Privacy Policy

1. Introduction

Conduit Mail ("Conduit Mail," "we," "us," or "our") is operated by Conduit Labs LLC, a New York limited liability company based in New York, NY. This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered email client available at in.conduitmail.app(the "Service").

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

For questions about this policy, contact us atprivacy@conduitmail.app.

2. Information We Collect

2.1 Account Information

When you sign in via Google, or connect a Google or Microsoft (Outlook) email account, we receive:

• Your email address
• Your display name and profile photo (as provided by the identity provider)
• OAuth tokens (used to access your email on your behalf)

When you connect an email account via IMAP/SMTP (e.g., Yahoo, AOL, iCloud, Fastmail, or a custom mail server), we collect:

• Your email address
• Your IMAP/SMTP credentials (username and app-specific password)
• Your mail server hostname, port, and connection settings

When a free trial starts, we also record a time zone for it: the one reported when the trial is started, and UTC if we do not receive a usable one. We use it to state trial times in any messages we send you about the trial, including any reminder we send before a trial ends.

2.2 Email Data

When you connect your email account, we access the following via the Gmail API, the Microsoft Graph API (for Outlook accounts), or the IMAP protocol (depending on your email provider):

• Email messages (subject, body, headers, attachments metadata)
• Labels, folders, and mailbox metadata
• Contact information associated with your messages

Important: Email content is stored locally in your browser using IndexedDB. We do not store the content of your emails on our servers. Exceptions stored server-side (as described in Section 2.3): content you choose to save — notes you create from an email, or email content captured into notes or AI memory by rules you configure — and short writing samples from your sent mail (body excerpts, plus recipient and subject as metadata), and, briefly, files and messages your connected applications ask Conduit to send (see Section 2.5). Writing samples are collected by default so drafts can match your tone across devices; you can turn them off in Settings → Writing style. For IMAP accounts, email data is fetched via our server (which acts as a proxy to your mail server) but is not persisted server-side — it is transmitted to your browser and stored only in your local IndexedDB database.

2.3 User-Created Content

You may create the following within the Service, which is stored server-side:

• Email rules and automation configurations (including webhook URLs you configure)
• Notes and saved content you create, including notes captured from emails by your rules
• Short writing samples from sent mail (body excerpts, recipient, and subject as metadata), unless you disable this in Settings → Writing style
• Account settings and preferences
• AI memory and personalization data — this includes conversation context, preferences, and instructions you provide to the AI assistant so it can better assist you over time
• Blocked sender lists

2.4 Automatically Collected Information

• Usage analytics (pages visited, features used) via PostHog
• Error and crash reports via Sentry
• Device and browser information (user agent, screen size)

2.5 Connected Applications (Integrations)

You may authorize third-party applications — such as an AI assistant connected through the Model Context Protocol (MCP) — to access your Conduit data on your behalf. When you authorize an application, you grant it access at the capability level shown on the consent screen (for example: reading your email, managing your automation rules, or managing your notes). You choose which capabilities to grant, and you can withhold any of them.

Access is all-or-nothing per capability: a capability you grant applies toall of your connected email accounts, not a subset. Linking an email account to Conduit means that account is available to Conduit’s features and to any integration you authorize for the capabilities you approve. If you do not want an application to reach a given capability (for example, notes that may contain content captured from your email), do not grant that capability. You can review every connected application and revoke its access at any time in Settings → Integrations; revocation takes effect within seconds.

When a connected application sends or drafts email for you, Conduit holds what it hands us for a short time. The contents of a file the application attaches are encrypted with AES-256-GCM; the file's name, type, size and checksum are kept alongside, not encrypted. A file is deleted after the email that uses it sends. Otherwise (a draft, a canceled send, or a file never used) it stays until it expires: 24 hours after it was added, or one hour after a delayed email's send time if that is later. An expired file is typically removed within about a day after it expires. If you have an undo-send delay, an email the application sends is held until its send time, which is at most 24 hours away, and its body, subject and recipients are encrypted with AES-256-GCM. We erase that content as soon as the email sends or you cancel it. Canceling does not delete the email's attached files, which stay until they expire. A record without message content (which mailbox, status, times and any error) stays for 7 days after the send time, canceled sends included. Everything described in this paragraph is deleted when you delete your account (Section 7 covers backups).

3. How We Store Your Data

3.1 Local Storage (Your Browser)

Email messages, threads, and labels are stored in your browser's IndexedDB. This data never leaves your device except when email content or message details are sent to our AI providers (Section 5): email content for AI features you invoke, and, on plans that include AI sorting, message details for the automatic sorting described in Section 4. You control this data through your browser settings and can delete it at any time by clearing site data.

