Privacy Policy

The short version: your email is not our business model. We use your data to provide Aero, never to sell ads or train generalized AI.

1. Who operates Aero and what this policy covers

Aero is developed and operated by Shawn Schwartz (“Aero,” “we,” “us,” or “our”). This Privacy Policy describes how we collect, use, store, disclose, and protect personal information when you use aeromail.ai, our web application, desktop application, mobile application, and related services (the Services). Shawn Schwartz is responsible for the personal information covered by this policy and is the data controller where that term applies. Contact us at privacy@aeromail.ai. The policy covers information you provide, technical information generated while you use Aero, and data received from connected providers such as Google Gmail, Google Calendar, and Google Contacts.

How information reaches Aero

We receive information directly when you create a profile, connect an account, change settings, compose content, upload a file, submit feedback, or contact us. With your authorization, connected email, calendar, and contacts services provide the records needed for those features. Other people may provide information about you when they send you email, invite you to an event, or collaborate with you. Technical information is generated when devices and servers communicate with the Services.

Providing a mailbox connection is voluntary. Without the relevant permission, Aero cannot synchronize or perform actions for that mailbox, calendar, or address book. Optional AI, notification, file-sharing, and collaboration features have additional controls described below. Other providers and recipients also process information under their own policies.

2. Google account data: access and use

Connecting Google is voluntary. Authorization takes place on Google’s consent screen, which shows the permissions requested. Aero and its mailbox connection provider use authorization tokens to maintain the connection; Aero does not receive your Google password. Google permissions apply to the account you connect, and you can revoke them at any time.

Gmail

With Gmail access, Aero reads and synchronizes the message content and metadata described below so you can use it as your email client. Send permission lets you send messages and replies. Mailbox modification permission lets Aero mark messages read or unread, archive them, move them to Trash, and manage labels in response to your actions and enabled organization or screening settings. Removing a mailbox connection is different from moving individual messages to Trash: removal does not delete your original Gmail mailbox.

Google Calendar

With Calendar permission, Aero accesses calendar names and identifiers and event details such as titles, descriptions, dates, times, locations, organizers, attendees, and response status. We use these details to display your calendars and to create, edit, delete, or respond to events when you use those features.

Google Contacts

With Contacts permission, Aero reads contact names, email addresses, and associated contact identifiers to import your address book and suggest recipients when you compose mail. We do not use your address book to send marketing to your contacts.

Authorization credentials and background synchronization

Aero and Aurinko use the authorization credentials issued during connection to access the services you approve. These may include access tokens, refresh credentials, provider account identifiers, and the permissions granted. Credentials are used to keep the connection working, refresh authorization where supported, and synchronize changes in the background while the connection remains active, including when the Aero interface is not open. Google passwords are not received by Aero.

We use message identifiers, synchronization cursors, and change notifications to determine which records need updating. Reading email requires message access; sending requires send access; changing labels or message state requires mailbox modification access; editing calendar events requires calendar write access; and importing your address book requires contacts access. The consent screen and provider settings show the permissions for your connection. Revoking a permission may make the corresponding feature unavailable or require you to reconnect.

3. Google API Services and Limited Use

Aero complies with the Google API Services User Data Policy and its Limited Use requirements when accessing, using, storing, or transferring Google user data. These commitments also cover information derived from that data.

Google user data is used to deliver or improve the user-facing features described in this policy. We do not sell it, use it for advertising or ad targeting, provide it to data brokers, use it to assess creditworthiness, or use it to train or improve generalized or pooled AI or machine-learning models. These restrictions also apply to our service providers.

Transfers of Google data are limited to providing or improving these features with your consent, necessary security purposes, compliance with law, or a merger, acquisition, or asset sale with your explicit prior consent. Employees and contractors may read identifiable Google data only with your affirmative permission to view specific content, when necessary to investigate security issues or abuse, or when legally required.

4. Information we collect

Account and profile information

When you sign in, we receive account identifiers from WorkOS, including your user identifier, email address, and available profile information such as your name and profile image. We store your Aero profile, preferences, onboarding choices, workspace memberships, and subscription status so we can identify your account and provide your settings across supported devices. WorkOS handles the sign-in process. Signing in to Aero and granting access to a mailbox are separate actions; a sign-in identity alone does not give Aero access to your email.

