Data & Security

Last updated: 7 October 2026

The one thing to know

MyPAI reads your Gmail and Google Calendar, read-only, to find the commitments in them. Software we wrote — deterministic rules, not an AI model, and not a person browsing your mail — decides what to show you.

What "Clear" means — and what it doesn't

Today, MyPAI does not issue a Clear. That feature is switched off while we prove it works. Until it is switched on, no screen from MyPAI is a Clear. A calm message is not a Clear: MyPAI may show one when its items are not yet pressing, or say that it cannot confirm full coverage when it has nothing to show. Neither means that nothing needs your attention.

If we switch the feature on, we will publish here what a Clear means, and its limits, before it is available.

What MyPAI reads

• Gmail, read-only: your received and sent messages — headers (such as subject and sender), labels, dates and content — read in memory: in practice the messages in your Gmail Primary category (or, if there are none, your inbox) and your sent mail for the time window you choose (90 days by default). When certain features are switched on, MyPAI also looks up the identifiers (not the content) of your recent Trash and Spam messages.
• Google Calendar, read-only: the upcoming events on your primary calendar.
• Your Google profile: email address, name, picture, and Google's stable identifier for your account.
• Permissions requested: openid, userinfo.email, userinfo.profile, gmail.readonly, calendar.readonly.
• Outlook is not available in this release. Records from any earlier Outlook connection are kept but not used.

MyPAI never sends, edits, deletes or moves any of your email or calendar items, and never sees your Google password.

Why MyPAI reads it

Only to provide and improve MyPAI's own features: finding your commitments and showing them to you, checking its own accuracy, keeping the service secure, protecting it against data loss and meeting legal obligations. Nothing else: no advertising, no selling, no AI training.

What MyPAI stores

MyPAI reads your messages in memory. It does not store message bodies, attachments or snippets and does not keep a copy of your mailbox. Always, it keeps:

• your account identifiers (your Google email address and Google's stable identifier for your account) and the connection tokens that let it read on your behalf (kept on our server, protected by access controls; the long-lived refresh token never leaves it);
• records of the items it assessed for you — an identifier made with a one-way hash, MyPAI's assessment, the times, whether you marked them as handled or acknowledged them, and Google's identifier for the email conversation or calendar event concerned;
• your handled and acknowledged marks, the accounts you have connected (email address and when connected) with the personal or work label MyPAI sets for each, and the time of your last check;
• sign-in session records — a one-way hash of your session token, your email address, times and, recorded once at sign-in, your IP address and browser details;
• security logs of events and counts, designed never to include message content (the server's ordinary process log can also hold request and error lines, including IP addresses);
• encrypted backups of the above, taken manually from time to time; MyPAI's own automated scheduled backups are not yet in place.

When certain features are switched on, it also keeps commitment records — type, due time, state, a short description, the sender's domain, a normalised subject line or event title, the sender's email address (or a calendar organiser's), booking or order reference numbers and message or event identifiers (for the evidence behind a commitment, references to the messages or events, never their text) — records of items it chose not to show you, and what happened next (its conversation identifier, a one-way hash of the subject, the sender's domain, the message date, for some decisions whether it was unread and whether you had replied, its assessment and, on later checks, what you then did with the conversation, such as replying to, starring, reading, archiving or deleting it, with weekly counts by sender domain) and notice records (the kind of notice and when it was last shown).

The full list is in our Privacy Policy, section 3.3.

What reaches your browser

• A short-lived Google access token. At sign-in MyPAI's server passes your browser a short-lived Google access token — never the long-lived refresh token, which stays on our server. Your browser uses it once to ask Google for your name, email address and profile picture. If you add another account, the tab holds that account's token in session storage until the link completes, then clears it.
• Google scripts. Every page of the web app loads Google's sign-in script, and the app also includes Google's older Firebase library (details in the Privacy Policy, section 3.4). MyPAI uses no advertising, analytics, tag-manager or error-tracking scripts.

The commitments MyPAI finds

The commitments MyPAI shows you are its own automated assessments, made by deterministic rules from what it read — not by an AI model. They are personal data about you and get the same protection as your mail, including Google's Limited Use rules below. In the app, only you see them; you can ask us to correct or delete them, or for a copy. Marking an item as handled records your choice and MyPAI stops counting it as needing you (it may bring it back if the situation changes); it is your statement, not a check by MyPAI that the commitment is done.