3.2 Server-Side Storage (Google Cloud)

We store the following in Google Cloud Firestore:

• User account records (email, name, provider, subscription status, and, if you have had a free trial, that trial’s start and end dates, its AI allowance, the time zone described in Section 2.1, and records of how the trial was started, ended and reminded about; if a trial was refused because one of your addresses is already recorded, we also store the date that refusal stops applying)
• Email rules and automation settings
• Acceptance records: when you agree to our Terms of Service and Privacy Policy, the versions you agreed to, the times, your account email at that time, your choice about AI features if the app asked you for one, and the device and browser information your device sent, such as its user agent, platform and app version (see Section 7)
• User preferences and AI memory
• Files staged by connected applications, and messages they ask Conduit to send, held briefly, with their contents encrypted (see Section 2.5)
• Encrypted OAuth tokens (for Google and Microsoft accounts)
• Encrypted IMAP/SMTP credentials (for IMAP-connected accounts — see Section 3.3)
• Free trial records: one one-way record of each email address on an account that has had a free trial, kept to prevent repeat trials (see Section 7). If you link a mailbox to an account that has already had a trial, a record of that address is written when you link it, even if no trial ever ran on that mailbox.
• Administrative audit records: a log of administrative actions taken on an account, and of mailbox unlinks made on it. An entry names the account by its internal ID rather than by email address. The email address of an administrator is on the entries for their own actions, and an entry for an invitation or waitlist place for an address with no account holds that address, and an entry for a change to administrator permissions lists the administrators’ addresses. An entry for a mailbox unlink includes a one-way record of the unlinked address rather than the address itself. Older entries can still hold the address of an account that exists. We keep the log as a security record. When an account is deleted, its email address is erased from the entries about it, except the administrator permission entries above (see Section 7).

3.3 IMAP/SMTP Credential Storage

If you connect an email account via IMAP/SMTP, your credentials (including your app-specific password, server hostname, and port) are encrypted as a single blob using AES-256-GCM before being stored in our database. Credentials are decrypted only in server memory for the duration of an IMAP or SMTP operation and are never written to disk in plaintext or logged. You may delete your stored IMAP credentials at any time by removing the connected account from the Service.

3.4 Encryption

OAuth tokens and IMAP/SMTP credentials are encrypted at rest using AES-256-GCM with a server-managed encryption key before being stored in our database. All data in transit is protected by TLS encryption. Firestore data is additionally encrypted at rest by Google Cloud's built-in encryption.

4. How We Use Your Data

• Provide the Service: Access and display your email (via API or IMAP), sync labels and folders, apply rules, send email (via API or SMTP), and manage your inbox.
• AI Features (Managed): When you use AI features (summarization, drafting, search, rules), relevant email content is sent to Anthropic's Claude API for processing via our servers. Sorting and rule checks are described below and may go to Anthropic or TypeSafe. On plans that include AI sorting, a free trial of such a plan included, sorting also runs on its own as mail arrives, without you invoking it: for each new message a local classifier on your device is unsure about, and, when Jev does the sorting (Section 4.1), for each new message the classifier files under People even when it is sure, we send that message’s sender, subject, a short preview, a few mailing-list header signals, up to two category hints (one from your mail provider, one worked out on your device), and an identifier used only to match the answer back to the message. The full message body, the recipients and any attachments are never sent for sorting, and you can turn this sorting off in Settings, under AI. That automatic sorting, and the AI conditions in your rules, are decided by Jev, a model made by TypeSafe AI, Inc. (Section 4.1). Everything else in this bullet goes to Anthropic. Anthropic deletes what we send it from its systems within 30 days, with the exceptions described in Section 7, and does not use it for model training.
• AI Features (Bring Your Own Key): If you provide your own Anthropic API key, your AI requests travel from your device through our server, which forwards them to Anthropic using your key and under your own API agreement with Anthropic. Our server passes these requests, and Anthropic’s replies, through without storing their content or your key, and Anthropic’s own terms and data policies govern that data. Jev (Section 4.1) is not used in this mode; sorting and AI rule checks go to Anthropic.
• Webhooks: If you configure automation rules with webhook actions, email data (such as sender, subject, and AI-generated summaries) may be sent to external URLs that you specify. You are responsible for the privacy and security practices of any third-party services you connect via webhooks.
• Product Analytics: We use PostHog to understand how the Service is used so we can improve it. No email content is sent to PostHog.
• Error Tracking: We use Sentry to detect and fix bugs. Personally identifiable information is scrubbed from error reports. No email content is sent to Sentry.
• Communication: We may send you service-related emails (security alerts, major changes) to the email address associated with your account.

