How we protect your data
The specific precautions behind the privacy notice, not marketing language.
Read-only, metadata-only Gmail access
The Google scope we request is gmail.readonly, and every message fetch uses Gmail's metadata format restricted to four headers (From, Date, List-Unsubscribe, List-Unsubscribe-Post). The message body is never requested, so it's never something we could store even by mistake.
Your Gmail token is encrypted at rest
The refresh token that lets us reconnect to your Gmail account is encrypted with AES-256-GCM before it's stored, using a key that only exists as a server environment variable, never in the database itself. Deleting your data (Settings → Danger Zone) deletes this token outright.
Row-level security, not just application logic
Every table is protected by a Postgres row-level security policy requiring auth.uid() = user_id. That check happens at the database layer, so even a bug in the app's own code couldn't leak one user's rows to another user's session.
No admin/service-role access at runtime
The app never uses a Supabase service-role key, which is the credential that bypasses row-level security entirely. Every request the app makes runs as the signed-in user, with the same restrictions row-level security places on you.
Testing-mode Google access
This app's Google OAuth app is in Testing status, meaning only accounts explicitly added as test users can connect Gmail at all. It has not gone through Google's public app verification process, and won't until it's ready for a wider release.
Self-service export and delete
You can download everything stored about you as JSON, or permanently delete it, at any time from Settings. Nobody has to ask us to do this on your behalf.