Privacy Policy

Overview

Zen Inbox is an email app for Gmail and Outlook on Android phones and Windows PCs. It is made in Canada. This page explains, in plain language, what the app can see, what we keep, who else is involved, and how to delete it.

Questions: support@zeninbox.ca

The person responsible for privacy at Zen Inbox is Sumesh Chandran, reachable at the same address.

What the app can access in your mailbox

Google or Microsoft asks you to allow these permissions. The calendar and mailbox-settings ones are asked for only as noted beside each; the rest when you connect an account.

Gmail and Google Workspace

• Your name and email address, to show which account is which.
• Full access to your mail (read, organize, send when you press Send, and permanently delete). Google only offers permanent deletion with full access, which is why we ask for it.
• Your calendar events, only if you turn on Calendar sync.

Outlook and Microsoft 365

• Your name and email address, and permission to stay signed in.
• Read and change your mail and send email for you.
• Read and change your calendar, only if you turn on Calendar sync.
• Read and change your mailbox settings, only if you say yes when the app offers it after you pin an Outlook email. The app uses it only to add a “Pinned” category to your Outlook categories, so Outlook shows your pins.

What stays on your phone

• Your emails, attachments you open, folders and search.
• Your Planner cards, summaries and app settings. If you share a mailbox's Planner with your other devices, its cards are also kept on our servers, encrypted, so those devices can show them.
• Planner backups, saved as files on your phone. Automatic backups keep the last 7. Backup files you save stay on your phone, even after you uninstall the app, until you delete them; the app only removes automatic backups older than the last 7.
• The information shown in home-screen widgets.

Removing an account deletes that account's emails, folders and sign-in from the app right away. Its Planner cards are deleted the next time the app starts from closed, or right away if it was your last account. Attachments you opened stay on the phone until you uninstall the app or clear its storage. The names and addresses the app remembered from that account's mail, to suggest while you type, stay until you remove your last account or uninstall the app. Uninstalling the app deletes everything it stored on your phone, except Planner backup files (the ones you saved and the automatic ones). It doesn't delete what our servers keep; see "How long we keep things". Your phone's own backup (for example Google's Android backup) may keep copies of some app settings according to your phone settings. Your emails are left out of those backups.

Calendar sync works from your phone or computer directly with Google Calendar or Outlook. Events we add live in your calendar. The app adds them itself; our servers never read or change your calendar. The sign-in tokens our servers keep (encrypted) include the calendar permission once you turn Calendar sync on on your phone, our servers renew Google sign-ins for the app, and, if you share your Planner, they note which event belongs to which card.

What our servers keep

Our servers run on Google Cloud (Firebase) in Montréal, Canada. We do not store your email bodies or attachments there.

