Privacy & Data Usage
What Gmail data Selyf reads and stores, what reaches an AI provider and when, retention, and how deletion works -- the developer-facing counterpart to the public Privacy page.
This is the developer-facing technical counterpart to selyf.com’s own Privacy page, which remains the primary, most current statement of this policy. See also Gmail integration and AI analysis & drafting for how these data flows work technically.
What Gmail data is read
A sync reads inbox message metadata: subject, sender, a short snippet, timestamps, and unread status. Opening a specific thread additionally fetches that message’s full body and attachment metadata (filename, type, size -- never attachment contents) from Gmail, and caches it so it is not re-fetched on the next view. This only happens for a thread actively opened, never in bulk and never on a schedule.
What's stored
The metadata above; the full body and attachment metadata of any opened thread; AI analysis results (priority, reply status, reason, suggested action, confidence) for analyzed threads; and the account/session records needed to keep a user signed in. The OAuth refresh token is stored encrypted (AES-256-GCM), never in plain text.
Compliance with Google's Limited Use requirements
Selyf's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: Gmail data is never used for advertising, in any form; Gmail data is never used to train AI models -- not a Selyf model (Selyf does not train any models), and not the underlying AI provider's; and Gmail data is used only to provide the Gmail features in the product itself. The gmail.readonly scope (see Authentication) is the only Gmail permission requested, used strictly for these read-only purposes.
What's sent to the AI provider
When an analysis or draft is requested for a specific thread, that thread’s message content is sent to the configured AI provider (Anthropic or Gemini) to generate the result -- only for a thread explicitly opened and acted on, never in bulk or on a schedule. An analyzed message’s result is cached, so the same message is never re-sent a second time.
How draft requests are handled
Generating a draft sends the thread’s content and the requested tone to the same AI provider and returns editable text that exists only in the browser tab. Nothing is written to Gmail, saved as a Gmail draft, or sent anywhere -- the only action available is copying the text to the clipboard.
Retention
Data retention follows the service’s configured retention policy. This codebase’s own schema defaults, for reference, are: 180 days for AI usage records, 90 days for a disconnected account’s Gmail metadata and analyses, and a 730-day minimization ceiling for an active account’s Gmail metadata -- each independently configurable, and none of it a substitute for deleting an account outright, which removes everything immediately rather than waiting on any window.
Audit logs
Security-relevant events (connecting an account, disconnecting, a failed OAuth attempt, account deletion) are recorded in an internal audit log used for security investigation, not analytics or profiling. Deleting an account anonymizes this log rather than leaving identifying information attached to it.
Disconnect vs. delete
Disconnecting revokes Gmail access with Google and ends the session immediately, but previously-synced metadata and analysis results are not automatically deleted -- they remain stored until either a reconnect (sync simply resumes) or an account deletion. Deleting an account removes everything immediately: the Google connection, all synced metadata and message bodies, all AI analysis results, and the account itself.
Third parties
Three categories of third party ever see any data: Google (as the source of Gmail data, under the terms of the OAuth scope granted), the configured AI provider (Anthropic or Gemini, for the specific thread content chosen to analyze or draft a reply for), and the product-analytics provider, which receives only non-identifying event names and properties -- never Gmail content, never an email address. Selyf does not sell, share, or otherwise provide account data to anyone else.
This page is a factual description of how the product currently works. It is not legal advice.