Early-access requests

If you ask to join the closed beta, we store the address you gave us and anything you chose to add — your name, which mailbox you would connect, and what you are hoping Aero solves — so we can decide who to admit and when. That record is used to run the beta and for nothing else. Ask us at privacy@aeromail.ai and we will delete it.

Connected mailbox data

When you connect a mailbox, Aero accesses and stores message headers, sender and recipient addresses, subject lines, message bodies, attachments, message and thread identifiers, dates, labels or folders, and read/unread and other mailbox state. We use this information to synchronize and display your mail, search it, group conversations, screen senders, organize messages, show notifications, and carry out the mail actions you request. The connection is limited to the permissions you authorize.

Drafts, collaboration, and files you choose

We store content you create in Aero, including draft text, recipients, staged attachments, collaboration posts and comments, documents, invitations, and sharing permissions. Uploaded files can include their contents, filenames, file types, sizes, and storage identifiers. These records support composing and sending mail, continuing work across supported clients, and sharing with the audience you select. Draft attachments may be uploaded before you send the message; uploading a draft attachment does not itself send it to an email recipient.

Subscription and payment information

Stripe processes checkout, billing details, and payment transactions. Aero stores the customer and subscription identifiers, plan, subscription status, and related billing events needed to provide paid features and support your subscription. Payment details you enter in Stripe checkout are processed by Stripe; they are not included in mailbox synchronization or sent to our AI features. Financial and transaction records can be subject to separate legal retention obligations.

Support and feedback

When you contact us or use in-app feedback, we receive the information you choose to submit, along with relevant account or technical context needed to understand the issue. This can include your contact address and the text of your request. In-app feedback is delivered to our support workspace through Slack. Support submissions are separate from routine product telemetry, so information you deliberately include in a support message may be available to the person handling that request. Please share only content relevant to your issue.

Service and device data

We collect service events and technical information needed to operate, troubleshoot, and secure Aero: app and operating-system versions, device or browser characteristics, session and internal account identifiers, feature interactions, synchronization outcomes, timing and performance measurements, and redacted errors or crash information. Hosting infrastructure may process IP addresses, request times, and network information. Product telemetry is designed to exclude message bodies, subjects, snippets, email addresses, names, authorization tokens, and attachment filenames. Diagnostic information is used for reliability and abuse prevention, not to build advertising profiles from your mail.

5. Cookies, local storage, and device permissions

Sign-in and device storage

The web application uses session cookies to maintain authentication and browser storage to remember settings and support the interface. Supported clients also use device storage for session credentials, cached mailbox data, draft state, and preferences such as appearance and accessibility choices. These technologies help Aero keep you signed in and make the app responsive. Clearing browser storage can sign you out or remove locally stored preferences and unsent work; it does not delete your server account or original mailbox.

Website measurement and diagnostics

The marketing website is hosted by Framer, and the web application uses Vercel hosting and web analytics. These services can process page requests and technical usage information to serve pages and measure visits and performance. Aero also records product telemetry and uses Sentry for configured error and crash reporting. We do not use connected Google data for behavioral advertising or cross-site advertising profiles. Browser and device privacy settings can restrict some storage or measurement, although blocking essential session storage can prevent sign-in from working.

Notifications

When you enable notifications, Aero registers delivery identifiers such as a device push token and stores notification preferences. Novu and platform push services, including Apple Push Notification service and Firebase Cloud Messaging, route notifications to the selected device. Notification content may include a sender, subject, or excerpt, depending on your settings. You can change notification preferences in Aero and revoke device notification permission in operating-system settings. Disabling notifications does not delete synchronized mailbox data.

Selected photos and documents

Aero can open system photo and document pickers when you choose to attach or share a file. We process the files you select for that action; this does not import your entire photo library or scan unrelated documents. Depending on your platform, the system may ask for permission or grant access only to the selected items. You can decline the picker or manage available permissions through your device settings. Device file selection is separate from authorization to read Google Contacts or Gmail attachments.

6. How we use information

We use account and service information to authenticate you, apply your preferences, provide collaboration, manage subscriptions and payments, answer support requests, prevent abuse, and improve reliability. Connected Google data is used for the email, calendar, contacts, search, and optional AI features described here, subject to the stricter Google-data commitments in this policy.