• Account record: your email address, your name as Google or Microsoft gives it, the label and colour you gave the mailbox, your sign-in tokens (encrypted), Google's or Microsoft's ID for your account, which of your devices have signed in to it (their random IDs, platform, when each first and last signed in, and a one-way fingerprint of each one's secret key), the push addresses of the phones and computers that get notifications for it, the connection Google or Microsoft uses to tell us about new mail and whether it still works, whether Zen AI is on and since when, and your UTC offset and clock format so dates in cards are right.
• Device record: a random ID for each phone or computer, which email addresses are connected on it (and our record IDs for them), the app version, build and platform, your support ID, when it last checked in, and your Premium status: from Google Play (the product, the purchase token (encrypted), a one-way fingerprint of it, whether it's a trial, whether it renews, when it renews or ends, and when we last checked it), complimentary (the address it came through and our note), or borrowed from another of your devices (that device's random ID and the mailbox it came through). We never see your card number.
• Notification records: the ID of each email we sent you a notification about, so you don't get the same one twice. They contain no email content and are deleted automatically, usually within two days.
• Complimentary Premium and personal settings: if we give you free Premium (for example as a tester), or give your mailbox its own feature settings or AI provider, your email address is kept on a list with those settings and any note we add. We may also put your address in a group of addresses that we change settings for together.
• Admin history: a record of changes our support team makes for your account, for example giving complimentary Premium, naming your address. Kept until you ask us to delete your data; then we replace your address in it with a masked form (its first letter and domain), and keep a record of the deletion with that masked form and a one-way fingerprint of your address.
• Zen AI usage counts: how many summaries and writing-help requests each mailbox made each day, and an estimate of what they cost us. When we cannot tell which mailbox a request belongs to, it is counted under your phone's random ID. We use the counts for the daily limit on Zen AI and to watch our costs. They contain no email content.
• Premium offer counts: how many phones see the Premium offer, open the Premium page, tap a plan and start a subscription. We keep daily totals only. We do not keep your email address or your phone ID with the counts.
• Server logs: technical logs to fix problems. They can include your email address, the sender name of an email we notified you about (or the sender's address, when the email shows no name), what kind of card the AI made (for example "bill, due Sept 25"), flight numbers and status changes for trips we track, and occasionally a few words of an AI answer that failed. Kept for 30 days.
• Shared Planner (only if we have turned Planner sharing on for your mailbox and you chose to share it between your devices): the mailbox's cards, each with the email's ID, subject, sender name and address, when it arrived, the AI's summary and highlights, amounts, dates, travel details and your edits, along with the answer our server got from the AI for that email. For an email the AI made no card from, a note with the email's ID. Your rules for emails the Planner should skip. These are stored encrypted, with a key that is itself locked by Google Cloud's key service. We also keep the list of devices sharing it (random ID, name, platform, build, when each joined and was last seen) and which device adds calendar events. A card is deleted 7 to 14 days after its last date, or 30 to 37 days after the email arrived if it has no date, and never sooner than 7 days after it was last saved. When you mark a card paid, done or removed, its contents are replaced by a note with the email's ID, when it arrived and the mark, which is deleted 90 to 97 days later; a "no card" note is deleted on the same schedule. When sharing ends, the cards, notes, rules and key are deleted right away, and a record that sharing ended is deleted about a week later.
• Flight tracking (only if we have turned live flight status on for your mailbox): for a trip we track, our ID for your mailbox, the email's ID, and the flight numbers, dates, airports and live status. We stop tracking a trip after it lands (or a few days after its date if we never found the flight) and delete it about two weeks after that.
• Google Play notifications: a record of each subscription notice Google Play sends us (what happened, the product, the time, when the subscription ends and whether it renews) with your phone's random ID when we can match the purchase to a phone. We keep these.
• Place suggestions (Windows and Linux computers): a count of the place lookups each device made each day, with the device's random ID and platform. What you typed is not kept. Each count is deleted automatically about 8 days after its day.

Until September 2026 these servers were in the United States. We deleted them in September 2026.

Zen AI and email content

On the phone, Zen AI uses Gemini, Google's AI, through Google Cloud, unless we set your mailbox, or all mailboxes, to another provider. On a Windows PC, Zen AI writing help runs on the PC itself, using models the app downloads from Hugging Face; for writing help the Windows app does not send your email or your draft to us or to an AI company. For automatic summaries and the Summarize button, a mailbox can instead be set to one of these AI providers: Augure, Cohere or SPUR Compute. If that provider fails to answer, the same request goes to Gemini so your card still arrives. On the phone, writing help always uses Gemini. On a computer, it runs on the computer itself. If we add or change an AI provider, we will update this page before any of your email is sent to it. On the phone, Zen AI only runs if you have Premium, either with the Planner turned on or when you use AI writing help. On Windows and Linux, writing help runs on the computer itself and doesn't need Premium.

