Security & Privacy

What Gmail access allows

Gmail connection is separate from creating an Incontrol account. The integration requests only Google's gmail.readonly permission. That permission allows reading mail; it is broader than the recent snapshot this version retrieves.

The Gmail integration does not send, reply, archive, delete, or change messages. Review buttons save your judgment inside Incontrol; they do not carry out an action in Gmail.

What is read and stored

When you choose to read recent mail, the app requests message metadata and Gmail preview text. It does not request full message bodies or attachment downloads. Preview text is still email content and can include sensitive information.

• Message details: subjects, sender and recipient headers (which may include names and addresses), preview excerpts, message and thread IDs, and message timestamps.
• Briefing records: spoke classifications, reasons, recommendations, urgency signals, deadline phrases found in the source, and any review choices or notes you save.
• Connection and settings: your connected Gmail address, connection and refresh timestamps, connection tokens, and the trusted sender addresses you add. Your Incontrol sign-in account is stored separately.

Classification uses rules in Incontrol's backend. The current email flow does not send mail to an AI model provider. Digests display source excerpts, rather than AI-generated summaries.

How long records remain

A successful refresh replaces the saved snapshot and removes briefing records absent from the new results. There is no automatic time-based expiry for saved briefing records. If you stop refreshing or a refresh fails, the previous snapshot can remain.

The Connection & trust screen offers “Disconnect & clear cached mail.” Its database operation removes your connection tokens, pending connection attempts, and cached briefing records, including saved reviews and notes. Your sign-in account and trusted sender list remain. Reconnecting also clears the previous briefing snapshot.

Disconnecting does not change Gmail or revoke Google's permission grant. Manage that grant in your Google account settings separately. Backup and infrastructure-log retention have not been verified; this is not a promise of removal from every copy.

Safeguards and their limits

Mailbox functions require sign-in and restrict access to the signed-in account's records. Google connection tokens are encrypted on the server before database storage and are not returned in mailbox views. That token protection does not extend to briefing text: the app does not encrypt subjects, addresses, excerpts, or notes before saving them. We cannot promise that stored email information is inaccessible to service operators.

The Gmail handlers use generic errors instead of logging Google response bodies or connection credentials. Website analytics, when configured, use cookies and browser storage for visits and interactions. The analytics code excludes app and Gmail callback routes and disables session recording. Hosting and backend logs have not been independently audited.

A recent snapshot, with limits

A manual read retrieves up to 100 incoming messages and checks up to 25 recently sent threads, using a 30-day search window. Sent threads may contain older messages. This is not full-mailbox monitoring. Machine search covers saved records; Waiting identifies possible follow-ups. Classification can be wrong, and a trusted sender header is not proof of identity. Verify sensitive requests in Gmail.