Privacy Policy

Last updated 3 September 2026

Envoy reads your email and calendar so it can tell you what you have left unanswered. That is an unusual amount of access to ask for, so this page is specific about what happens to it. Everything below describes what the software actually does.

What we collect

• Account information. Your name and email address, from Sign in with Apple or Google.
• Email metadata. Sender, recipients, subject, timestamps, thread and message identifiers, and Gmail labels. Not message content.
• Email content — only if you turn it on. Off by default. When enabled, we read the first 2,000 characters of messages that pass the filter described below. Stored encrypted, deleted after 180 days.
• Calendar events. Titles, times, attendees, locations and conferencing links.
• What Envoy infers. A record of the people you correspond with, how often, and what appears unresolved between you. This is derived data and it is the core of the product.
• Messages sent to your public Twin by visitors, if you publish one.

Email content: what is never read

When body reading is enabled, a deterministic filter runs before anything is fetched, so ineligible mail is never retrieved at all. It excludes newsletters and mailing lists, promotional and social categories, automated and no-reply senders, receipts and shipping notices, messages sent to large groups, people you have muted, and anyone you have not exchanged mail with in both directions.

You can see the resulting numbers — how much was read, how much was skipped, and for which reason — in Settings. A privacy claim you cannot inspect is a marketing claim.

How we use it

To operate the product: detecting unanswered questions and unkept commitments, drafting replies for your approval, and answering questions you ask your Twin. We use large language models from Anthropic and OpenAI to do this.

We do not train AI models on your data, and we do not permit our providers to train on it either. We do not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act. We serve no advertising and run no third-party analytics or tracking.

Google user data

Envoy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve user-facing features, never transfer it except as necessary to provide the service or as required by law, never use it for advertising, and no human reads it except where you explicitly ask us to for support.

You can revoke access at any time from your Google account permissions, or by disconnecting the account in Settings.

Other people's information

Your mail contains other people. Envoy stores metadata about your correspondents and — where you have enabled body reading — some of what they wrote to you. We do this to provide a service you asked for, on your behalf, over your own mailbox. We do not build profiles of these people for any purpose other than your own use, we do not sell or share their information, and deleting your account deletes what we hold about them.

Retention and deletion

• Email bodies are deleted automatically after 180 days.
• Turning off email-content reading deletes every stored body immediately, in the same operation that flips the setting.
• Deleting your account removes your data, including derived relationship records.

Your rights in California

Under the CCPA as amended by the CPRA, California residents may request to know what personal information we hold, request its deletion or correction, and are protected from discrimination for exercising those rights. Because we do not sell or share personal information and do not use it for cross-context behavioural advertising, there is no opt-out to offer — but we honour Global Privacy Control signals regardless. Email privacy@my-twin.ai to make a request.

In the UK or EEA you additionally have rights of access, rectification, erasure, restriction, portability and objection under the UK GDPR and GDPR.

Cookies

Envoy sets only strictly necessary cookies: one to keep you signed in, and one to hold the closed-beta pass. Both are HTTP-only and expire. There are no advertising, analytics or tracking cookies, which is why you have not been shown a consent banner.

Security

Data is encrypted in transit and at rest. Email bodies and OAuth tokens are encrypted with separate application-level keys. On mobile your session is held in the device Keychain and the app is locked behind Face ID, Touch ID or your passcode.

Contact

privacy@my-twin.ai. We respond to verified requests within the timeframes applicable law requires.