Kyanix

Legal

Security

Kyanix is built for people who care about their inbox. Here's how we keep it safe.

Effective June 26, 2026 · KyanixMail (operated by Utkarsh Kumar) · Bengaluru, Karnataka, India

Encryption

  • OAuth tokens: Google access and refresh tokens are encrypted with AES-GCM (256-bit) before being stored. The encryption key lives in the runtime environment, never in code.
  • In transit: all traffic is TLS 1.2+ (terminated at Cloudflare).
  • At rest: the database is encrypted with AES-256 (Supabase-managed).

OAuth & scopes

We use Google OAuth 2.0 with the minimum scopes required:

  • https://www.googleapis.com/auth/gmail.readonly — read message headers
  • https://www.googleapis.com/auth/gmail.modify — mark messages read / archive on unsubscribe (only when you click)
  • openid, email, profile — sign-in identity

You can revoke access any time from your Google account permissions.

What we read

  • Sent to our server: From, Subject, Date, List-Unsubscribe, List-Unsubscribe-Post, label IDs, and derived security signals (SPF/DKIM/DMARC results, sender domain).
  • Stored locally only: full message bodies are fetched on-demand into your browser's encrypted IndexedDB cache to power the full-email viewer and the Security Engine. They are never uploaded to our servers.
  • Never: attachments are not stored or scanned server-side.

Data retention

  • Email bodies, sender stats, and security analysis: stored encrypted on your device only (IndexedDB).
  • Disconnect a Gmail account: server-side account state is purged immediately.
  • Reset local data: wipes this device's encrypted vault; next scan re-syncs from Gmail.
  • Delete your Kyanix account: all server rows purged within seconds; backups roll over within 30 days.

Authentication

  • Sign-in via Google OAuth (no passwords stored on our side).
  • Sessions use Supabase Auth with short-lived JWTs and rotating refresh tokens.
  • Row-Level Security policies on every table ensure users can only ever see their own data.

Account security extras

The in-app "Account security" dashboard scans every connected email across three independent free providers (HaveIBeenPwned, XposedOrNot, LeakCheck) and surfaces breaches with detailed metadata. We never store the breach lookups themselves, only your "marked as fixed" records.

Responsible disclosure

Found a vulnerability? Email security@utkarshkr.in with reproduction steps. We'll acknowledge within 72 hours and credit you in the fix notes if you'd like.

Kyanix is not yet SOC 2 / ISO 27001 certified. We follow the spirit of those frameworks but don't claim formal certification until an independent audit completes.