Privacy & Security

When you connect Gmail, you're granting a read-only permission (Google calls it gmail.readonly). This isn't just a promise in our privacy policy — Google's own permission system makes it technically impossible for BlindSpot to send, delete, label, archive, or edit anything in your mailbox. We only ever look at mail you've already sent, to spot commitments you've made.

We do not store your full emails. When something looks like a commitment, we save:

• A short title and summary (written by the classifier, not copied from your email)
• Up to 500 characters of the original text as a reference excerpt
• Who it involves, when it's due, and its status (open, done, dismissed, etc.)

The rest of that email — and everything in mail we didn't flag — is never copied anywhere. We only ever read what's needed to check for a commitment, in the moment we check it.

Two more limits on that excerpt specifically: a best-effort filter strips obvious sensitive numbers (SSN-shaped, card-shaped, long bare digit runs, "password:"/"key:"-style lines) before it's ever saved — it catches common patterns, not everything, so it's one layer, not a guarantee. And once a commitment has been resolved for 90 days, the excerpt itself is cleared automatically — the title, summary, and status stay (that's the actual point of the app), but the verbatim text doesn't sit around indefinitely.

• In transit: every connection — your browser, Google, OpenAI, our database — runs over HTTPS/TLS.
• Everything at rest: our database provider (Supabase, built on encrypted AWS infrastructure) encrypts the underlying disks by default. Row-level security also means the database itself physically refuses to return another account's rows (see section 4) — that isolation applies today, independent of encryption.
• Gmail connection tokens and the excerpt/summary text — an extra, application-level layer of encryption (AES-256-GCM) on top of the disk-level encryption above: this is built and ready, but not switched on yet. Until it is, this page won't claim otherwise. We'll update this line the day it actually goes live.

This isn't just an app-level check we could get wrong — it's enforced at the database itself. Every account's commitments are tagged with that account's ID, and the database is configured to physically refuse to return rows that don't belong to whoever's logged in. Even a bug elsewhere in the app can't leak your data to another account, because the database is the thing saying no.

Three services, and only these three:

• Google — to read the mail you've authorized, nothing more.
• OpenAI — receives the text of a flagged email momentarily, to classify it as a commitment. It is not used to train OpenAI's models, sold, or shared onward.
• Supabase — hosts BlindSpot's database. It's where everything above actually lives.

No ad networks. No data brokers. Nothing is sold, ever.

Settings → "Delete my account." Type DELETE to confirm, and in one step it removes every commitment, disconnects every mailbox, and deletes your login — no one on our side has to do it by hand.

Worth being direct about: this is immediate and permanent. There's no grace period and no way to undo it once you've confirmed. If you're not certain, don't type DELETE yet — ask first.