Aero does not sell personal information, serve behavioral advertising, or use mailbox content to train generalized or pooled AI models.

7. AI features

Aero AI is optional and requires affirmative consent. When you enable it, relevant message content, participant information, and your prompts may be sent to Anthropic (Claude) to generate Daily Rundown summaries, suggested replies, search answers, and other AI features you use. Enabled features may refresh as described in their settings. Drafted replies wait for you to send them. You can turn off Aero AI in Settings to stop new AI processing.

Semantic search has a separate opt-in for indexing eligible mail. Where available and enabled, selected message text is sent to OpenAI to create numerical representations (embeddings) that help Aero find relevant messages. Those representations are stored with your account and used for your search results. Turning off AI or semantic indexing stops new processing for the disabled feature; it does not itself delete all previously stored messages or outputs. You can request their deletion through the contact below.

We do not use Google data, email content, prompts, or generated outputs to train shared or general-purpose models, and do not authorize model providers to do so. AI results may be inaccurate; review them against the source messages before relying on them.

AI inputs, outputs, and your control

Enabled AI features may send relevant portions of message text, conversation context, participant information, and your entered prompt to the model provider. Aero receives the generated summary, answer, or suggested draft and may store it with the associated account or feature so it can be displayed again. Search embeddings are derived from selected text and are treated as account data, even though they are numerical rather than directly readable message text.

AI and automated organization can summarize, rank, or group information in ways that affect what appears in your inbox or search results. They are productivity features, not decisions about credit, employment, insurance, or legal eligibility. Check important outputs and mailbox actions. Turning a feature off stops new processing for that feature; ask for deletion separately if you also want previously stored outputs removed. Model-provider processing and retention are described in the provider and retention sections of this policy.

8. How we share information

We share information with service providers only as needed to operate the Services, with recipients or collaborators you choose, for security and abuse prevention, and when required by law. Service providers process information on our behalf under applicable contractual restrictions. The categories and relevant providers are described below. Transfers of Google user data are additionally limited by the Google-data commitments in this policy; these restrictions take precedence over any broader sharing language.

We do not permit service providers to use mailbox data for their own advertising or generalized model training.

Providers that help operate Aero

Aurinko processes connected mailbox data and authorization credentials to connect Aero to supported email, calendar, and contacts services. Supabase provides database, authentication-token storage, and file storage for synchronized messages, attachments, preferences, and related app data. WorkOS handles Aero sign-in and account identity. Connecting a Google mailbox is a separate authorization from signing in to Aero.

Anthropic processes content for enabled Aero AI features, and OpenAI processes text for separately enabled semantic search, as described above. Notification services, including Novu and platform push-delivery services, process device or delivery identifiers and notification content. Depending on your notification settings, previews may contain sender information, a subject, or a short message excerpt.

Stripe handles checkout and billing information. Website and application hosting, monitoring, and support providers process the technical data or support information needed for those functions. Payment processing does not require access to your Gmail message bodies. If you contact support, we receive the information you choose to include; avoid sending unrelated mailbox content.

Hosting, measurement, and support providers

Framer hosts the public marketing site and processes page requests, site delivery information, and website measurement. Vercel hosts the web application and provides web analytics, processing requests and associated technical usage information. Sentry receives configured diagnostic events and crash reports after Aero’s redaction controls. Slack receives the in-app feedback you submit and support context needed to route and investigate it. These providers do not need routine access to your synchronized message bodies to perform website measurement or crash reporting.

A provider receives the information needed for its particular function: Aurinko connects and synchronizes authorized mailbox services; Supabase stores app records and files; WorkOS manages sign-in identity; Anthropic and OpenAI process the enabled AI inputs described above; notification providers handle delivery identifiers and applicable previews; and Stripe handles billing. A successful request to delete a service profile does not establish that all of a provider’s legal, security, or backup records have expired.

Sharing you control

When you send an email, the addressed recipients and their email providers receive the message and attachments. Calendar actions can share event details with invited attendees. In Aero collaboration features, the people you authorize can access the discussions, documents, shared threads, or files you choose to share. If you explicitly publish a shareable link, people with access to that link may be able to view the published content. Connecting a mailbox does not automatically share it with other Aero users. Recipients and collaborators may retain or copy information you send or share, and deleting your Aero account does not remove copies they independently hold.

