Privacy Policy

MiniBrief is a web app that triages your inbox: it sorts what arrives, tells you who is waiting on you and who you are waiting on, files mail into folders you define, drafts replies in your voice, and writes you a morning brief. To do that when no browser of yours is open, our server reads the mailbox you connect. This document explains what we hold, why, for how long, who else touches it, and what you can do about it.

The short version

• You connect a mailbox on purpose. Signing up, subscribing or starting a trial does not connect one. Connecting is a separate step under Settings → Mailboxes, at Google's or Microsoft's own consent screen.
• We store your mail's metadata, not its bodies. For each connected mailbox we keep a rolling 90-day window of subjects, senders, recipients, dates, short previews and flags, plus what our software works out about each message. Message bodies are fetched from your mailbox when you open a message and are not kept.
• AI sees only what a feature needs. Sorting sends a subject and about 120 characters of preview per message. Reading features that need more (summaries, reply drafting, the Brief) send the message you opened or asked about, capped, and only when you use them. Nothing you send to the AI is logged or used to train models.
• No analytics, no tracking, no selling. There is no analytics service and no telemetry in the product. We do not sell your data or use it for advertising.
• Disconnecting a mailbox deletes what we read from it. Deleting your account deletes everything. Both are self-serve in Settings.

Your account

To offer paid accounts and a free trial we operate a backend (Supabase) that stores: your login email and account id, your subscription status, an integer count of AI calls per day for abuse prevention, the phone number you verified once to start a free trial, and — to prevent repeated free trials — the addresses of mailboxes you connect and the phone numbers that have already seeded a trial. Your password is held only as a hash by our authentication provider; if you turn on two-factor authentication, the secret is held there too.

The mailbox you connect

The permission

The OAuth grant you give at Google's or Microsoft's consent screen is exchanged on our server, encrypted with AES-256-GCM before it is written, and stored only in that sealed form. The key that seals it lives only in the environment of our two server processes (the web app and the background worker) — never in the database, so a copy of the database alone cannot read any mailbox. Your browser never receives the grant. Disconnecting a mailbox in Settings revokes the grant at Google (Microsoft has no per-app revocation endpoint; you remove MiniBrief from your Microsoft account instead) and deletes the mailbox row together with every message row and verdict we read under it. You may connect more than one mailbox (two Gmail accounts, say); each is read through its own connection, shown as its own tab, and everything below applies to each of them separately.

What we store about your mail

For each connected mailbox, our background worker reads the mailbox through the Gmail API or Microsoft Graph and stores, per message: the subject, the sender's name and address, the recipients, a short preview (the first couple of hundred characters, as the provider supplies it), the date, read and starred flags, labels and categories, attachment names and sizes, a few header-derived signals (whether the message carries an unsubscribe header, whether its authentication checks passed), and the link back to the message in Gmail or Outlook. Alongside those we store what MiniBrief works out: importance and category, whether a reply is owed, order and delivery detection, the Sender Guard warning level, the risk layer's verdict (a tier, plain-English reasons and short evidence such as a domain — never a number from the message), and Smart Folder membership. For the risk layer we also keep, per connected mailbox, a relationship baseline: how often each address and domain has written to you or been written to, the display names an address has used, whether its mail passed authentication, and fingerprints (one-way hashes) of payment details a domain has sent before — never the details themselves. It personalises your own checks and trains nothing.

We also store, because the app's features need them:

• Per-thread bookkeeping: who wrote last and when, and whether a reply is awaited. Timestamps and flags, no content.
• Sender memory: one person-or-automated verdict per correspondent address, so a sender is asked about once; and the addresses you have written to, with a count and a date, which is how we tell a stranger from someone you correspond with.
• Your corrections: a message you filed by hand, and — for the triage corrections that teach the classifier — the sender, the change you made, the subject and a short preview of the message you corrected (the newest 100).
• Senders you blocked, with the id of the Gmail filter that trashes their future mail, so the block can be listed and undone.
• The Brief and meeting preps: the daily Brief as generated (the subjects, senders and previews it cites and the model's prose), kept so you can read it back and send it on; and, per calendar event, the event's title and attendees, the related mail's subjects and previews, and the model's notes. A prep is generated when you open a meeting and also, by default, on its own by our background worker about ten minutes before the meeting while notifications are on, whether or not a browser is open. It is kept on our server and also in a copy on your device (your browser's local storage, or its IndexedDB on the web). Turn off “Prepare meetings automatically” in Settings → Notifications and no prep is generated on its own; one you open is still prepared and kept as above.
• A record that you have already been notified about something, so two open tabs or two devices stay quiet instead of telling you twice.