Training AI models. We do not collect, use or sell personal data to train large language models or other AI models, and our agreements with our AI providers bar them from training on what we send them. If you use your own Anthropic API key, your own agreement with Anthropic applies to those requests instead. Applications you connect yourself (Section 2.5) are not our providers, and their own terms apply to the data they access.

4.1 Sorting and Rule Matching (TypeSafe's Jev)

Conduit uses Jev, an AI model made by TypeSafe AI, Inc. (“TypeSafe”), for two jobs: sorting new mail into categories, and checking the AI conditions in rules you write. This applies on plans that include these features, a free trial of such a plan included, and for every mail provider we support, Gmail included. If you use your own Anthropic API key, Jev is not used. If we switch Jev off, these jobs go to Anthropic and the same details are sent there instead.

When Jev sorts mail, it checks each new message the classifier on your device is unsure about, and each new message the classifier files under People, even when it is sure. For each of those messages, Jev is asked which category it belongs in, whether it asks you for a reply or a decision, whether it has an explicit deadline in the next few days, and whether it creates or reminds you of a commitment you owe someone.

For each message Jev checks, our servers send it only these details:

• The sender’s name and email address (and, if a mailing list has rewritten the sender, the original sender’s address).
• The subject.
• A short preview of the message.
• A few header values that show whether the message came from a mailing list or an automated sender, such as the list ID, the return-path domain and the unsubscribe link’s domain.
• Up to two category hints: one from your mail provider, one worked out on your device.
• For rule checks only, the words of the AI condition being checked.

Jev does not receive the full message body, the recipients or any attachments.

How TypeSafe handles it. The details travel from our servers to TypeSafe over an encrypted (TLS) connection. Under our agreement with TypeSafe, it applies zero data retention: it does not keep what we send once it has returned its answer, and keeps only operational telemetry, such as usage and billing counts. TypeSafe has confirmed in writing that it does not train on what we send. It states that it hosts its service in the United States.

Your choice. You can turn automatic sorting off in Settings, under AI. A rule’s AI condition runs only while the rule exists, so editing or deleting the rule stops it.

5. Third-Party Services

We rely on the following third-party services (subprocessors) to provide the Service:

• Google (Gmail API, Firebase Authentication, Cloud Firestore, Cloud Run) — Email access, user authentication, data storage, and server hosting.
• Microsoft (Microsoft Graph API) — Email access for Outlook accounts you connect.
• Anthropic (Claude API) — Powers AI features. What we send it is deleted from its systems within 30 days, with the exceptions in Section 7, and is not used for model training under Anthropic's commercial terms.
• TypeSafe AI, Inc. (Jev model) — Sorts new mail and checks the AI conditions in your rules. Receives the message details listed in Section 4.1, never the full body, recipients or attachments. Zero data retention (it keeps only operational telemetry, such as usage and billing records), no training on what we send. It states that it hosts its service in the United States.
• PostHog — Product analytics. No email content is sent to PostHog.
• Sentry — Error tracking and performance monitoring. PII is scrubbed; no email content is sent.
• Stripe — Payment processing. Stripe receives your payment method details, billing address, and transaction information. We do not store full credit card numbers on our servers. Stripe's handling of your payment data is governed by the Stripe Privacy Policy.
• Resend — Transactional email delivery. Sends service emails (such as account and subscription confirmations) on our behalf, and receives the recipient address and content of those emails.
• Third-party mail servers — If you connect an IMAP/SMTP account (e.g., Yahoo, AOL, iCloud, Fastmail), our server communicates with your email provider's mail servers using your encrypted credentials to fetch and send email on your behalf.
• User-configured webhooks — If you set up webhook automations, email metadata and AI-generated content may be sent to external services of your choosing. These services are not our subprocessors — they operate under your own relationship with those services.

Our subprocessors process data primarily in the United States. By using the Service, you consent to the transfer and processing of your data in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, please see Section 9 regarding the legal basis for this transfer.