9. Storage and protection of connected data

Aero stores synchronized mailbox content and metadata, attachment files, account preferences, and feature-specific derived information to provide the Services. Supported clients may also cache information on your device for performance. We use encrypted transport, protected server-side storage, account-based access controls, and secret management for authorization credentials. We do not sell Google data or make it publicly accessible unless you explicitly choose to share it. We restrict operational access and design product telemetry to exclude email content.

10. Retention and deletion

We retain account information while your account is active and synchronized mailbox data while the mailbox is connected. To remove a mailbox, use Settings → Mailboxes. To request deletion of your Aero account and associated stored data, email privacy@aeromail.ai. We verify requests to protect your account, begin deletion promptly, and target completion from active systems within 30 days. Receiving or accepting a request is not confirmation that every cleanup step has finished.

Account deletion covers Aero’s copies of synchronized messages, raw message files, attachments, imported contacts, stored calendar data, private drafts and files, search indexes, embeddings, and AI outputs associated with your account. It also includes cleanup of mailbox authorization credentials and the connected service, sign-in, notification, and billing profiles used to provide your account. Deleting Aero does not delete your original email provider account or messages held there. Shared discussions, documents, and files may remain available to collaborators; recipients may retain copies you sent them.

What happens after a deletion request

After ownership is verified and deletion is initiated, Aero removes the account’s active database mapping and associated private records, records the cleanup work still required, and retries file and service-profile cleanup if a provider is temporarily unavailable. Our target is completion within 30 days of a verified request. Request acceptance and cleanup completion are separate events. If you contact us about a pending request, we can investigate its status; do not assume that closing the app or revoking Google access completes server-side deletion.

Removing one mailbox limits deletion to that connection and its associated Aero data; other connected mailboxes and your Aero sign-in account can remain. Removing the full Aero account also includes the sign-in and notification profiles and, where applicable, cancellation through deletion of its Stripe customer profile. Neither action instructs Google to delete the underlying Google account or original messages.

Local copies and caches

Files are removed through the storage service as well as from database records. Delivery-network caches may take additional time to invalidate after origin removal. Supported clients may already have downloaded data to your device; clear application or browser data on devices you control if you also want those local copies removed. Uninstalling an app or clearing its cache does not request deletion of your server account. Copies independently retained by recipients or collaborators are outside this deletion workflow.

Database backups

Our hosted Supabase database currently has a seven-day daily-backup window. Backups rotate separately from deletion in active systems, so a database record removed from active use can remain in an older backup until that backup expires. Message and attachment files in object storage are deleted separately; they are not included in these database backups. We do not currently maintain additional database exports or outside backups. Backup access is restricted to recovery and security purposes.

Deletion records and limited exceptions

We retain a limited deletion record to track cleanup and prevent old sessions from recreating a deleted account. Our target is to remove completed deletion records after 90 days. Cleanup records do not contain mailbox content; provider identifiers needed for unfinished cleanup are retained until that step is resolved. Records necessary for legal obligations, billing or tax requirements, fraud prevention, or security may be retained longer and are restricted to those purposes.

Product telemetry retention

Aero’s own product telemetry is pruned daily. Most debug, navigation, and performance events have a seven-day retention period; ordinary events and selected web-performance measurements are kept for 30 days; error events are kept for 90 days. Daily pruning can add up to one sweep interval. Full-account deletion also removes telemetry linked to that Aero account. These periods apply to Aero’s product telemetry store, not to every hosting, support, payment, or security provider’s records.

Service-provider retention

The 30-day active-system deletion target is not a guarantee that every provider’s backups, safety records, or legally required records are erased on the same schedule. We request deletion of the service profiles associated with your account. Stripe may retain transaction history for financial and legal obligations. Infrastructure and security providers may retain limited operational records under their applicable retention rules.

For optional AI processing, Anthropic’s standard API retention is up to 30 days from receipt or generation of inputs and outputs, with exceptions for safety enforcement, legal requirements, and applicable service terms. OpenAI’s embeddings API has no stored application state; standard abuse-monitoring logs may be retained for up to 30 days, with longer retention where required by law or necessary for safety. These periods run from processing, not from your Aero deletion request. We do not claim zero retention for these services.