• Automatic summaries: when a new email looks like a bill, trip, appointment, event, subscription, receipt or task, its subject, the sender's name (or address, when the email shows no name) and up to 8,000 characters of its text are sent to the AI provider, along with the current date and time, your email address and the label you gave the mailbox (if you gave it one), so the card is written to you. When your phone asks for a card itself and the email belongs to a conversation that looks like arranging a meeting or call, or that already has a follow-up card, up to 3,000 characters of the emails you received in that conversation are sent in place of that one email's text. Most emails, including marketing, are filtered out before this and never sent. When you turn the Planner on, it also reads the mail of the last 30 days that is already on your phone, in the same way and with the same filter, so your first cards are there right away.
• Summarize button: sends the same details, taken from the full email rather than a preview (the preview only if the full email can't be fetched), with up to 3,000 characters of its text (the beginning and the end when the email is longer). For a conversation with more than one received email that has a follow-up card that hasn't been removed from the Planner, or that looks like arranging a meeting, it sends up to 3,000 characters of the conversation instead: each message's date, sender name, subject and text.
• Writing help: "Write a reply" sends the conversation (up to 6,000 characters). "Fix grammar", "Shorten", "Make formal", "Make casual" and "Make detailed" send only your draft (up to 4,000 characters). "Write a reply" also sends the label you gave the mailbox (or, if you didn't give one, its address), so the reply is written as you.

We use the answer to build your card or draft and don't keep the email's text. If you share a mailbox's Planner between your devices, we keep each card (encrypted) so your devices can show it; a card includes the email's subject and the sender's name and address. If we have turned live flight status on for your mailbox, we keep a tracked trip's flight numbers, dates and airports. We send email text to an AI provider only to make your card or draft, never for anything else.

• Gemini runs on Google's global AI service, which may run outside Canada. Google Cloud's terms say it does not use this data to train its models.
• Augure and SPUR Compute say they process requests in Canada.
• Cohere does not promise where its service runs, so requests may be processed outside Canada.

We don't use your email to train AI.

Turn off Show Planner in Settings on your phone to stop automatic summaries. If the same mailbox is also on another phone that has Show Planner on, turn it off there too, or that phone keeps them going. If your phone is offline when you turn it off, our server stops when the phone next syncs with it. Cards you already have are kept on your phone.

Other companies involved

• Google (Gmail) and Microsoft (Outlook) — your email provider, to read, send, organize and delete your mail, and to tell our server when new mail arrives.
• Google Cloud / Firebase — runs our servers and database in Montréal, Canada.
• Google Gemini (Vertex AI) — summaries and writing help, as described above. May run outside Canada.
• Augure (Toronto, Canada) — automatic summaries, for mailboxes set to use it. Says it processes requests in Canada.
• Cohere (Toronto, Canada) — automatic summaries, for mailboxes set to use it. May run outside Canada.
• SPUR Compute (Waterloo, Canada) — automatic summaries, for mailboxes set to use it. Says it processes requests in Canada.
• Firebase Cloud Messaging (Google) — delivers our notifications to your phone, and to Zen Inbox on Linux. A new-mail notification carries your mailbox's address, the sender's name and email address, the subject, a short preview of the email's text and, if the Planner made a card, the card's details (such as its summary, key facts, amount and dates). If we track a flight for you, flight messages carry the flight number and what changed. Runs on Google's global network.
• Sentry — crash and error reports, stored in the United States. Reports from the phone include a random support ID and a second random ID made by Sentry's kit; the app version; your phone's maker and model and general device details (such as Android version, memory, storage, battery level, screen size, connection type, language, time zone, when the phone was last started, which permissions the app has, and accessibility settings); the screens you opened before the error; whether the error involved a Gmail or an Outlook mailbox; and the error details. Reports from the Windows app include its support ID, the app version, the Windows version, memory, language, time zone and when the PC was last started (not the PC's name or model), how many mailboxes it has and whether they are Gmail or Outlook, whether you have Premium, and the error details. Sentry also works out a rough location from the internet address a report comes from. Before the app sends a report about an error in its main code, it looks for email addresses and for sign-in tokens in the forms it can recognise, and removes them or holds the report back. This is pattern matching and can miss things: it can't recognise other personal details, such as a name or a subject inside an error message. On the phone, reports of a crash or freeze outside that code (in the app's Android-specific parts, such as its home-screen widgets, or inside Android itself) are made by Sentry's kit and don't go through this check. The phone app also sends speed measurements for about 1 in 10 of the things it times (such as starting up and opening a screen), and a small record of each app session (when it started and ended, and whether it crashed). The Windows app sends no speed measurements.
• Google Play — Premium subscriptions and payments. We receive your subscription status, not your payment details.
• Web Hosting Canada — hosts this website and forwards email sent to support@zeninbox.ca. Support email is then kept in our support inbox at Microsoft Outlook.com.
• AeroDataBox and AirLabs — live flight status for travel cards, only if we have turned it on for your mailbox. Our server sends AeroDataBox the flight number and date from your card, and AirLabs the flight number; nothing about you or the rest of the email.
• Google Maps or Microsoft Azure Maps (whichever we have switched on) — address suggestions when you type a place for a calendar event on Windows or Linux. Our server sends them what you typed, your language and country, and a location used to put nearer places first (on Windows, the main city of your PC's time zone; on Linux, the place your desktop uses for its weather); not your email address.
• Microsoft (Windows push notifications) — tells Zen Inbox on your Windows PC to check for new mail or a Planner change, when we have this switched on. The message holds only our ID for your mailbox record: no sender, subject or text.
• Hugging Face — where Zen Inbox on Windows and Linux downloads its on-device AI models for Zen AI writing help and Speak. A download carries no email or account data; Hugging Face sees your computer's internet address and which model is being fetched.
• Google Calendar's public-holiday feeds — on Windows, if you add a country's public holidays to your calendar, the app downloads that country's holiday calendar from Google. The request says which country and carries nothing about you. On Linux, the desktop's writing tools and Speak can use Claude, OpenAI, Cohere or Augure, but only if you add your own key for one; the text you ask it to work on then goes to that service, and if you choose Cohere's servers to write down what you say, the recording of your voice goes to Cohere.
• Photon (komoot) — place search in the Linux desktop's calendar, used when our server gives no suggestions. What you type goes straight from the computer to Photon's public server, along with a language and, when the computer has one, a nearby point on the map rounded to about a kilometre.

