Security Architecture
Oct 12, 2026 · Security
6 min read
Your data is processed with a privacy-first architecture designed to keep control in your hands at every layer. We don't build behavioral profiles. We don't train AI on your personal content. We don't use your data for advertising.
"We are intentionally strict about data usage boundaries. We never sell your data, never build cross-user profiles, and never train machine learning models on personal inbox content."
How Your Data Is Handled
We only process the minimum data required to power your feed experience.
Email & feed sources:
- We only ingest Promotions, Updates, and Social categories from connected Gmail accounts.
- We ignore primary inbox content entirely.
- We process metadata such as sender, subject, and timestamps to organize your feed.
Content Storage Modes
Depending on your deployment (Cloud vs Community Edition), data is handled differently:
Privacy Mode
- Default on our cloud-hosted platform
- Email bodies are never stored on our servers
- Content is fetched securely from Google APIs on demand
Performance Mode
- Available in the upcoming Community Edition
- Newsletter content is stored locally for instant loading
- Storage optimized for your own private hardware
Authentication & Token Security
Security credentials are handled with strict separation of concerns:
- Access tokens are stored in encrypted, short-lived cache systems.
- Refresh tokens are stored in dedicated secret management vaults.
- Passwords are hashed using modern cryptographic functions (Argon2 / bcrypt).
- No sensitive credentials are ever stored in plain-text databases.
Multi-Layer Security Safeguards
All network traffic is encrypted in transit using modern TLS 1.3.
SSRF protections are strictly enforced for external RSS feed fetching.
Role-based access controls restrict internal infrastructure access.