Security & trust
Security you can check for yourself
We hold sensitive data pulled from your inbox, so security is something we take seriously. Here is exactly how that data is protected, and what we will never do with it. Every line below is something the software actually enforces.
Metadata only
We read headers — sender, subject, date — and never your message content.
Crypto-shred purge
Delete your account and your per-user key is destroyed, leaving everything unreadable.
Verifiable mandate
Every request goes out under a signature anyone can independently verify.
Encrypted per user
Your stored data is protected with Tink envelope encryption, under a key that belongs to your account alone (a unique data-encryption key wrapped just for you). Tokens, mandates, and replies are all encrypted at rest.
Strict cross-user isolation
PostgreSQL Row-Level Security (RLS) enforces isolation in the database itself, so you only ever touch your own rows. There is no path to another user's data. The database enforces that, so the guarantee holds even if we write a query wrong.
Gmail metadata only
We use the gmail.metadata scope, which means headers: sender, subject, and date. We never read your message bodies or attachments, and we can't run a full-text search of your mailbox. Discovery works from metadata alone.
Deletion by crypto-shred
Delete your account and we crypto-shred it. We destroy your per-user key, which leaves everything we stored permanently unreadable. Disconnecting a mailbox is a separate, lighter action: it revokes access but keeps the data you've already discovered.
Grounded in real law
Every request we send cites the right legal basis for where you live: GDPR Article 17 (the right to erasure) in the EU, and the CCPA right-to-delete in California. We've supported both since day one. We're also honest about the limit, though. We can't force a company to act.
The constraints we publish are the same ones the product enforces. Here is what we will never do.
What we'll never do
Never sell or share your data
We never sell your information. The only thing that ever leaves our systems is a deletion request you authorized yourself, sent to a company you picked.
Never read your email content
We use the gmail.metadata scope, so we only ever see headers: sender, subject, and date. We never read the body of a message or open an attachment.
Never fake or forge a send
Every request is real and goes out on your behalf, under an authorization mandate you signed and anyone can verify. We never fabricate or forge a send.
Never use third-party trackers
No third-party analytics, no outside scripts, no hosted fonts. The site and the app are same-origin only, so nothing about you gets shipped off to a tracker.
Privacy you don’t have to take on faith