Privacy

With your read-only Gmail connection, Selyf reads inbox message metadata during sync: subject line, sender, a short snippet, timestamps, and unread status.

When you open a specific thread, Selyf additionally fetches that message's full body from Gmail — and the filename, type, and size of any attachments, never attachment file contents — and caches it in Selyf's database, so it doesn't need to be fetched again the next time you view the same thread. This only happens for a thread you actively open. It is never done in bulk across your inbox, and never on a schedule.

The metadata above; the full body and attachment metadata of any thread you've opened; AI analysis results (priority, reply status, reason, suggested action, confidence) for threads you've analyzed; and account/session records needed to keep you signed in. Your OAuth refresh token is stored encrypted (AES-256-GCM), never in plain text.

During onboarding, Selyf also asks for your role and main use case — each a choice from a fixed, short list (e.g. "Manager", "Client communication"), never free text — and, optionally, an email signature. None of this is sent to the AI: the signature is only ever appended to a generated draft's text after the AI has already written it, and role/use case are used solely to make Selyf's own summaries clearer. Both are optional and can be changed anytime from Settings.

Selyf's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Because the data Selyf accesses is specifically Gmail data, that access is also governed by the more specific Google Workspace API User Data Policy, which sets out the requirements — including the restriction on using Workspace data to train AI/ML models — reflected below. Concretely:

• Gmail data is never used for advertising, in any form.
• Gmail data is never used to train AI models — not a Selyf model (Selyf does not train any models), and not the underlying AI provider's.
• Gmail data is used only to provide the Gmail features you see in the product: syncing your inbox, letting you search and open threads, and generating the AI analysis or draft reply for a specific thread you explicitly request.
• The gmail.readonly scope is the only Gmail permission Selyf requests, and it is used strictly for these read-only purposes. Selyf cannot send, delete, or modify anything in your Gmail account with this access.

When you ask for an analysis or a draft on a specific thread, that thread's message content is sent to the configured AI provider (Anthropic or Gemini) to generate the result. This only happens for a thread you explicitly open and act on — not in bulk, and not on a schedule.

An analyzed message's result is cached, so the same message is never re-sent to the AI provider a second time.

Generating a draft sends the thread's content and your requested tone to the same AI provider, and returns editable text that exists only in your browser tab. Nothing is written to Gmail, saved as a Gmail draft, or sent anywhere — the only action available is copying the text to your clipboard yourself.

Data retention follows the service's configured retention policy.

You don't need to wait for it — deleting your account removes everything immediately (see below).

Security-relevant events (connecting an account, disconnecting, a failed OAuth attempt, account deletion) are recorded in an internal audit log used for security investigation, not analytics or profiling. If you delete your account, this log is anonymized — your identifying information is removed from it, not left attached.

Selyf uses a small set of product-usage events (page views; clicks like "Connect Google"; whether a sync, analysis, or draft happened) to understand which parts of the product are actually used. Every event is validated against a fixed schema before it's sent, and that schema closes off both which fields an event may carry and what values those fields may hold — most events carry no properties at all, and the few that do (e.g. which reply tone or language you picked) only accept one of a short, fixed list of values. Your Gmail address, message subject, sender, snippet, body, message id, and any OAuth token are never on that list, so they can never appear in an event, not even redacted.

Your browser never talks to the analytics provider directly — every event goes through Selyf's own server first. Before you sign in, events use a temporary identifier that lives only in memory, in your current browser tab — never written to a cookie or to your browser's storage, so nothing persists once you reload the page or close the tab. (It can carry across normal in-app navigation within that same tab, the same way any other in-memory page state would; the guarantee is that nothing is ever saved to your device, not that it resets on every click.) After you sign in, events use your internal Selyf account id, not your Gmail address, so no separate tracking cookie is needed for this purpose.

The analytics provider is PostHog (EU data region), which only ever receives the event names and non-identifying properties described above.

These are two different actions, and it matters which one you want. Disconnecting your Google account revokes Selyf's access with Google and ends your Selyf session, immediately — but the metadata and AI analysis results already synced before you disconnected are not automatically deleted; they remain stored until you either reconnect (sync simply resumes) or delete your account. Deleting your account removes everything immediately: your Google connection, all synced metadata and message bodies, all AI analysis results, and the account itself. If you want your data gone, not just the connection, delete your account rather than only disconnecting.

Both actions are available at any time from Settings in your dashboard.

Four categories of third party ever see any of your data: Google (as the source of your Gmail data, under Google's own terms for the OAuth scope you granted), the configured AI provider — Anthropic or Gemini — for the specific thread content you choose to analyze or draft a reply for, PostHog, which receives only the non-identifying product-analytics events described above — never Gmail content, and Sentry (EU data region), which receives a stack trace and your internal account id — not your Gmail address — only when the server itself fails unexpectedly. The same fields excluded from analytics events above (subject, sender, snippet, body, message id, any OAuth token) are filtered out of every error report before it leaves the server, and routine 4xx errors (a bad request, an expired session) are never sent at all — only genuine server failures are. Selyf does not sell, share, or otherwise provide your data to anyone else. See Subprocessors for the full list, including hosting/infrastructure providers, and Cookies for exactly what's stored in your browser.

Questions about this policy, or requests about your own data, can be sent to support@selyf.com.