How we protect your mail.
Declutter.ai needs access to your mailbox to do its job. That is a lot of trust. This page says exactly what we store, what we never store, what the AI sees, and how to cut us off.
The short version
- You connect with an app password, never your real password. You can revoke it in one click from your provider.
- The app password is encrypted before it is saved. The key lives outside the database and outside the app folder.
- We only move mail. There is no delete step in the code. We never empty your trash.
- We never send mail from your account. Your morning brief comes from our own service address.
- The AI sees the sender, the subject and the first 500 characters of a message, with signatures and quoted replies stripped. Never attachments.
- We do not store the text of your emails. We keep the short list of things below that the service needs to work.
What we store
| What | Why | How long |
|---|---|---|
| Your name, account email, plan, timezone and protected senders | To run your account and send your brief | Until deletion or within 48 hours of cancellation |
| Each inbox's address, provider and encrypted app password | To sign in to your mailbox | Removed immediately on cancellation or inbox removal |
| Sender addresses and the folder each one goes to | So it learns from the mail you move | Until deletion or within 48 hours of cancellation |
| Addresses of people you have written to, with a count | To recognize contacts, subject to your learned routes | Until deletion or within 48 hours of cancellation |
| A one-way fingerprint of your recent sent subjects | So replies to your own threads stay in the inbox | 14-day lookback |
| Message IDs, sender and folder for mail we filed | So nothing is filed twice | Processing ledger; decisions expire after 14 days |
| Short deadline entries: a cleaned title, a date and a company label | To build your morning brief | Until a week after the date passes |
| Billing records | Handled by Stripe. We never see your full card number. | As the law requires |
Shadow suggestions store sender and subject, never bodies, and expire after 30 days. Learning reads 14 days of inbox and sent mail. Cancellation removes app passwords immediately; account details and saved state are erased within 48 hours. Backups expire within 14 days after erasure.
Our logs record events such as "run started" or "message filed". They do not contain subjects, message text or passwords.
What we never store
- The body of any email.
- Attachments.
- Your real mailbox password.
- Links, phone numbers or bank details copied from your mail.
What the AI sees
Most mail is sorted by rules and by what it has learned from you. When a message needs judgment, we send the AI the sender, the subject and the first 500 characters of the body, after removing signatures, quoted replies and formatting. The date header is not sent.
We use Anthropic's commercial API. Anthropic states that API data is never used for model training without the customer's permission, and it keeps data under its commercial retention policy.
The AI can only answer with a folder key from a fixed list. Anything else is thrown away and the message stays in your inbox. Email text is treated as untrusted, with strict output validation and brief sanitization to reduce prompt-injection risks. These safeguards cannot guarantee that every extracted item is correct.
Wire and payment fraud
Any deadline that mentions a wire, an ACH, a routing or account number, or a change of bank details comes with this line in your brief: "Verify by phone with a number you already have. Never use contact details from the email." The brief never repeats links, phone numbers or account numbers from an email.
How the service is protected
- All connections to mail providers use TLS on port 993, with the provider's certificate checked. We refuse to connect to private or internal network addresses.
- Sign-in uses single-use email links that expire in 15 minutes. There is no password to steal.
- Signup and sign-in are protected by Cloudflare Turnstile and rate limits.
- Every form carries an anti-forgery token. Strict security headers block the site from being framed or loading outside scripts.
- Our deployment hardening script configures key-only administrator login, a firewall and automatic security updates. Production setup must be verified before launch.
- Backups are encrypted before they leave the server and are kept for 14 days.
Cancel, disconnect or delete
- Disconnect one inbox: remove it on your account page, or delete the app password at your provider. Access stops immediately.
- Cancel: service stops and app passwords are removed immediately. Account details and saved state are erased within 48 hours, with no partial refunds.
- Delete your account: one button on your account page removes your account, credentials and saved data right away.
- Your folders and mail stay exactly where they are in your mailbox.
Report a problem
If you think you have found a security issue, email security@declutter.ai. We reply within one business day.
Common questions
Is it safe to give an app my email password?
You never give us your real password. You create an app password, which only works for mail access and which you can revoke in one click from your provider's security page. We encrypt it before it is stored.
Can Declutter.ai send email from my account?
No. We never use your account to send mail. The daily brief comes from our own service address, not from your mailbox.
Can it delete my mail?
No. The code only moves messages between folders. There is no delete step, and it does not empty your trash.
Does the AI train on my mail?
No. We use Anthropic's commercial API, which does not train models on customer data.
Try it on one inbox first.
$8 a month or $60 a year. 7-day trial. Save a card, review read-only suggestions, then start your trial at go-live.