Privacy

What we keep

• Your Gadfly account: email, name, password hash, passkeys, two-factor secret.
• The mail accounts you connect and their credentials, sealed under our master key.
• Mail content for to-dos and recent mail: bodies, subjects, summaries, to-do titles. Older mail stays with your provider and is fetched again when you open it.
• Your settings, the devices you sign in on, and push tokens for your phones.

How it is protected

Mail content is encrypted at rest with AES-256-GCM under a key that belongs to your account only. That key is itself sealed by a master key kept outside the database. Delete your account and its key is deleted, which makes your data unreadable in old backups too.

We do not claim end-to-end encryption. To sync your mail, read deadlines and chase you while the app is closed, the server must read mail while it works. Nobody reads it: no routine human access to production data, and no mail content in logs or error reports.

AI

Gadfly uses Anthropic's Claude through its commercial API to triage mail, find deadlines and write summaries. Anthropic does not train on API data.

This website

No cookies for analytics, no ad trackers. A sign-in cookie is set only when you sign in.

Visits are counted with our own self-hosted analytics: pages, referrers and which buttons are used. Nothing is stored in your browser for it, visitors cannot be followed from one day to the next, and no email address or name is ever part of it.

If you ask to be told about the release, we keep that email address for that one message and for your early sign-up offer. Write to us to have it removed.

Payments

Payments are handled by our payment provider, which sees your card and billing details. We see only your plan and its status.

Your rights

Export or delete everything from your account page, or write to hello@gadfly.email. Servers are in the EU (Germany) and run under the GDPR.