Privacy & Security
What BlindSpot actually does with your data — in plain language, nothing glossed over.
Email is what's live today — any provider, not just one. Texts and voicemail are the next channels on the roadmap, the same read-only way, once we can get that working reliably on both iPhone and Android.
1What we can see
When you connect an inbox — Gmail, Outlook, Yahoo, iCloud, or another provider — you're granting a read-only permission (for Gmail specifically, Google calls it gmail.readonly; other providers have their own equivalent). This isn't just a promise in our privacy policy — your provider's own permission system makes it technically impossible for BlindSpot to send, delete, label, archive, or edit anything in your mailbox. We only ever look at mail you've already sent, to spot commitments you've made.
2What we store — and what we don't
We do not store your full emails. When something looks like a commitment, we save:
- A short title and summary (written by the classifier, not copied from your email)
- A short reference excerpt of the original text
- Who it involves, when it's due, and its status (open, done, dismissed, etc.)
The rest of that email — and everything in mail we didn't flag — is never copied anywhere. We only ever read what's needed to check for a commitment, in the moment we check it.
Two more limits on that excerpt specifically: a best-effort filter strips obvious sensitive data (things that look like account numbers, IDs, or credentials) before it's ever saved — it catches common patterns, not everything, so it's one layer, not a guarantee. And once a commitment has been resolved for 90 days, the excerpt itself is cleared automatically — the title, summary, and status stay (that's the actual point of the app), but the verbatim text doesn't sit around indefinitely.
3Encryption
- In transit: every connection this app makes — to your browser, to your email provider, and to every other service it talks to — runs over HTTPS/TLS.
- Everything at rest: our infrastructure providers encrypt the underlying disks by default, on encrypted cloud infrastructure. Row-level security also means the database itself physically refuses to return another account's rows (see section 4) — that isolation applies today, independent of encryption.
- Mailbox connection tokens and the excerpt/summary text — an extra, application-level layer of encryption on top of the disk-level encryption above: this is built and ready, but not switched on yet. Until it is, this page won't claim otherwise. We'll update this line the day it actually goes live.
4Your data is walled off from everyone else's
This isn't just an app-level check we could get wrong — it's enforced at the database itself. Every account's commitments are tagged with that account's ID, and the database is configured to physically refuse to return rows that don't belong to whoever's logged in. Even a bug elsewhere in the app can't leak your data to another account, because the database is the thing saying no.
5Who else touches your data
Three categories of service, and only these three:
- Your email provider (Gmail, Outlook, Yahoo, iCloud, or whichever you connect) — to read the mail you've authorized, nothing more.
- Our AI classification provider — receives the text of a flagged email momentarily, to classify it as a commitment. It is not used to train any model, sold, or shared onward.
- Our database and hosting provider — hosts BlindSpot's database. It's where everything above actually lives.
No ad networks. No data brokers. Nothing is sold, ever.
6Deleting your account
Settings → "Delete my account." Type DELETE to confirm, and in one step it removes every commitment, disconnects every mailbox, and deletes your login — no one on our side has to do it by hand.
Worth being direct about: this is immediate and permanent. There's no grace period and no way to undo it once you've confirmed. If you're not certain, don't type DELETE yet — ask first.