Privacy Policy

Effective Date: October 9, 2026

At Moderation, your privacy isn't just a legal requirement — it's a moral commitment. This policy explains how we collect, use, protect, and respect your personal information.

1. What We Collect

• Personal details you provide (e.g., name, email, age)
• Emotional states or personal reflections you choose to share
• Location data via map services
• Financial data you submit or connect
• Usage data (how you interact with the product)
• Optional files, voice notes, or journal entries
• Gmail messages and Google Calendar events
• What you send to mod.me, the in-app assistant (messages, photos, and files), and the facts, reminders, routines, and permissions it keeps for you

2. Why We Collect It

• Personalize your experience
• Enable core features
• Improve and evolve the platform
• Ensure trust and safety

3. What We Never Do

• We do not sell your data
• We do not serve ads
• We do not track you across other sites
• We do not use your data to train or improve any general-purpose AI model

4. Google User Data — Limited Use

Moderation's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In practice, that means:

• We use your Gmail and Calendar data only to provide the features you can see and use in the app — email sorting, triage, flagging, reply drafting, meeting scheduling, and the mod.me assistant when you ask it something or it runs a reminder or routine you set up.
• We do not transfer your Google data to anyone except the service providers named in section 7, who process it on our behalf so that those features can work, and the people you choose to email or invite when you approve it in mod.me.
• We do not sell your Google data, and we never share it with advertising platforms, data brokers, or information resellers.
• We do not use your Google data to create, train, or improve any generalized or general-purpose machine learning or artificial intelligence model, and we never provide it to anyone else to train theirs. We do train our own models — described in section 6a — and they exist only to run the features listed above for Moderation users. They are never sold, licensed, shared, or used for any other product.
• No one at Moderation reads your email or calendar except where you have explicitly asked us to look at something specific (for example, when you report a problem), where it is necessary to investigate abuse or a security incident, or where the law requires it.

5. Google Account Access

This section covers the Google Calendar and Gmail data access. You can disconnect your google account at any time. For each connection we store the OAuth access and refresh tokens, encrypted by our application before they are written to our database.

Gmail. We ask for the following Gmail data access: message metadata, message bodies, derived data, and sync bookkeeping. This data is used to:

• Categorize, sort, and flag incoming email
• Draft replies for you to review, edit, and send
• Schedule meetings based on your availability and the timing of events
• Build your contact list from the people you email and meet with
• Use the timing and location of events to make the app's suggestions fit your actual day
• Let mod.me find and read the messages you ask it about, save drafts for you, and send, archive, or label mail after you say yes to it in the chat (or under a standing permission you gave it there and can revoke)

Google Calendar. We ask for the following google calendar data access: event details, your calendar list, derived data, sync bookkeeping, and a record of events we created. This data is used to:

• Schedule meetings based on your availability and the timing of events
• Update and modify events to fit new information or changes to your schedule
• Plan more efficient and effective meetings by considering your availability and the timing of events
• Use the timing and location of events to make the app's suggestions fit your actual day
• Let mod.me answer questions about your schedule, and add, change, RSVP to, or delete events you approve in the chat (adding, changing, and RSVPs can also run under a standing permission you gave it there and can revoke). When it does, Google emails the event's guests or organizer about the change, as it would if you made it yourself

6. How We Use Your Gmail and Calendar Data

• Categorization and sorting — deciding what kind of email each message is and where it belongs
• Triage — ranking what needs your attention and what doesn't
• Flagging — surfacing mail that looks important, time-sensitive, or unusual
• Reply drafting — preparing suggested replies for you to review, edit, and send
• Scheduling — reading your calendar to work out when you're free, proposing meeting times, matching emails to events already on your calendar, and adding an event once you accept a time
• Contacts — building your contact list from the people you email and meet with
• Travel and planning features — using the timing and location of events to make the app's suggestions fit your actual day
• mod.me assistant — when you ask it something, reading your next 48 hours of events and the mail and events that bear on your question, and answering it; saving drafts; sending, archiving, or labeling mail and making calendar changes once you approve them; learning how you write from a few of your recent sent emails so its drafts sound like you; and running the reminders and routines you set up

That's the whole list. We do not use your Gmail or Calendar data for advertising, profiling for third parties, or resale.