Each company has its own privacy policy for the data it handles.

When you contact us

• Report a problem (Settings): on the phone, it sends a crash-style report to Sentry with the kind of problem you picked, the first 80 characters of your description and your support ID; on Windows and Linux, it opens an email to support from your own mailbox, with your support ID in the subject. On the phone, the screen asks you not to paste email content, and the app removes the email addresses and sign-in tokens it recognises from your description before sending it. It also lets you email support from your own account.
• Report a Planner card sends an email from your own mailbox to support with the card's details and your note. The original email is attached only if you choose to attach it, and you can remove it before sending.
• We read what you send us so we can help. It stays in our support inbox until we delete it, and you can ask us to.

Google user data

Zen Inbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: we use your Gmail and Google Calendar data only to run the features you see in the app. From the Android app and our servers, the only Gmail data that goes to other companies is: the email text sent to the AI providers above to make your cards and drafts; what your notifications carry (your address, the sender's name and address, the subject, a short preview of the email, Gmail's ID for the email and, if the Planner made a card, the card's details), which Firebase Cloud Messaging delivers; if you turn on Calendar sync with an Outlook calendar, the Planner cards the app adds to that calendar, with the email's subject and sender; if we have turned live flight status on for your mailbox, a trip's flight numbers and dates, sent to AeroDataBox, its flight numbers, sent to AirLabs, and the flight updates our server then sends to your phone through Firebase Cloud Messaging; and anything you send us yourself, such as a card report, which arrives in our support inbox at Microsoft Outlook.com through Web Hosting Canada. Error reports to Sentry are not meant to carry email content and the app removes the email addresses it recognises, but a stray detail inside an error message could get through. We don't sell your data, use it for ads, or use it to train AI models. People don't read your email, except when you send it to us yourself (for example a card report), or when needed for security or the law.

We do not use Google user data, including Gmail and Google Calendar data received through Google Workspace APIs, to develop, improve or train generalized or non-personalized AI or machine-learning models. AI is used only to make your own cards, summaries and writing help, as described above.

How we protect your data

We use encryption and access controls to protect your information, including your Gmail and Google Calendar data.

