1. Who we are
Elyntic is an AI email assistant made of two parts: the Elyntic desktop application (for macOS and Windows) and this website, www.elyntic.com. In this policy, “Elyntic”, “we”, and “us” mean the operator of the Elyntic desktop application and website. You can reach us at privacy@elyntic.com.
Elyntic is local-first: the workspace that holds your connected messages, calendar events, contacts, tasks, and drafts is stored on your own computer, not on servers we run. The sections below describe the few cases in which data does leave your device, and to whom.
2. Data the desktop application processes
When you connect an account or turn on a feature, the desktop application may process:
- Email from accounts you connect (Gmail, or Outlook and other IMAP providers): message headers, bodies, attachments metadata, labels or folders, and the history the app builds from them.
- Calendar events from a Google Calendar you connect: titles, times, attendees, locations, and descriptions.
- Derived workspace records: the people, tasks, drafts, review states, and notes the app creates from that history and from your own input.
- Credentials: the OAuth tokens that let the app talk to a connected service on your behalf. Elyntic never sees or stores your account password.
- Optional integrations you configure (for example an AI model provider, Slack, Linear, Jira, or GitHub) receive only the data needed to perform the task you asked for, under their own terms.
These records are kept in a local database inside your operating-system user profile. OAuth tokens are encrypted at rest with your operating system's credential protection (Keychain on macOS, DPAPI on Windows) before they are written to disk.
3. Google user data
If you connect a Google account, Elyntic requests only the permissions needed for the features you turn on. The table lists each Google permission the application can request, why it is used, and where the data ends up.
| Permission | Why Elyntic uses it | Where the data is stored |
|---|---|---|
Google account email and basic profile | Identify which account you connected and label it in the app. | On your device. |
Google Calendar (read) — https://www.googleapis.com/auth/calendar.readonly | Read your calendars and events so the calendar, meetings, and planner features can show your schedule, detect meetings, and prepare related work. This permission alone cannot change anything on your calendar. | Events are cached in the local workspace database on your device. |
Google Calendar (events) — https://www.googleapis.com/auth/calendar.events | Create, change, or delete a calendar event when you ask Elyntic to — for example, turning an email into a meeting. Every calendar change is one you initiate in the app: Elyntic never writes to your calendar on a schedule, in the background, or on its own initiative, and by default creating an event does not email the other attendees. Elyntic does not request the broader Google Calendar permission, so it cannot share or delete a whole calendar. | Events you create are written to your Google Calendar and cached locally on your device. |
Gmail — read, organize, and (with your approval) send mail | Turn selected messages into tasks and context, keep the history that gives a request meaning, and send replies you approve. Gmail access is brokered through inbox.dog (see “Who else receives data”), or, if you connect Google directly, through the mail scope Google requires for IMAP access. | Messages and labels you connect are stored in the local workspace database on your device. |
How Google user data is used. Google user data is used only to provide and improve the user-facing features described above—showing your mail and calendar inside Elyntic, turning messages into tasks, detecting meetings, and preparing drafts you review. It is not used to serve advertising, is not sold, and is not used to train Elyntic artificial-intelligence or machine-learning models. No person at Elyntic reads your Google data unless you explicitly ask us to for support, it is required for security or legal reasons, or it has been aggregated so it no longer identifies you.
How Google user data is shared.Google user data is transferred only (a) to Google's own APIs to perform the action you requested, (b) to inbox.dog when you choose the inbox.dog Gmail connection (section 5), (c) to the AI model provider you configure, for the specific task you asked it to perform, and (d) as required by law. It is never shared with advertising platforms, data brokers, or information resellers.
Elyntic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the policy at developers.google.com/terms/api-services-user-data-policy.
4. How data is used
- To show your connected messages and calendar inside the app.
- To build the history, people, and tasks that give a request meaning.
- To let the AI model you choose prepare drafts, summaries, and follow-ups you review.
- To send replies and other actions only after you approve them, or under an automatic-delivery rule you set.
- To keep the application working, secure, and improving (see analytics below).
5. What leaves your device, and who else receives data
The following third parties can receive data. None of them buys data from us, and we do not sell data to anyone.
- Google LLC — receives the API requests needed to read your mail or calendar, to create or change a calendar event you ask for, and to send mail you approve, under Google's Privacy Policy.
- inbox.dog— when you connect Gmail through inbox.dog, it acts as the OAuth token broker and Gmail API proxy for that connection: it holds the Gmail credential and relays mail between Gmail and your device. inbox.dog is subject to its own privacy policy and to Google's policies for verified applications.
- Your AI model provider — Elyntic can run a model locally on your device (for example through Ollama, in which case nothing leaves your computer) or use a cloud provider you configure. A cloud provider receives the context needed for the task and applies its own retention and training terms.
- Other integrations you enable (Slack, Outlook/IMAP, Linear, Jira, GitHub, and similar) — receive only what the specific action needs, under their terms.
- Product analytics (PostHog) — the desktop application can send usage and error events (for example “task created”, app version, operating system, and a random installation identifier) so we can keep it working. These events are scrubbed of personal data before sending and do not contain the contents of your messages, calendar events, or drafts. You can turn analytics off in the application settings at any time.
- Website hosting (Vercel) — www.elyntic.com is served by Vercel, which processes ordinary web-server logs (IP address, user agent, requested page) to deliver the site.
6. Data the website collects
The website does not require an account and does not use advertising or cross-site tracking cookies. If you request early access, we keep the work email address you submit, the time you submitted it, and the page it came from, in a private waitlist so we can manage access and contact you. That record is separate from any desktop workspace and is not used to train AI. Ask us to remove it at any time by emailing privacy@elyntic.com.
7. Retention and deletion
- Workspace datastays on your device until you delete it. Removing a connected account in the application deletes that account's stored credential; deleting the workspace or uninstalling the application removes the local database.
- Google access can be withdrawn at any time by disconnecting the account in Elyntic and by visiting myaccount.google.com/permissions and removing Elyntic. After revocation the application can no longer read new data from that account.
- Records we hold (the early-access waitlist and any support correspondence) are kept only as long as needed for that purpose. Email privacy@elyntic.com to request a copy or deletion; we respond within 30 days.
- Copies held by connected services(Gmail, Google Calendar, inbox.dog, an AI provider) remain subject to that service's own policy. Deleting one copy does not automatically remove the others.
8. Security
Data in transit between your device and Google, inbox.dog, or a provider you configure travels over HTTPS. OAuth tokens are encrypted at rest with operating-system credential protection before being stored, and Elyntic never handles your account password—sign-in happens in your browser directly with Google or the provider. The application follows Google's guidance for native applications (loopback redirect and PKCE) so authorization codes cannot be intercepted by other software. No system is perfectly secure; if you believe your data has been exposed, contact us immediately.
9. Children
Elyntic is a professional tool and is not directed at children. We do not knowingly collect personal information from anyone under 16 (or the age of digital consent where you live). If you believe a child has provided us data, email us and we will delete it.
10. Changes to this policy
When we change this policy we update the “Last updated” date at the top of the page. If a change materially affects how Google user data is handled, we will also announce it inside the application before it takes effect.
11. Contact
Questions, access or deletion requests, and security reports: privacy@elyntic.com. See also our Terms of service and the plain-language overview on the Security page.