What we do with your email

What we can see, and why

When the Gmail owner connects AttentionShield, Google asks them to approve a permission called gmail.modify. We ask for it because we need to do four things:

• Read new messages, to write a summary.
• Label messages, for example “Needs you today” or “Ads and extras”. Labels do not take mail out of the inbox or mark it as read.
• Move marketing out of the inbox, but only after someone approves it with a tap or turns on a setting that does it. Moved mail is archived, not deleted, and still shows up in Gmail search.
• Send a note to the Gmail owner’s own address: the summary in the same conversation, and one short morning note a day (that one can be turned off in Settings).

That permission would also let a program send other email or delete mail. AttentionShield does neither.

What we keep

• Your account: your email address and the sign-in ID from Google.
• Summaries and details about each email: sender, subject, dates, labels, how important it looked, and the summary we wrote. The full message is read in memory to write the summary and is not stored as a full message in our database.
• Your choices: settings, senders you have muted or kept, and the taps you make on summaries.
• Billing: whether the subscription is paid, and references to it at Stripe. Card numbers are handled by Stripe; we do not store them.
• A key to the mailbox: the Google access token that lets us read new mail, kept in a locked store (a “vault”), not in plain view in our database.
• Technical logs: short-lived records we need to fix problems.

Who else handles it

We use a few other companies to run AttentionShield. Each one only gets what it needs for its job:

• Google: sign-in, and the Gmail access you approve.
• Anthropic: writes the summaries. Message content is sent to Anthropic for this.
• Supabase: sign-in, our database, and the vault for the Gmail key.
• Stripe: takes the $9/month payment.
• Resend: sends our own business email, such as receipts or a reply from support. This is separate from the notes in your Gmail.
• Railway (or a similar host): runs our servers.

There is one optional feature that contacts other companies for you: one-tap unsubscribe. It is off unless you switch it on, and it asks twice before doing anything. When you use it, our server asks the sender’s own website to take you off their list. We only record the website’s name, not the link. An unsubscribe cannot be taken back.

How long we keep it (retention)

• Summaries and email details: kept for up to 90 days, then deleted. A clean-up runs once a day, so a record can linger a day or so past 90. Counts of what the service cost to run (no email text) are kept.
• Your choices and taps: for as long as the account exists.
• Account and billing references: until the account is deleted. Stripe keeps its own records under its own rules.
• Technical logs: days to a few weeks.
• The Gmail key: until Gmail is disconnected or the account is deleted.

We are still in a closed beta, so these periods may be adjusted. If they change in a way that matters, this page will say so.

How to see it, stop it, or delete it

• See it: in Settings, “Download My Data” gives you a file with everything we store about you. It never includes the Gmail key or full messages.
• Stop it: remove AttentionShield from Google Account permissions. From then on we cannot read the mailbox.
• Delete it: “Delete My Account” in Settings removes the data we control and the Gmail key, and asks Stripe to remove the customer record.

Keeping it safe

Everything travels over encrypted connections (HTTPS). The Gmail key is kept in a vault, and access to our production systems is restricted. No system is perfectly secure, so a strong Google password and two-step sign-in on the Google account help too.

Children

AttentionShield is not meant for children under 13 (or the minimum age where you live).

Questions

Write to luke.spooner@lotuscollective.ai. A person reads it.