6a. The Models We Train Ourselves

Some of the features above are powered by machine learning models we train in house, and we would rather tell you exactly what that means than leave it to a blanket denial.

• What they do. They predict, at the moment a message arrives, whether it is something you would delete, what category it belongs in, and whether it describes an event worth putting on your calendar. That is the sorting and triage you see in the app.
• What they are trained on. Data derived from the mailboxes of Moderation users — including yours — and, above all, from what users actually did with their mail: what you read, replied to, archived, starred, deleted, or pulled back out of the trash. The training inputs are the derived signals we describe in section 6 (sender patterns, timing, structural properties of a message, your own actions), not the text of your emails.
• They are trained across users, not just on your own mailbox. A model that had only ever seen one person's mail would be a poor judge of it. So your data contributes to models that also serve other Moderation users, and theirs contributes to the ones that serve you. The models learn general patterns; they do not store or reproduce your messages, and no user can see another user's mail, contacts, or predictions through them.
• What they are never used for. Training, fine-tuning, or evaluating any general-purpose or foundation AI model; any product other than Moderation; anything sold, licensed, or shared with a third party. No third party receives your Google data for training — see section 7 for the processors we send data to and the terms that bind them.
• Deletion. Deleting your data removes the mailbox data and derived signals we hold, so nothing of yours is used in any future training run. Models already trained are aggregate statistical artifacts from which your individual data cannot be extracted, and they are not retrained retroactively; they are replaced over time as new models are trained without your data.

7. How Google User Data Is Shared and Transferred

Apart from the people you choose to email or invite through mod.me (below), we share your Google user data with one category of recipient: service providers who process it on our behalf, under contract, so that the features above can work. Today that means one company, and we think you should know exactly what leaves our systems and where it goes.

Anthropic PBC. We use Anthropic's Claude API to automatically categorize, triage, and flag incoming email, to assist in drafting replies, and to power mod.me, the in-app assistant. For email, this involves sending the sender, subject, and full body of your emails, and excerpts of your own previously sent emails, to Anthropic for processing. When you use mod.me, we also send your chat messages and any photos or files you attach, your recent conversation and the facts mod.me remembers about you, and the Gmail and Google Calendar content it reads to answer you, including event titles, times, places, and guests. Web searches and page fetches that mod.me makes are run by Anthropic as part of the same service. On our Anthropic API organization, inputs and outputs are automatically deleted within 30 days by default, and your prompts and outputs are never used to train models under Anthropic's Commercial Terms of Service §B (privacy.claude.com, anthropic.com/legal/commercial-terms). Anthropic's handling of this data is further governed by a Data Processing Addendum. See Anthropic's privacy policy for more detail.

For scheduling, what we send Anthropic from your calendar is narrower: the candidate dates and times you are free, worked out on our servers from your events. The titles, descriptions, locations, and attendees of your calendar events are not sent for scheduling. mod.me is different: each time you use it, the titles, times, places, and guests of your events for the next 48 hours, and of any other events it looks up to answer you, are sent to Anthropic, as described above.

When you approve an email or a calendar change in mod.me, it goes to the people you chose: the email to its recipients, and Google's invite, update, cancellation, or RSVP emails to the event's guests or organizer.

Beyond that, your Google user data is transferred only where the Limited Use requirements permit it: to comply with applicable law, to investigate abuse or protect the security of our users, or — with your explicit prior consent — as part of a merger, acquisition, or sale of assets. We will tell you before a change of ownership affects your data.

Our own infrastructure runs on Amazon Web Services in the United States. AWS hosts the databases and servers your data sits on; it does not use your data for its own purposes.

