Your inbox is personal. We treat it that way.

Who operates this service

DailyAiBrief is operated by Daily AI brief. For privacy questions, contact [email protected].

Information we access

With your Google authorization, we access your Gmail email address, message identifiers, senders, subjects, message text, timestamps and labels. We access inbox messages to display email, calculate statistics and create optional AI briefs. We change read status and archive or move messages to Trash only when you use the corresponding controls. Gmail normally permanently deletes messages left in Trash after 30 days. We do not download attachments or load remote email images.

We receive OAuth access and refresh tokens to act within your granted permission, including offline access. We never receive your Google password. We use an essential session cookie and a short-lived OAuth security cookie. This application contains no advertising, analytics or tracking cookies.

How we use the information

We use Google data only to provide visible email productivity features: inbox viewing, user-requested message management, inbox statistics and the optional daily brief. Background AI reading runs only after you enable automatic daily briefs. We do not sell Gmail data, use it for ads, credit decisions or unrelated profiling.

Optional AI processing

AI is disabled by default. After you configure and authorize a provider, message excerpts, sender/subject details, message identifiers, dates and unread status are sent over HTTPS to OpenAI, OpenRouter or the custom OpenAI-compatible endpoint you chose. Up to 10 recent inbox messages and up to 10,000 text characters per message are included in each brief. OpenRouter forwards requests to a downstream model provider; our OpenRouter preset requests routes that disallow data collection and support the required parameters. These providers are third parties with their own retention and privacy policies. Review those policies and configure the provider not to use Google user data for model training before enabling AI. DailyAiBrief does not use Google user data or derived briefs to train generalized AI models. Changing provider settings disables AI and scheduled processing until you consent again.

AI can be inaccurate or omit details. Its output is a suggestion; it cannot send or alter email. Turning AI off deletes the saved brief and stops future AI jobs. An already-running request may finish processing, but its result is discarded if permission has been withdrawn.

Storage and retention

We encrypt your email address, Google tokens, provider API key, settings and latest AI brief in the application database using AES-256-GCM. Session identifiers are stored as hashes. Email bodies are processed in memory and are not saved in the app database. They are sent to your browser to display the inbox.

Only the latest brief is retained; generating another replaces it. Account records expire after 30 days without authenticated app activity. Expired records are deleted on the next service database activity or scheduled cleanup. Disconnecting deletes active account data immediately. The app does not create backups; any infrastructure backup retention must be disclosed here before such backups are enabled.

Sharing and human access

The app does not sell data or share it with advertisers. It sends the described email data only to your selected AI provider after explicit consent. The provider also receives your API key to authenticate the request; your Google tokens are never sent to that provider. Hosting infrastructure processes data only to operate the service under the operator's control. Human access to Google user data is limited to your explicit consent for specific messages, necessary security investigations, legal obligations, or other uses specifically allowed by Google's Limited Use requirements. Ordinary support does not require reading your inbox.

The deployed service runs on a private VPS controlled by Daily AI brief. Cloudflare provides the public reverse proxy. HTTPS protects both the browser-to-Cloudflare connection and the Cloudflare-to-VPS connection; Cloudflare validates the origin certificate using Full (strict) mode. These infrastructure services process requests to deliver the app. We do not configure email-content logging or application backups. Contact us for questions about hosting and applicable data rights.

We may disclose information when required by applicable law or to address fraud, abuse or security incidents, subject to Google's user data requirements.

Google API Services Limited Use

DailyAiBrief's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. These restrictions also apply to derived, aggregated and anonymized Google user data.

Your choices and deletion

You can disable AI or daily processing, disconnect Gmail and delete app data in Settings, or revoke access through Google Account connections. Revoking access at Google stops our API access but does not by itself delete locally stored records. Use our data deletion process for local deletion. For access, correction or other privacy requests, contact [email protected].

Children and policy updates

This service is not directed to children under 13 or below the minimum age required by local law. Material changes to data use require an updated policy and any necessary new consent before those changes take effect.