Limited Use

MyPAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms:

• We use the Gmail and Calendar data MyPAI reads only to provide and improve MyPAI's own features: finding the commitments in your mail and calendar and showing them to you. These features are the MyPAI product you see.
• We do not transfer your Google data to anyone else, except: to the hosting providers that run MyPAI for us (see Who else touches your data); where necessary for security, such as investigating abuse; where the law requires it; or, only with your explicit prior consent, as part of a merger, acquisition or sale of assets.
• We do not use your Google data for advertising, and we never sell it.
• We do not share your data with advertisers, data brokers or AI companies.
• We do not use your Google data to create, train or improve any machine-learning or artificial-intelligence model. MyPAI's decisions are made by deterministic software we wrote, not by a model, and MyPAI does not send your Google data to any AI model or AI provider.
• We do not let people read your Google data, except: with your clear agreement for the specific items concerned; where necessary for security; where the law requires it; or as aggregated, anonymised figures used to run the service.
• These commitments apply to the data we read and to everything we derive from it, including our own records and backups.

AI and model training

No AI model decides what matters. MyPAI's engine is deterministic software written by us. MyPAI does not train, fine-tune or improve any AI or machine-learning model — ours or anyone else's — with your data, and no part of MyPAI sends your Google data to an AI model or AI provider.

Connecting an AI assistant

Today: MyPAI does not offer any connection to an AI assistant. If we ever offer one, we will update this page and the Privacy Policy before it is available.

How we protect it

• Read-only access: MyPAI cannot change your mailbox.
• Encrypted connections (HTTPS) between your browser, MyPAI and Google.
• Sessions on our server: the sign-in cookie is HTTP-only and Secure, and our database stores only a one-way hash of the session token itself (the session record also holds the details listed above).
• Access by grant only: a sign-in from a Google account that has not been given access is refused before anything about it is saved.
• No message bodies in our database.
• Security logs designed never to record message content, tokens or full email addresses.
• Encrypted off-site backups, taken manually. We take encrypted off-site backups from time to time, with a key kept separate from the database. MyPAI's own automated scheduled backups are not yet in place, so we do not promise a backup of your latest data.
• We claim no security certification (such as SOC 2 or ISO 27001).
• Independent checks: MyPAI has not yet completed Google's verification for restricted Gmail access, or the annual independent security assessment (CASA) that Google requires for it.

We add a protection to this page only once it is actually in place.

Keeping, deleting and exporting your data

How to manage or delete your data today

1. Stop MyPAI reading your mail. In your Google Account, open Security, find the list of third-party apps and services with access to your account (Google may reword these screens), choose MyPAI and remove its access. Google then stops honouring MyPAI's tokens. This does not delete anything MyPAI has already stored.
2. Log out of MyPAI to end your session on that browser. This deletes the session record; it keeps your stored connection tokens.
3. Additional accounts. If you linked an additional account, Disconnect in MyPAI's account menu deletes that account's stored tokens and its entry in your account list, but not the records already made about its mail. It does not itself ask Google to revoke access, so also remove MyPAI in that Google Account.
4. The account you sign in with. MyPAI has no button to disconnect it or delete its data, and no self-service account deletion or export yet.
5. Delete your MyPAI records, or get a copy. Ask us (Contact). We delete the records MyPAI holds about you, or send you a copy in a machine-readable format, within one month and confirm when it is done. We may first need to confirm your identity.

Deleting a record removes it from our live systems. Copies inside older encrypted backups and in our host's disk snapshots remain until those backups are deleted or the snapshots expire (see Backups below). If Google stops honouring MyPAI's tokens, they stay stored until they are deleted.

How long we keep each kind of record

• Records are kept for as long as you have a MyPAI account; we do not currently delete them on a timer.
• Sign-in sessions: the cookie lasts 30 days from sign-in; on the server a session ends after 30 days without use and in any case 90 days after sign-in. Logging out deletes the session record, and an expired session's record is deleted if its cookie is presented again, but there is no scheduled clean-up, so other expired records (which include the IP address and browser details recorded at sign-in) stay until your account is deleted.
• Backups are taken manually for now and are encrypted; a deleted record stays inside older encrypted backups until we delete those backups. We have not yet set a fixed retention period for backups; we keep them until we delete them. Separately, our host, Render, takes automatic daily snapshots of the server's disk and keeps them for at least seven days; a deleted record can remain in a snapshot until it expires.
• Security logs: MyPAI's own security events hold codes and counts, designed never to include content. Our host, Render, keeps the server's process log (these events and ordinary request and error lines) under the log retention that applies to our hosting plan.

Who else touches your data

These four are the only providers that receive your Google data or MyPAI's records of it:

No analytics, advertising, error-tracking, payment or AI provider receives your data, and we do not share it with advertisers, data brokers or AI companies. Where each provider processes data, and the safeguards for transfers outside the UK, are in our Privacy Policy, section 8.

Contact

andrewostyles@gmail.com · UK regulator: Information Commissioner's Office, ico.org.uk.