Message bodies are not stored. When you open a message on the web, its body is fetched live from your mailbox through our server and shown to you. The same is true of attachments: an attachment you open is fetched from your mailbox and handed to your browser (a large one through a link that works for five minutes and names only that file); it is not kept on our side. A short-lived body cache exists in our database schema for a future reading feature; it is evicted 21 days after a body was last read, and nothing writes to it at the time of this policy. If that changes, this paragraph will change first.

How long we keep it

Mail rows are kept for a rolling 90 days from the message's date, capped at the newest 25,000 messages per mailbox; a message you delete or archive away is tombstoned and removed after 30 days; the body cache, when it is in use, is evicted 21 days after a body was last read. Disconnecting a mailbox deletes everything read under it immediately. Deleting your account deletes all of it.

Who can read it

Every table is protected by row-level security keyed to your account: the web app reads only your rows, with your session. The background worker connects as the database owner and is scoped in code to one mailbox at a time. No MiniBrief staff tool reads mail rows; the support tooling sees account and subscription fields only.

Things you tell us yourself

Some of what MiniBrief holds is not mail but your own words and choices, stored against your account so every browser you sign in from agrees:

• Your client list (names, addresses, domains, tags and your own notes), your team's domains, your signature, your settings and preferences.
• Your Smart Folder rules. A folder's name, your description of it, and the rule you built from it — which may quote a sender address or a subject word you typed or confirmed in the folder builder — plus your per-folder "always file this sender" / "never this one" choices and your muted senders (a mute is such a rule).
• Your decisions about senders. The senders you rescued from Junk, the ones you marked safe, the ones you added to Orders, and the senders you told us are a person or a machine, or always a given priority. These are addresses and domains you chose, kept readable so arriving mail can be matched against them.
• Which emails you stored under a client, and where. For each email you file into a client's Stored Correspondence we keep the client, the subfolder, when you filed it, and the identifier Gmail or Outlook uses for that message — an opaque code that means nothing without your mailbox — plus the names you gave your subfolders.
• What you decided about a conversation — dismissed, or closed as dealt with — recorded against a one-way hash of the conversation's identifier, with no subject, sender or preview.

Every row is protected by row-level security keyed to your account, and deleting your account deletes all of it.

AI features — exactly what the model sees

MiniBrief's AI features run on Anthropic's models. Two of our processes call them: our background worker, for the sorting that happens whether or not a browser is open, and the web app itself, for the things you ask for while reading. In both cases the request is scoped to the feature, neither the request nor the response is logged or stored, and we keep only token counts and operation labels per call. Google user data is not used to develop, improve or train generalized AI or machine-learning models, is not used for advertising, and is not sold.

What each feature sends:

• Sorting your inbox — importance, person-or-automated category, order and delivery detection, Sender Guard, and Smart Folder intents — sends the subject and a preview of at most about 120 characters per message. A sender is asked about once; a message is asked about once per folder wording.
• The Brief and the executive report send the subject lines, senders and short previews of the mail in the window, and the model returns the prose the Brief shows.
• Meeting prep sends calendar-event details — the event title, description (up to 500 characters), location, and the attendee names and addresses — from your connected calendar, and the subjects and previews of related mail. It runs when you open a prep, and on its own about ten minutes before a meeting while notifications are on, unless you turn off “Prepare meetings automatically” in Settings → Notifications.
• Reply drafting sends up to 4,000 characters of the cleaned thread you are replying into, plus any thread or client notes you yourself wrote (each capped at 2,000 characters).
• Summaries and "Ask about this thread" send up to 3,000–4,000 characters of the cleaned body of the message or thread you opened, because that is the input. The thread assistant can see nothing but that one thread; your questions and its answers are held while you read and are not stored.
• Commitment extraction and open-question analysis send up to 3,000 characters of the latest message you open, to surface follow-ups and unanswered questions.
• Tone and writing checks send the draft text you are checking.
• Ask your inbox sends the question you typed and, as the assistant works, the subjects, senders and previews of the messages it finds; a thread it opens is sent as the Brief would send it.
• Smart Folder compilation sends the plain-English description you typed (up to 300 characters, plus your own address so "my team" resolves) once, to turn it into a rule.
• Forwarding an email sends nothing to the AI — the message and your own typed note go straight to Gmail or Outlook.

What MiniBrief changes in your mailbox

With your permission, MiniBrief acts on your inbox through the Gmail API or Microsoft Graph. Every action below is initiated by you except where noted as background; all of them are carried out by our server with the sealed grant described above.