6. Google API Services User Data Policy

Conduit Mail's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Specifically, Conduit Mail:

• Only uses Google user data to provide and improve the email client functionality described in this policy.
• Never uses Google user data to create, train, or improve any artificial intelligence or machine learning model, ours or anyone else's, and never shares it with anyone for that purpose. No consent or setting changes this. Our agreements with Anthropic and TypeSafe bar them from training AI models on it, and TypeSafe has confirmed in writing that it does not train on what we send. TypeSafe processes it only on our instructions, keeps no copy once it has answered, and keeps only operational telemetry, such as usage and billing records.
• Does not transfer Google user data to third parties except (a) as necessary to provide the Service (e.g., sending email content to Anthropic for AI features you invoke, and message details to Anthropic or TypeSafe for the automatic sorting described in Section 4 on plans that include it and for the AI conditions in your rules, as described in Section 4.1), (b) as required by law, or (c) with your explicit consent.
• Updates this policy and tells you in the Service or by email when it changes how it uses or shares Google user data.
• Does not use Google user data for serving advertisements.
• Does not allow humans to read Google user data unless: (a) you have given affirmative consent, (b) it is necessary for security purposes (e.g., investigating abuse), or (c) it is required by law.

7. Data Retention & Deletion

• Account deletion: You may delete your account at any time in Settings. Deletion is immediate and irreversible: all server-side data (account record, rules, settings, writing samples, files staged by connected applications and messages waiting to send, encrypted OAuth tokens, and encrypted IMAP/SMTP credentials) is permanently erased from our live systems when you confirm, except as described in the three bullets below (free trial records, administrative audit records and acceptance records). Deleted data can remain in encrypted backups for up to 14 weeks, until those backups expire. There is no reactivation window.
• Free trial records: If your account, or a mailbox you linked to it, has had a free trial, we keep a one-way record of each of those addresses to prevent repeat trials. The record does not contain your address and cannot be read as one. We can only check whether an address you give us later matches it. We do not use it for anything else.
• Administrative audit records: Our administrative audit log records administrative actions taken on an account, and mailbox unlinks made on it. An entry records what was done, when, who did it and the account it applied to, and it names that account by its internal ID rather than by email address. An entry for a mailbox unlink includes a one-way record of the unlinked address rather than the address itself. We keep this log as a security record. When you delete your account, we erase your email address from every entry that names you or your address, and the rest of the entry stays. The exceptions are entries for changes to administrator permissions, which list the addresses of administrators, and those addresses stay. An invitation or waitlist entry sent to an address before it had an account keeps that address until that account is deleted. Entries written before we made this change can still hold the address of an account that exists, until that account is deleted.
• Acceptance records: When you agree to our Terms of Service and Privacy Policy, we record that you did: your account email at that time, the versions you agreed to, the dates and times, your choice about AI features if the app asked you for one, and the device and browser information your device sent, such as its user agent, platform and app version. We keep these records for 6 years after you delete your account, as proof of what you agreed to, and then erase them.
• Local data: Email stored in your browser (IndexedDB) stays on your device and is not deleted automatically when you delete your account. Clear site data for in.conduitmail.app in your browser settings to remove it.
• AI processing data (Anthropic): Anthropic deletes what we send it for AI features from its systems within 30 days. Its own policy lists exceptions: content its automated safety systems flag as a possible Usage Policy violation can be kept for up to 2 years, the results of those safety checks can be kept longer, and it may keep data the law requires it to keep.
• AI processing data (TypeSafe): TypeSafe keeps none of the message details it receives once it has answered (zero data retention). It keeps only operational telemetry, such as usage and billing counts.

8. Data Breach Notification

In the event of a security breach that compromises the confidentiality of your personal data, we will:

• Notify affected New York residents within 30 days of discovering the breach, consistent with the New York SHIELD Act (NY Gen. Bus. Law § 899-aa).
• Notify the New York Attorney General, the New York State Police, and the New York Department of State's Division of Consumer Protection as required by law.
• Notify affected residents of other states in accordance with their applicable breach notification laws.
• If required by GDPR, notify the relevant supervisory authority within 72 hours and affected data subjects without undue delay.

Notification will include, to the extent known: the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data. Some records are kept after a deletion request: the one-way free trial records described in Section 7, which we keep to prevent repeat trials; the administrative audit log described in Section 7, which we keep as a security record after removing your email address from it, except as Section 7 describes; and the acceptance records described in Section 7, which we keep for 6 years after deletion as proof of what you agreed to. Deleted data can also remain in encrypted backups for up to 14 weeks, until those backups expire (Section 7).
• Data Portability: Request a machine-readable export of your data.
• Objection: Object to processing of your personal data for certain purposes.
• Restriction: Request that we limit how we use your data.
• Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing performed prior to withdrawal.
• Non-Discrimination: Under the CCPA, you have the right not to receive discriminatory treatment for exercising your privacy rights.

