach it.

Everything else, Friday sends to whichever model suits the request best for its price, and some of those providers are in China. Your saved memories, the facts Friday keeps about you so it doesn't have to ask twice, which can include details it picked up from your conversations and connected accounts, travel with those requests too, unless you switch on Keep my data with US providers in Settings, under Privacy. That keeps everything you send with the approved US providers.

When you give a team of agents a job to work through, that path is stricter still: it only uses approved providers, whether or not the content looks sensitive, and if none are available the job fails and tells you rather than quietly using someone else. We are still extending that same restriction to the remaining background jobs, so we will not yet claim it holds everywhere, our Privacy Policy says the same, and we would rather the two pages agree than sound impressive.

Who sees your data

Every kind of company below receives something when you use Friday, a message, a file, a search term, or just the fact that you loaded a page. They are all here, including the ones whose terms we don't like. We publish them as categories rather than by name: the full list, with each company's terms and the date we last read them, is in the data processing agreement every business customer receives, and anyone can ask for it.

With one exception, and it matters: the row marked Services you opt in to (e‑signature, media generation, payments, messaging) receives nothing at all unless you connect your own account or your own key with one of those companies. Until you do, they have never had a byte of yours. Once you do, they get what that specific job needs and nothing else. That is a different claim from the rest of the table, so we say it here rather than let the layout blur the two, see Accounts you connect.

The page fonts and scripts row receives your IP address with the request and nothing else. The model rows are generated from the same configuration the router enforces, so who is allowed to receive a prompt cannot drift from what the software actually does; a company joining or leaving the policy moves a count on this page. The supporting-service rows are maintained by hand: nothing in the code checks them, so treat them as our written statement rather than something the software proves. Tell us if you find one out of date.

A mail provider carries our email. Broom’s own mail runs on a mail provider in the United States. Every email we send, your address confirmation, a group or project invite, an alert, and any message Friday sends to another person once you have approved that specific message, is handed to its mail servers in readable form. When Friday is waiting on a reply to one of those, someone answering an invite, or answering a question he sent on your behalf, he reads it from the same mailbox. This is about email only: an ordinary message you send Friday sends no email at all and never touches this path.

Accounts you connect

The table above is companies we chose. Connecting your own accounts adds more, and you should know what that does before you do it.

Friday can also do jobs it has no native wiring for by using your key with an outside service: it names the service, links you to that service's own page for creating a key, and once you paste the key it drives the service for you. The vetted routes today are Replicate (generate video from a prompt), Shotstack (edit and assemble video), Netlify (deploy and host a live site), Twilio (send SMS and WhatsApp messages), Ayrshare (post to social media) and Dropbox Sign (send a document out for e-signature). These are named because they are your integrations, not our suppliers: you choose one, you hold the key, and it acts for you, on your account with that company. Connecting one is what puts that company in the table above, under Services you opt in to. Before you do, it has received nothing from us, and disconnecting stops it again. The key is stored encrypted, bound to that one service's API host, and is never shown again.

Some of these reach someone who is not you, Twilio, Ayrshare and Dropbox Sign. Nothing goes out to another person on your behalf without your explicit approval of that specific message, every time, including when a minion proposes it on its schedule. Connecting the account does not grant standing permission to send.

If you connect Gmail, Google Calendar or Notion, Friday reads from them on your behalf. That doesn't hand your mail to a company that didn't already have it. Google already holds your Gmail. What it does mean is that anything Friday reads from those accounts can become part of a message to a model, and is then subject to everything above: it is treated as private, so only approved providers can see it.

Where it is switched on for your account, apps Friday builds for you (a booking app, an order form, a member list) keep their records in your own Supabase project. You connect it with an access token you create on Supabase's own site; Friday uses it to set up the app's tables and security rules, then checks those rules with test entries it deletes straight away. Your customers' records stay in your project and Friday does not keep a copy. Nothing reads them on a schedule: on a free project, one small daily check reads a single placeholder row so Supabase doesn't pause it.

Friday can also connect to other tools through a standard called MCP. Those appear in a directory in the app, and none of them receive anything until you connect one yourself. When you do, you are choosing to add that company to this list. Disconnecting stops it.

What we don’t claim

Vendor terms last read 13 October 2026. The rows above are checked by hand against each provider’s published terms.

Questions

If you want to know which provider handled a particular request, or you'd rather we switched a provider off for your account entirely, email youssef@broomit.net and we'll do it.

See also our Privacy Policy and Terms of Service.