1. Information we collect
- Account data: your email address and unique user ID from Google Sign-in.
- Gmail metadata sent to our server: sender address, subject line, date, read/unread state, the standard
List-Unsubscribeheaders, and derived security signals (SPF/DKIM/DMARC results, sender domain). Full message bodies are cached locally in your browser only and are never uploaded. - OAuth tokens: Google access and refresh tokens, encrypted at rest with AES-GCM before being stored.
- Aggregate stats: per-sender counts (total, last 7d, last 30d, unread), priority score, last-seen timestamp.
2. How we use your data
- To group your inbox by sender and rank the noisiest subscriptions.
- To execute unsubscribe actions you explicitly trigger.
- To detect breaches involving your linked email addresses via free public providers (HIBP, XposedOrNot, LeakCheck).
We never train models on your data. We never sell or rent your data. We do not run third-party advertising or behavioural analytics.
3. Google API Services User Data Policy
Kyanix's use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum Gmail scopes required (gmail.readonly, gmail.modify for unsubscribe actions) and only use the data to provide the user-facing features described above.
4. Storage location
KyanixMail follows a local-first architecture. Your Gmail messages, bodies, sender statistics, and security analysis are encrypted with a per-user key and stored only in your browser (IndexedDB). Our servers do not permanently store your email bodies or mailbox contents. OAuth refresh tokens remain encrypted in the database (required to call Gmail); only a wrapped copy of your encryption key is stored server-side.
5. Data retention
Sender stats are retained while your account is active. Disconnecting a Gmail account or deleting your Kyanix account purges all associated rows immediately. Backups roll over within 30 days.
6. Your rights
- Access, export, or delete your data from Settings or by emailing privacy@utkarshkr.in.
- Revoke Google access at any time from your Google account permissions.
- Delete your account in one click at /delete-account.
7. Subprocessors
- Managed Postgres — database, auth, hosting.
- Google — OAuth identity provider; Gmail API.
- Cloudflare — DNS, edge proxy.
8. Children
Kyanix is not directed at children under 13 and we do not knowingly collect their data.
9. Changes
We'll update this page and the effective date above when the policy changes materially.
10. Contact
Privacy questions: privacy@utkarshkr.in
Security reports: security@utkarshkr.in