Privacy Policy

Siftbird helps you keep your inbox clean by deciding, for each new email, whether it should stay unread, be marked read, or be archived. This policy explains exactly what we access and store.

What we access

Most accounts connect over IMAP with an app password you create at your email provider (Gmail, iCloud, Yahoo, Fastmail and others). Siftbird signs in over IMAP to read each new message’s headers and the first few kilobytes of its text (to build a short preview), mark messages read, and move them between your folders (Archive, Junk, and — only if you turn on that cleanup level — Trash, recoverable until your email provider empties it). An app password technically allows more than that, including sending mail and permanent deletion. Siftbird’s code does neither: it never sends email and never permanently deletes a message. You can revoke the app password at your provider at any time, which cuts off our access immediately.

Accounts connected earlier through Google sign-in use a single Google permission (gmail.modify) to read message metadata and change read/archive labels. That permission cannot permanently delete email; it technically allows sending, whichSiftbird never does.

What we store

We deliberately store as little as possible:

• Your account identity (name, email, profile image).
• Your IMAP app password (or, for Google sign-in accounts, a Google token), encrypted with AES-256-GCM, so we can act on your inbox on your behalf.
• IMAP bookkeeping: your mail server’s name, folder names, and message-number watermarks.
• Any plain-English smart rules you write.
• Your billing status (via Stripe — we never see your card number).
• Your preferences and any sender rules you create.
• An activity log containing only the action taken, a derived category, the sender’s domain, and the message’s ID (Gmail’s ID, or the email’s Message-ID header) so you can undo it.

What we do NOT store

We never store the content of your emails — no bodies, no subjects, no attachments, no full sender addresses (unless you type one into a sender rule yourself). We read what we need to make a decision, then discard it. Email content is never used to train any model.

Data Security

We protect the sensitive data described above with the following safeguards:

• Encryption in transit: all traffic between your browser, our servers, your email provider, and Stripe is sent over TLS.
• Encryption at rest: your app password and any Google OAuth tokens are encrypted with AES-256-GCM before they are written to our database, in addition to the database provider’s own disk-level encryption. Tokens are never stored in plaintext.
• Access controls: production data is accessible only to Siftbird’s founder, who runs it alone, is never shared with third parties for marketing, and is not accessed by humans except as described above (support, security, legal compliance, or with your consent).
• Data minimization: we intentionally avoid storing email content, so there is nothing sensitive to protect beyond the metadata and tokens listed above.
• Retention & deletion: your app password or Google token and your account data are deleted immediately when you disconnect your inbox or delete your account.

Google API Services — Limited Use

Siftbird’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use the Gmail data we access (via the gmail.modify scope) only to provide and improve Siftbird’s inbox-triage features for you.
• We do not transfer or sell this data to others, except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use this data for advertising, and we never use it to train generalized AI/ML models.
• We do not allow humans to read your Gmail data, except: with your explicit consent for specific messages, where necessary for security (such as investigating a bug or abuse), to comply with applicable law, or where the data has been aggregated and anonymized.

Third parties

To sort mail and apply your rules, we send minimal metadata (sender, subject, a short snippet) to our AI provider for the moment of the decision only. Requests are restricted to zero-data-retention endpoints that do not keep or train on it, and we don’t retain it either. Payments are processed by Stripe. Hosting is on Vercel. Account and waitlist emails are sent through Resend. We use PostHog for product analytics (pages visited and buttons clicked), with all on-page text masked and session recording off. If you join the waitlist, we store your email address so we can invite you, and delete it on request.

Your control

You can turn automation off, disconnect your inbox, or delete your account at any time, which removes your stored data. Disconnecting deletes our encrypted copy of your app password. To fully cut off access, also delete the app password at your email provider (Google’s App passwords page, or the account security settings at iCloud, Yahoo and others). For accounts connected earlier through Google sign-in, disconnecting deletes our stored Google token; you can also remove Siftbird from your Google account’s third-party access settings.

Questions? Email support@siftbird.com.