9.1 GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, the legal bases for our processing of your personal data are: (a) performance of our contract with you (providing the Service), (b) your consent (e.g., when you invoke AI features or connect an email account; automatic sorting, which runs without you invoking it, rests on (a) because it is part of providing the Service), and (c) our legitimate interests (e.g., product improvement, security, fraud prevention, and preventing abuse of our free trials, which is the basis on which we keep the one-way trial records described in Section 7), balanced against your rights. You may lodge a complaint with your local data protection authority if you believe your rights have been violated.

Conduit Labs LLC is not certified under the EU-U.S. Data Privacy Framework. Data transferred from the EEA, United Kingdom, or Switzerland to the United States is transferred on the basis of the derogations in Article 49 GDPR: your explicit consent to the transfer (Art. 49(1)(a)), which you provide when you create an account and connect an email account after being informed that your data will be processed in the United States, and the necessity of the transfer for the performance of our contract with you (Art. 49(1)(b)) — the Service is operated from the United States and cannot be provided without processing your data there. Some of our subprocessors additionally maintain their own transfer safeguards, such as their own EU-U.S. Data Privacy Framework certifications or standard contractual clauses.

9.2 CCPA / CPRA (California)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Correct: You may request correction of inaccurate personal information.

Categories of personal information collected: Identifiers (email address, name, and the one-way free trial records described in Section 7); commercial information (subscription plan, purchase history, and billing records — payment card details are collected and processed by Stripe, not stored by us); internet or electronic network activity information (usage analytics, error reports); and account credentials (OAuth tokens, IMAP credentials, stored encrypted).

To exercise any of these rights, contact us atprivacy@conduitmail.app. We will respond within 30 days (or 45 days where your state's law allows, with notice if an extension is needed). We may need to verify your identity before fulfilling your request.

9.3 Appealing a Decision

If we decline a request, you can appeal by replying to our decision or emailingprivacy@conduitmail.app with “Appeal” in the subject. We will answer within 60 days and explain our decision. If we deny your appeal, you can contact your state's Attorney General; Connecticut residents can file a complaint atportal.ct.gov/ag.

10. Security

• All data in transit is encrypted via TLS.
• OAuth tokens and IMAP/SMTP credentials are encrypted at rest using AES-256-GCM with a server-managed key.
• IMAP credentials are decrypted only in server memory for the duration of an IMAP/SMTP operation and are never logged or written to disk in plaintext.
• Firestore data is additionally encrypted at rest by Google Cloud.
• Email content is not stored on our servers, except notes, writing samples, and AI memory content that you or your configured rules choose to save (see Section 2.3), and, briefly, files and messages your connected applications ask Conduit to send (see Section 2.5) — our local-first architecture means your messages stay on your device.
• We implement reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of personal information, consistent with the requirements of the New York SHIELD Act (NY Gen. Bus. Law § 899-aa).

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security.

If you discover a security vulnerability, please report it tosecurity@conduitmail.app.

11. Cookies & Tracking Technologies

The Service uses the following cookies and similar technologies:

• Authentication cookies/tokens: Essential for keeping you signed in. These are strictly necessary for the Service to function and cannot be disabled.
• Local storage (IndexedDB, localStorage): Used to store your email data, preferences, and application state locally in your browser. This is core to the Service's local-first architecture.
• PostHog analytics: Uses cookies and similar technologies to collect pseudonymous usage data (pages visited, features used), tied to an internal user ID — never your email address or email content. You can opt out of PostHog tracking by enabling your browser's "Do Not Track" signal or by contacting us atprivacy@conduitmail.app.
• Sentry error tracking: May set cookies for session tracking when capturing error reports. PII is scrubbed; no email content is collected.

We do not use advertising cookies or tracking pixels. We do not engage in cross-site tracking or behavioral advertising.

12. Children's Privacy

The Service is not directed at children under the age of 18, or under the age of majority where you live if that is higher. We do not knowingly collect personal information from children below that age. If we learn that we have collected data from a child below that age, we will promptly delete it. If you believe a child below that age has provided us with personal data, please contact us atprivacy@conduitmail.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. Changes that are non-material or that are beneficial to you may take effect immediately upon posting. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

If you have any questions about this Privacy Policy or our data practices, please contact:

Conduit Labs LLC
New York, NY
Email: privacy@conduitmail.app