• Encrypted connections: the app, our servers, your email provider and our AI providers talk to each other only over encrypted HTTPS (TLS) connections.
• Encrypted storage on our servers: our database in Montréal is encrypted at rest by Google Cloud. On top of that, we encrypt the sign-in tokens for your mailbox, and your Google Play purchase token, with AES-256-GCM, using a key kept separately in Google Cloud Secret Manager.
• On your phone: your sign-in details are kept in Android's encrypted storage (Android Keystore). Your emails are stored in the app's private storage, which other apps can't read, and are left out of Android's cloud backups and device-to-device transfers.
• Access controls: the app and websites can't read or change our database directly; only our own server code can. Our admin tools only work for a short list of approved Google accounts. When Gmail tells our server that new mail has arrived, we check that the message really came from Google before acting on it.
• Keeping as little as possible: we don't store your emails or attachments on our servers. We send email text to an AI provider only to make your card, summary or draft, and we don't keep it. (What each provider does with it is set by its own terms.) Crash reports about errors in the app's own code are checked for email addresses and sign-in tokens the app can recognise, which are removed or the report is held back; other personal details inside an error message are not detected, and crashes below the app's own code are reported without this check.
• Human access: nobody at Zen Inbox reads your email, except when you send it to us yourself, or when needed for security or the law.
• If something goes wrong: if a security breach involving your personal information creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada, as Canadian law requires.

How long we keep things

• On your phone: until you remove the account or uninstall the app. Some things stay longer. A removed account's Planner cards go the next time the app starts (at once, if it was your last account). Addresses the app remembered to suggest while you type stay until you remove your last account. Attachments you opened stay until you uninstall the app. Planner backup files stay until you delete them (automatic backups keep only the newest 7), and uninstalling does not remove them.
• Account record and sign-in tokens: deleted when you remove the account from a device and no phone or Linux computer is left that our server sends that mailbox's notifications to. Otherwise deleted automatically after 90 days without app activity, or after 30 days if your phone can no longer receive our notifications. A Windows PC that still has the mailbox doesn't keep the record from being deleted when you remove the account: it registers the mailbox again the next time the app starts there, which sets the record up again unless our server refuses the registration (for example, because it would put you over your plan's mailbox limit).
• Server logs: 30 days.
• Notification records: deleted automatically, usually within two days.
• Zen AI usage counts: kept until you ask us to delete your data.
• Premium offer counts: daily totals with nothing about you in them. We keep them.
• Device records: deleted when you remove the last account from that phone, or after 90 days without app activity. If you bought Premium on that phone, we keep its Google Play subscription details so Premium keeps working, but after 90 days without app activity we remove the lists of connected email addresses and record IDs. If the Premium status saved on that phone's record is complimentary or shared from another of your devices, the record also names the address it came through (and, for complimentary, our note), and that clean-up does not remove it. Email us to delete the rest.
• Crash reports in Sentry: kept for Sentry's retention period. Send us your support ID and we will delete yours.
• Support emails: until we delete them. Ask us and we will.
• Backups: our database is backed up every day (each copy kept 7 days) and every Sunday (each copy kept 98 days), in Montréal, and it can be rolled back to any minute in the last 7 days. Anything deleted from the database stays in those copies until they expire, up to 98 days later. We use backups only to recover from a failure.

See Delete Account for how to delete everything.

Your choices

• Remove account in Settings to disconnect a mailbox.
• Turn off Show Planner to stop automatic AI summaries.
• Leave Calendar sync off (it is off unless you turn it on).
• Keep Load images automatically off (the default) so the pictures in an email aren't fetched when you open it, unless you chose to always show pictures from that sender. On the phone this holds back ordinary pictures, which covers the usual tracking pixel, but the app does not block pictures an email loads through its styling, so some senders can still tell. On a Windows PC the reading pane loads nothing from the internet until you allow pictures.
• Stop Zen Inbox's access anytime from your Google Account or Microsoft account.
• Email support@zeninbox.ca to ask what we have or to delete it.

Children

Zen Inbox is intended for users 18 and over. We do not knowingly collect data from children.

Changes

We will update this page when the app changes what it collects or who it shares with. The "Last updated" date below changes when we do.