Privacy & AI
Your mail goes between your Mac and Google. Nowhere else.
This page explains the design in plain English. The Privacy Policy is the full, formal version.
How your data moves
Your Mac
The app, a copy of your recent mail, your sign-in tokens, and the assistant's model.
Your Gmail, Calendar and Drive, where your data already lives.
There is no Path Tracer server. We receive none of your data and have no way to see it.
What the app can access, and why
When you connect a Google account, Google asks you to allow three permissions. Each is a separate sign-in, so you can grant or revoke them independently. The app asks for nothing else.
| Permission | What the app uses it for |
|---|---|
Gmailgmail.modify | Showing, searching and reading your mail; marking messages read; moving messages to Bin (never permanent deletion); saving drafts; sending the messages you write and click Send on. |
Calendarcalendar.events | Declining an invitation, inviting guests, and creating events with a Google Meet link, each only when you do it. |
Drivedrive.readonly | Browsing, searching and opening your files, and attaching one to an email you write. Read-only. |
The assistant Beta
AI that stays on your Mac
- On your Mac only. The assistant uses Apple's on-device model, part of Apple Intelligence. Your questions, the email it reads and its answers are processed on your Mac. The app does not use Apple's Private Cloud Compute or any other server-based model.
- The open email, and nothing else. It works on the thread you have open. It does not search or read the rest of your mailbox, your calendar or your Drive.
- Only when you ask. It reads the thread to answer a request you type or speak.
- It cannot send. The only thing it can create is a draft reply. You see it first, and it is saved to your Gmail drafts only if you confirm.
- Secrets kept out. Passwords, one-time codes, sign-in and reset links, and keys are replaced with “[hidden]” before the model reads a thread. This is a safety measure, not a guarantee.
- Never used for training. Nothing you do in the app is used to train or improve any AI model, by us or by anyone else.
- Voice input uses Apple's on-device speech recognition, so recordings are not sent anywhere.
What we never do
No analytics, no tracking, no advertising, no crash reporting to us, no selling or renting of data, and no transfer of your data to anyone. This website sets no cookies and loads nothing from other sites.
Google Meet calls and web pages you open, including Google Docs, Sheets and Slides, are Google's own pages shown by macOS's built-in web engine. Google's privacy policy applies to them.
What is kept on your Mac
| Sign-in tokens | Never your password; the app does not see it. In your Mac's Keychain in signed releases; in beta builds, a file only your user account can read. |
|---|---|
| Recent mail | About the last 60 days, readable only by you and excluded from Time Machine; encrypted in signed releases. |
| Assistant conversation | Kept so it can refer back. Clear deletes it. |
| Logs | What the app did, never the content of your mail, events or files. |
Disconnect revokes the app's access at Google and deletes all of this for that account. You can also revoke access at any time at myaccount.google.com/permissions.