Security

Our commitment to you

• Your mail is never used to train general AI models — ours or anyone else's.
• Gmail tokens are encrypted at rest (AES-256-GCM). Access tokens are never stored.
• We keep metadata and short summaries — not full message bodies.
• Wingman writes drafts and labels. Nothing sends without you.
• Your data is yours: disconnect or delete anytime.

We never train on your mail

Email content is not used to train generalized AI or marketing models. Processing is for the features you enable — triage, drafts, briefs — only.

Transient AI processing

Classification and drafting go through our AI provider (OpenAI) via its API. API data is not used to train their models; the provider may retain it briefly (up to 30 days) solely for abuse monitoring, then deletes it. We don't keep the AI's copy of your content at all.

Encrypted tokens and secrets

Gmail refresh tokens are encrypted at rest with AES-256-GCM. API keys and other server secrets stay in Sensitive Vercel environment variables — never in the browser or in git. We store metadata (sender, subject, snippet, category, short summary) — not full message bodies. Access control, the secret inventory, and decrypt/encrypt monitoring are documented in Secrets management.

Nothing sends without you

Wingman creates drafts and labels. There is no autopilot send. You approve every outbound message in Gmail.

Google Limited Use

Use of Gmail data adheres to the Google API Services User Data Policy, including Limited Use.