8. Retention and Deletion of Google User Data

You can disconnect Gmail or Google Calendar, or delete the data from either one, in the Data & Privacy area of your account at any time. Each connection is deleted independently.

Deleting your Gmail data removes the records we hold that came from your mailbox: message metadata and bodies, attachment metadata, labels, the categories, features and model scores we derived, the summaries and extracted details we hold about individual messages, the state of any message our automation is tracking, corrections you made to our labels, contacts extracted from your mail, scheduling suggestions, and sync history. Deleting your Calendar data removes your stored events and calendar list, our derived availability and scoring, the links between events and emails, contacts drawn from attendees, and sync history. Deleting your whole account does both, and also deletes the logs of the AI requests we made for you (which include short excerpts of your mail and of your conversations with mod.me), revokes our access to your Google account, and removes your stored credentials. Events we already added to your Google Calendar stay on your calendar — they're yours, and you can delete them in Google Calendar.

mod.me, the assistant. Deleting your Gmail data also removes, from what mod.me holds: any reply it gave after looking something up in your email or calendar to answer, the records of email actions it proposed or took (including the recipients and full text of anything it sent), the notes it inferred about you, reminders and routines set up or changed in a conversation where it had looked something up in your mail or calendar, and any standing permissions for email. Until you delete your whole account, we keep your own messages to mod.me and anything you attached, the facts and rules you told it, its other replies (including answers drawn only from the summary of your next 48 hours of events that it is given each time), your calendar standing permissions, and your other reminders and routines. Asking mod.me to forget something switches off the matching notes and keeps matching messages out of its search of older conversations, but the records stay until you delete your account. Email mod.me sent and calendar changes it made stay where they are: in your Sent folder, in the recipients' inboxes, and on your calendar.

Apart from what is described above, two things deliberately survive a deletion, and neither identifies you or contains your mail. We keep a short-lived record of the notification IDs Google sent us, which is how we avoid processing the same notification twice; it holds Google's own opaque identifiers and nothing else. We also keep an internal log of when our mail-notification pipeline was failing, which records error reasons and counts, not accounts or messages. Models already trained are covered in section 6a.

Until you ask us to delete it, we keep this data for as long as the corresponding connection is active, so the features you rely on keep working. We are rolling out automatic deletion for accounts that go unused for a long period; until that is live, deletion happens when you request it or disconnect.

One practical limit: our database backups are retained for about seven days. Data you delete can survive in a backup snapshot for up to a week before it ages out. Backups are not used to serve the app and are not re-read into it.

Revoking access directly from your Google Account permissions page stops all future access immediately. To also remove what we already hold, use the deletion option in the app.

9. How We Protect Your Data

Your data is encrypted in transit and at rest. Google OAuth tokens are additionally encrypted by our application before they are stored, with keys held in a managed secrets service and never written to disk or source control. Every database connection we open verifies the server's identity rather than merely encrypting. We follow industry best practices to secure our infrastructure and limit access to only those who need it for essential functions.

10. Your Rights

• Request a copy of your data
• Ask us to delete it
• Correct inaccuracies
• Withdraw consent, including disconnecting your Google account at any time

11. Cookies & Tracking

We use minimal cookies only for essential functionality — no third-party ad tracking, ever.

12. Data Sharing

For data other than Google user data, we only share it when:

• You explicitly ask us to
• It's required by law (and we'll notify you unless prohibited)
• It's with tightly vetted service providers under strict confidentiality

Google user data is subject to the narrower rules in section 7.

13. Data Retention

We retain data only as long as necessary for the purposes above — or until you ask us to delete it. Google user data is subject to section 8.

14. Updates to This Policy

If this policy changes, we'll notify you clearly and give you a chance to review and respond. If a change affects how we handle Google user data, we will update this page and the effective date above before the change takes effect.

15. Contact Us

Have questions, concerns, or requests?
privacy@moderation.com

You deserve a space that respects your thoughts and protects your truth.
Thank you for your trust.
— The Moderation Team