Privacy

• Email metadata — sender, recipients, subject, date, thread ID, Gmail labels, and a short snippet (first ~250 characters). We need this to render your inbox.
• Email body — the most recent message body for any thread that has not yet been analyzed. As soon as our AI worker finishes analyzing a thread, we drop the body from our database and keep only the derived summary, suggested action, and category.
• AI-derived data — short summaries, suggested replies, extracted commitments, categorization. These are generated from your emails.
• Account data — your Google ID, email address, OAuth refresh token (so we can keep syncing), and the settings you've configured in the app.
• Usage signals — every action you take in a Blitz session (archive, star, skip, delete) is logged so the categorizer can learn from your behavior. No content is logged, only the action and the category.

• OpenAI. To analyze a thread, we send the subject, sender, and most-recent body to OpenAI's API. Per OpenAI's API terms, they don't train on API requests. Your data leaves our infrastructure briefly during this call and then comes back.
• Supabase. Our database provider. Data is encrypted at rest with AES-256.
• Vercel. Our hosting provider. Vercel sees the HTTP requests and responses but doesn't access the database directly.
• Google. Obviously — we read your mail through Gmail's API on your behalf, with your permission, using the OAuth scope you granted at sign-in.
• The supaflo team. As the operator of this service, we have backend access to user data for support and debugging. We don't read your email for fun and we won't hand it to anyone who isn't legally compelling us to.

• We don't sell your data to anyone.
• We don't show ads.
• We don't share your data with marketing partners.
• We don't read or use your email for any purpose other than running supaflo.

You can delete your account and everything we've stored about you from the Settings page. This is permanent and immediate. It removes:

• Your account record
• Every email thread we've cached
• Every commitment, waiting-on, and AI-generated summary
• Every Blitz session history record and feedback signal
• Your custom categories and corrections
• Your stored Google OAuth refresh token

It does not delete your actual email from Gmail — Gmail is the source of truth, and supaflo only ever reads from it.

If you have questions about how your data is handled, want a copy of what we have on you, or want us to delete something specific rather than your whole account, get in touch.