11. Revoke Google access or request deletion

You can revoke access at any time in your Google Account’s third-party connections settings. Select the Aero-related connection shown there and remove its access. If you authorized a connection through our mailbox provider, review that connection as well. Revocation prevents further authorized access but does not by itself erase information Aero previously stored.

To stop using a connected mailbox in Aero, remove it in Settings → Mailboxes. For full account deletion, deletion of previously synchronized Google data, or help if mailbox removal fails, email privacy@aeromail.ai from the address associated with your account. Tell us whether the request concerns a particular mailbox or your entire Aero account. We may verify your identity before acting. Do not send passwords or authorization tokens.

12. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to certain processing, and to appeal a decision. You may also withdraw consent without affecting prior lawful processing.

To request access, correction, export, deletion, or help exercising your rights, email privacy@aeromail.ai. We verify requests to protect your account and respond within the period required by applicable law.

How to make a privacy request

Use privacy@aeromail.ai for access, correction, export, deletion, restriction, or objection requests. Sending from the account’s contact address helps us locate the record but is not always sufficient proof of ownership; we may request additional proportionate verification. Specify whether you mean one connected mailbox, your full Aero account, or particular information. We respond within the period required by applicable law and explain any applicable exceptions or extensions. You may contact the relevant privacy regulator if you are not satisfied.

13. European and UK privacy information

Where applicable data protection law requires a legal basis, we process account and service data to provide the service you request, rely on consent for optional processing where required, and process necessary records to meet legal obligations. We may rely on legitimate interests for proportionate service security, fraud prevention, and reliability work where permitted. These bases do not override the stricter Google-data restrictions or a requirement to obtain consent.

People in the EEA, United Kingdom, and Switzerland may have rights to access, correct, erase, restrict, object to processing, and receive portable copies of their information, subject to applicable conditions. Where processing relies on consent, you can withdraw it without affecting processing already lawfully carried out. You can complain to your local supervisory authority. Shawn Schwartz is the data controller for Aero; direct requests to privacy@aeromail.ai.

14. California privacy information

Where California privacy law applies, you may request information about the personal information collected and disclosed, access to it, correction, deletion, and the applicable limits on use of sensitive information. The categories, sources, purposes, recipients, and retention practices are described in this policy. Aero does not sell personal information or share it for cross-context behavioral advertising. We do not discriminate against you for exercising applicable privacy rights. You or an authorized agent can contact privacy@aeromail.ai; we may verify identity and the agent’s authority before acting.

15. Security and international transfers

We use encrypted network connections, encryption provided by our hosted storage services, account-based database permissions, restricted storage access, and protected server-side credential storage. Database access rules associate requests with the appropriate Aero account or authorized collaboration membership. Publicly shared content follows the sharing choices described above. Administrative access is restricted, and telemetry and error reporting apply redaction controls designed to avoid collecting mailbox content and authorization secrets. These measures reduce risk; no internet service or device can be guaranteed completely secure.

International processing

Aero’s current hosted Supabase database is in the United States, in the US West region. Other providers may operate infrastructure or support in additional countries, and data may therefore be processed outside the country where you live. Applicable protections and rights may differ between locations. Where required, we use a lawful transfer mechanism, such as an applicable adequacy decision or contractual safeguards, and you can contact us for information about safeguards relevant to your data.

Email, calendar entries, and files can themselves contain sensitive information supplied by you or your correspondents. Aero handles that content to provide the features you authorize and does not use it to infer advertising categories or assess creditworthiness. Protect access to your own devices, review recipients and sharing settings before sending, and tell us promptly if you suspect unauthorized access.

16. Children’s privacy

Aero is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided personal information to Aero, contact privacy@aeromail.ai so we can investigate and take appropriate deletion steps.

17. Changes to this policy

We update this policy when our practices or the Services change and display the revision date at the top. We provide prominent notice of material changes. If a new use of Google user data is not covered by the purposes already disclosed, we update the disclosures and obtain any required additional consent before that use begins.

18. Contact the operator

For privacy questions, complaints, or requests about your personal information, contact Shawn Schwartz, the developer and operator of Aero, at privacy@aeromail.ai. Identify the Aero account or connected mailbox concerned and describe your request. Do not include passwords, payment card numbers, authorization tokens, or unrelated email content.