The block filter is a real Gmail server-side rule. It will continue to auto-trash mail from the sender even if you disconnect the mailbox or delete your account. You can remove it under Settings → Blocked senders or directly from Gmail settings → Filters. On Outlook the equivalent actions use Microsoft Graph with the same triggers.

Calendar

Connecting Gmail also grants calendar.readonly, and connecting Outlook the equivalent Graph permission, used by the Meetings view to show upcoming events and the mail history with their attendees. Calendar events are read by our server for that purpose and are not stored; a meeting prep, once generated, is stored as described above.

Notifications

The web app sends a private, per-account notice to your open browser tabs when your inbox changes. That notice carries counts only — never a subject, sender or preview.

Browser notifications. If you turn them on in Settings → Notifications, a MiniBrief server can alert your browser when new mail lands in your Inbox, Response Needed, Orders & Deliveries or one of your Smart Folders, when a follow-up or a client check-in is due, an email has waited too long for your reply, a meeting is about to start, or your morning brief is ready. Each alert names the sender and the subject line, says where the message was filed (a tab, or the name you gave a Smart Folder) and links to the message — never a preview or a body. A meeting alert names the event and up to two attendees and, when a preparation has been made for it, adds one line from that preparation (a talking point, topic or action item our AI wrote from your mail); turn off “Prepare meetings automatically” and the alert carries the title, attendees and time only. Alerts are encrypted to your browser before they are sent, so the push service your browser uses (Google's, Apple's or Mozilla's) relays them without being able to read them. Turn them off in the same place, or in your browser's site settings.

The morning briefing by email. On by default for accounts created from 2026-10-09, at 7:00 in your time zone on weekdays (accounts that existed before then keep it off until they turn it on); switch it off in Settings → Notifications. At the hour and on the days you choose, in the time zone you set, we generate your Brief for the day and email it to your account address. That email contains the subject lines, senders and short previews the Brief cites, and what our AI wrote about them — the same content the Brief shows on screen. It is sent through Resend, our email provider, which processes it only to deliver it. The email carries an unsubscribe header, and the switch is in Settings → Notifications.

In your browser

The web app keeps a copy of your working state in your browser's own storage (IndexedDB), per account, so the inbox opens quickly: cached message metadata, your settings and folders, the AI outputs you have already seen, and your unsent drafts. Signing out of the web app on that browser clears it. Your session cookie is what keeps you signed in.

Third parties

• Google receives Gmail and Calendar API requests from our server, authenticated with your OAuth grant, for a connected Gmail mailbox. See Google's privacy policy.
• Microsoft likewise receives Microsoft Graph requests for a connected Outlook mailbox. See Microsoft's privacy statement.
• Anthropic receives AI requests, scoped as described above, from our worker and from the web app's AI proxy. See Anthropic's privacy policy.
• Supabase hosts MiniBrief's authentication, the account and subscription database, the mail store and everything else described above, and the AI proxy.
• Vercel hosts the web app at cloud.minibrief.app, including the server-side routes that exchange your OAuth code and seal the grant, and the marketing site at www.minibrief.app.
• Railway runs the background worker that reads connected mailboxes, classifies their mail, sends notifications and calls Anthropic.
• Stripe processes subscription payments. MiniBrief never sees or stores your card details. See Stripe's privacy policy.
• Twilio delivers the one-time text message used to verify your phone number when you start a free trial. It receives your phone number and nothing else.
• Resend delivers MiniBrief's own email: sign-up confirmation, password recovery, and — if you turn it on — the morning briefing described above. It receives your address and that message.
• Sender unsubscribe endpoints receive a one-click POST or a mailto: email when you click "Unsubscribe & block sender". The HTTPS POST contains the literal body List-Unsubscribe=One-Click and no other identifying data; the email follows whatever address and subject the sender prescribed in the List-Unsubscribe header.

There is no analytics service, no advertising network and no data broker in this list, because none is used.

Google API Services User Data Policy

MiniBrief's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your choices and rights

• Disconnect a mailbox under Settings → Mailboxes: the grant is revoked at Google and every row read under that mailbox is deleted at once.
• Delete your account under Settings: every row described in this policy is deleted.
• Turn notifications and the briefing off under Settings → Notifications; remove a block filter under Settings → Blocked senders.
• Ask us for a copy of what we hold, or to correct or delete it, at the address below. We answer from the same tables described here; there is no other store.

Changes to this policy

When what we store or send changes, this document changes first, and the "Last updated" line moves. A change that widens what leaves your mailbox will be announced in the app before it takes effect.

Contact

Questions, requests, or to exercise your rights over the data described here: support@minibrief.app.