Privacy Policy

QuippyAI is operated by PennaWorks ("we", "us") and available at pennaworks.com. For any privacy question or request, email kyle@pennaworks.com.

Account information. When you sign in with Google we receive your name, email address, and profile photo. Signing in does not give QuippyAI access to your email.

Gmail data (only if you connect a mailbox).Connecting Gmail is a separate, explicit authorization using Google's read-only Gmail scope (gmail.readonly). With it, QuippyAI syncs messages from approximately the last 30 days and new messages on an ongoing basis: sender and recipient addresses, subject lines, message content, dates, thread structure, and read/unread state. The read-only scope makes it technically impossible for QuippyAI to send, delete, or modify your email.

Google Calendar data (optional). Only if you enable deadline sync, we request Calendar access and use it to create and update deadline events on a calendar in your Google account. We do not read your existing calendar events for any other purpose.

Writing-style profile (opt-in only). If — and only if — you explicitly enable suggested replies, QuippyAI analyzes a sample of messages you have sent to build a profile of your writing style (tone, greetings, sign-offs). You can disable this and delete the profile at any time in Settings.

Information you provide. Client records, tasks, notification settings, your Discord webhook URL if you configure one, and anything you send us in support conversations.

Billing information. Payments are processed by Stripe. We store your subscription status and plan; we never see or store full card numbers.

Technical data. Session cookies to keep you signed in, push notification subscription tokens for devices where you enable notifications, and standard server logs.

• Organize your email by client and surface conversations that need a response.
• Identify requests, commitments, and deadlines in your mail and turn them into tasks and calendar entries.
• Alert you (via the channels you configure — web push and/or your own Discord webhook) when an important email is at risk of going unanswered.
• Generate suggested reply drafts in your writing style, if you opt in. Drafts are suggestions only; QuippyAI has no ability to send email.
• Operate, secure, and support the service, including billing and abuse prevention.

We do not sell your data, share it with data brokers, or use it for advertising. Ever.

QuippyAI's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, that means:

• Google user data is used only to provide the user-facing features described above.
• It is never sold, never used for advertising, and never used to determine creditworthiness or for lending.
• It is never used to develop, improve, or train generalized artificial intelligence or machine-learning models. Email content is processed by Anthropic's Claude API solely to generate the categorizations, tasks, and drafts you see, under API terms that prohibit training on this data.
• No human reads your email content except: with your explicit permission (for example, a support request); as necessary for security or abuse investigation; to comply with applicable law; or where the data has been aggregated and anonymized for internal operations.

Your data is shared only with the infrastructure providers required to run QuippyAI, each acting on our instructions: Railway (application hosting), Neon (database hosting), Anthropic (AI processing), Stripe (payment processing), and Google (the APIs you authorize). If you configure a Discord webhook, alert notifications are delivered to the Discord channel you chose.

Within a shared workspace, your connected mailbox is private by default. Teammates cannot see your email or email-derived tasks unless you explicitly share the mailbox with them in Settings.

We may disclose information if required by law, or as part of a merger or acquisition (in which case this policy would continue to apply to previously collected data).

• All data is encrypted in transit with TLS.
• Google OAuth tokens and Discord webhook URLs are additionally encrypted at the application layer with AES-256-GCM before being stored.
• Databases are hosted with encryption at rest.
• Every workspace is isolated: all data access is scoped to your organization and enforced server-side on every query.

Disconnect a mailbox:in Settings at any time. This immediately deletes the synced messages and all email-derived tasks for that mailbox from our database, and revokes QuippyAI's access token with Google so access truly ends.

Revoke from Google's side:you can also remove QuippyAI's access at myaccount.google.com/permissions, which stops all syncing immediately.

Delete your account: email kyle@pennaworks.com from your account address and we will delete your account and all associated data within 30 days, except minimal billing records we are legally required to keep.

Otherwise, we retain your data for as long as your account is active so the product keeps working.

QuippyAI uses only the session cookies required to keep you signed in. We do not use advertising cookies or third-party tracking.

QuippyAI is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

If we make material changes, we will update the effective date above and notify active users in the app or by email before the changes take effect.

Questions, concerns, or requests: kyle@pennaworks.com. See also our Terms of Service.