Privacy
policy

01Information we collect

We collect information you provide directly to us, including:

• Account information, such as your name and email address
• Messages, boards, tasks, projects, work logs, files, and other content you create in Zinthi
• Data from Gmail, Google Calendar, or Outlook, if you choose to connect them, as described in sections 02, 03, and 04
• Communications you send to us
• Payment information, if you buy a paid plan in the future. It is processed by our payment provider, and we do not store card details.

We also collect limited technical data automatically, including IP addresses, browser type, and usage data, to help us maintain and improve the Service.

The scratch board. The board at board.zinthi.com keeps your drawing in your browser only. We do not receive it unless you choose to keep the board in a Zinthi workspace, which creates an account under this policy. Clearing your browser's site data deletes the drawing.

02When you connect a Gmail account

If you choose to connect a Gmail account to Zinthi, we request one Gmail permission, gmail.modify. It lets us read your mail, apply the changes you make in Zinthi (such as read, archive, labels, and trash), and send mail you write. It does not let us permanently delete mail. With it, we access:

• Mail metadata: subjects, senders, recipients, timestamps, labels, and short snippets of message text. We store this metadata in our database to power inbox lists, search, and threading.
• Mail bodies and attachments: we read these on demand from Gmail when you open a message. We do not permanently store mail bodies or attachment content; bodies may be cached in memory for up to 30 minutes for performance.
• Send permission: when you send a reply or a new message through Zinthi, we send it on your behalf through the Gmail API. We never send mail without your explicit action.
• Modify permission: when you archive, label, mark as read, or otherwise manage your inbox in Zinthi, we apply those changes to your Gmail account.

You can revoke Zinthi's access to your Gmail account at any time from Zinthi's settings or from your Google account at myaccount.google.com/permissions.

03When you connect Google Calendar

If you choose to connect Google Calendar to Zinthi, we request one Google permission, calendar.events.readonly, which gives us read-only access to the events on your calendars:

• Event details: titles, start and end times, locations, attendees, and descriptions. We use these only to show your events in Zinthi, next to the work they relate to.
• Read only: Zinthi never creates, edits, or deletes events, and never responds to invitations on your behalf.

You can revoke Zinthi's access to Google Calendar at any time from Zinthi's settings or from your Google account at myaccount.google.com/permissions.

04When you connect an Outlook account

If you choose to connect a Microsoft Outlook account to Zinthi instead of Gmail, we request the following Microsoft Graph permissions: Mail.ReadWrite, Mail.Send, User.Read, and offline_access. Together they let us read your mail, apply the changes you make in Zinthi, send mail you write, identify your account, and stay connected between sessions. We use them in the same way we use the Gmail permissions above:

• Mail metadata: subjects, senders, recipients, timestamps, folders, categories, and short snippets of message text. We store this metadata in our database to power inbox lists, search, and threading.
• Mail bodies and attachments: we read these on demand from Microsoft Graph when you open a message. We do not permanently store mail bodies or attachment content; bodies may be cached in memory for up to 30 minutes for performance.
• Send permission: when you send a reply or a new message through Zinthi, we send it on your behalf through Microsoft Graph. We never send mail without your explicit action.
• Modify permission: when you archive, categorize, mark as read, or otherwise manage your inbox in Zinthi, we apply those changes to your Outlook mailbox. Although the permission technically allows it, Zinthi never permanently deletes mail; items you remove in Zinthi go to your Deleted Items folder.
• Account identity: we read your name and email address to label the connected account in Zinthi.

Only one email account, Gmail or Outlook, can be connected to a Zinthi account at a time. You can revoke Zinthi's access to your Outlook account at any time from Zinthi's settings or from your Microsoft account at myaccount.microsoft.com/consent. If your mailbox is managed by an organization, your administrator may also need to approve Zinthi before you can connect it.

05How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service
• Send transactional emails, such as account confirmations and product updates
• Respond to your support requests
• Detect and prevent fraud or abuse

We do not sell your personal information to third parties. We do not use your content for advertising, and we do not use it to train generalized AI or machine learning models.

06Use of Google user data

Zinthi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide and improve the user-facing features of Zinthi Mail and Zinthi's calendar view that you can see in the product. We do not:

• Use Google user data to train, develop, or improve generalized AI or machine learning models
• Transfer Google user data to third parties, except as necessary to provide the Service, to comply with applicable law, or as part of a merger or acquisition, in which case the receiving party will be bound by this policy
• Sell Google user data
• Use Google user data for advertising, including personalized, retargeted, or interest-based advertising
• Use Google user data to determine creditworthiness or for lending purposes
• Send Google user data to AI providers. Zinthi's AI features work on your workspace's chat, not on your mail or calendar.
• Allow humans to read Google user data, unless we have your explicit consent, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations

07Data storage

Your data is stored securely using industry-standard practices. We use Neon (serverless Postgres) for database storage and Cloudflare R2 for file storage. All data is encrypted in transit via TLS.

For data from connected mail and calendar accounts specifically:

• Mail metadata (subjects, senders, threading) from Gmail or Outlook is stored in Neon Postgres, encrypted in transit and at rest
• OAuth refresh tokens are encrypted at rest using AES-GCM, with a key separate from the database encryption
• Mail bodies and attachment content are not persistently stored. They are fetched from Gmail or Microsoft Graph on demand and cached in memory for up to 30 minutes.
• Drafts you compose in Zinthi Mail are stored in our database until you send or discard them. They are not copied to your Gmail or Outlook drafts folder.
• Calendar event details are stored in Neon Postgres, encrypted in transit and at rest, and refreshed from Google Calendar as your events change

08Third-party services

We use a small number of trusted third-party services to operate Zinthi:

• LiveKit, for voice and video calls
• Anthropic, to write thread catch-up summaries when you ask for one. Only the messages in that chat thread are sent. Anthropic does not use them to train its models.
• Loops, for transactional and marketing emails
• Cloudflare, for infrastructure and file storage
• Vercel, which hosts zinthi.com and board.zinthi.com and provides cookieless, aggregate page analytics. Vercel Analytics does not use cookies or identify individual visitors.
• Neon, for database storage
• Google (Gmail API and Google Calendar API), when you connect Gmail or Google Calendar. Your mail and events stay primarily on Google's servers, and we access them only on your behalf.
• Microsoft (Microsoft Graph API), when you connect an Outlook account. Your mail stays primarily on Microsoft's servers, and we access it only on your behalf.

Each of these services has its own privacy policy governing its use of data.

09Cookies

We use only the cookies needed to keep you signed in and maintain your session. We do not use tracking or advertising cookies.

10Your rights

You have the right to access, correct, or delete your personal data at any time. To make a request, email us at hello@zinthi.com and we'll respond within 30 days.

You can also export your workspace from Zinthi whenever you want.

11Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it.

If you disconnect a Gmail or Outlook account from Zinthi, we delete the associated metadata and revoke our access tokens within 7 days. Your mail itself is unaffected and remains in your Gmail or Outlook account.

If you disconnect Google Calendar, we delete the event data we hold and revoke our access tokens within 7 days. Your calendar itself is unaffected.

12Children's privacy

Zinthi is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children.

13Changes to this policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes by email. Continued use of the Service after changes constitutes acceptance.

14Contact

Questions about your privacy? Email us at hello@zinthi.com.