隱私 — OpenPlen

01The short version

Your mail stays in your own mailbox and on your own computer. OpenPlen stores no copy of it and has no server it passes through. When an AI model drafts or sorts a message, that message goes from your computer directly to the AI provider you chose, under your own account with them — never through us. What we do hold is an account: the address you sign in with, your handle, your public key, and — only if you use them — shared Pods. The rest of this page is the detail.

02What this website collects

If you submit the early-access form: your email address, the language you were reading in, the time you submitted, and a one-way hash of your IP address used only to limit abuse. Nothing else. There are no analytics scripts, no advertising pixels and no third-party trackers on any page of this site. Fonts and every other asset are served from our own origin, so opening a page here does not tell any third party that you did.

03Your account

To use the application you create an account with our directory. It holds the email address you sign in with; your sign-in method — a passkey's public credential or the link to your Google account (there is no password, so none is stored); your public key and the signed record of every change to it; your handle, if you claim one; a record of security events, such as a new sign-in, with the time and a coarse device name like "Mac"; and when each session was last used. Codes we email you for signing in are stored only as one-way hashes. The directory never receives, stores or forwards mail.

04What stays in the directory, and why

Your handle, your public key and the record of changes to it form a public directory: other people use it to check that a message or an invitation really came from you, which only works if that history cannot be rewritten. So when an account is closed, it is marked closed rather than erased, and the handle is never given to anyone else. Your email address, your sign-in methods and your sessions are not part of that public record and are deleted when you close your account.

05Shared Pods

If you create or join a shared Pod with other people, our server stores what the Pod needs in order to be shared: the names of the Pods, who is a member and in what role, open invitations — including the email address of anyone invited by address — and the posts and replies members write there. This content is not end-to-end encrypted: our server can read it. Do not put anything in a shared Pod that you would not put in any shared workspace. When a shared Pod is deleted, its content is deleted; a short notice that it was deleted is kept for each member for at most thirty days.

06What the application accesses in your mailbox

With your permission, the application connects to a mailbox you nominate and reads its messages, drafts replies, and applies labels or folders. It requests the narrowest access that makes those features work, and it asks for that access in context so you can see why. Access is granted by you and can be withdrawn by you at any time, from your mail provider's own security settings, without uninstalling anything.

07Google user data, specifically

If you sign in with Google, we ask Google for your basic profile and email address and keep only your verified email address. If you connect a Gmail or Google Workspace mailbox, OpenPlen accesses your messages and their metadata through Google's official APIs. That data is read into the application on your own device, indexed there so you can search it, and used to produce drafts and summaries that you review. It is stored on your device. It is not uploaded to us, it is not stored on our servers, and it is not shared with anyone other than the AI provider you yourself configured, for the sole purpose of producing the output you asked for.

08Our Limited Use commitment

OpenPlen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide the features you can see in the application, we do not transfer it except to deliver those features with your consent, we do not use it for advertising, we do not sell it, we do not use it to assess anyone's credit, and we do not use it to train or fine-tune any AI model.

09Humans do not read your mail

No one at OpenPlen can read your messages, because we hold no copy of them. If you report a problem and diagnosing it would require looking at a specific message, we will ask you for that message and you can decline. We will never ask for blanket access to a mailbox, and there is no internal tool that would grant it.

10The AI provider is yours, not ours

You choose which AI provider processes your mail, and you hold the account and the API key with them. Your message content travels from your computer to that provider directly. Their privacy policy and data-retention terms apply to that leg, so it is worth reading the one for whichever provider you pick — retention and training policies differ sharply between them. The model that powers search runs on your own computer: it is downloaded from us once, and downloading it sends us nothing about your mail.

11Where application data is stored

Mail, conversations, memory, documents and the search index are stored locally on your device. Credentials live in your operating system's keychain — never in plaintext on disk, never in logs. Once you have signed up, everything already on your device stays readable with no network connection. Apart from the AI provider you chose, your mail provider, and our account directory, the application sends your data nowhere. It sends us no usage statistics and no crash reports; if that ever changes, it will be off until you turn it on.

12Who processes data for us

We use a small number of service providers, each only for the job named here. Cloudflare hosts this website, stores the early-access list, and carries traffic to our account server. Resend sends the confirmation email for the early-access list. DigitalOcean runs our account server and its database, in Frankfurt, Germany; the database is backed up daily and each backup is kept for seven days. Postmark sends the security notices and sign-in codes we email you. Google is involved only if you choose to sign in with Google or connect a Google mailbox. None of them receives your mail from us, because we never have it.

13IP addresses and security

Our account server sees the IP address of each request. It is used only to limit abuse, shortened for IPv6 addresses, and deleted within twenty-four hours. The application and the account server talk only over encrypted connections.

14Deleting your data, and revoking access

Your local data is in your hands: remove the workspace and it is gone. To close your account, use Close account in the application. It signs the closure with your own key — we never close an account on anyone else's word — and our directory then removes your email address, your sign-in methods and your sessions by itself, keeping only the closed public record described above. If you own a shared Pod, delete it or hand it to another member first. If you write to support@openplen.com asking to close your account, we will walk you through it. You can revoke the application's access to a mailbox at any time from your mail provider's security settings; revocation takes effect immediately and does not depend on us. To leave the early-access list, use the one-click unsubscribe in any message we send — it deletes the record rather than flagging it — or write to support@openplen.com and ask, and we will, without asking why.

15Cookies

This site sets no cookies. Your language choice is remembered in your browser's local storage, on your device, and is never transmitted.

16Changes to this policy

If we change how the application or the account server uses your data, we will update this page and ask you to review the change inside the application before the new use begins. We will not quietly widen what we do with data you have already entrusted to the product.

17Contact

Questions about this policy, or about anything the product does with your data, go to support@openplen.com.

Privacy policy