Sylvia ("the Extension") is a Chrome extension that helps you manage your Gmail inbox using AI. This policy explains what data we access, how we use it, and what we never do with it — in plain language, without legalese. It covers both the free plan (where AI calls go directly from your browser to the provider you configure) and the paid Sylvia AI plan (where AI calls are proxied through our server to one of our AI providers — OpenAI or Google Gemini).
1 What data we access
To function, Sylvia requests access to your Gmail account via Google's official APIs. This may include:
- Email metadata — sender, subject, date, and labels
- Email content, only when required to carry out a task you explicitly request (e.g. summarise, draft a reply)
- Your Google account email address, for authentication only
2 How we use your data
All data accessed through Gmail is used exclusively to perform the actions you request within the Extension — search, filter, label, summarise, draft replies. Specifically:
- Email content is only ever sent to an AI provider when you explicitly trigger an AI action (e.g. "draft a reply", "summarise this thread"). Browsing your inbox does not transmit any content.
- On the free plan, AI requests go directly from your browser to the AI provider you have configured (OpenAI, Google Gemini, or Azure OpenAI). Our servers are not involved in those requests.
- On the paid Sylvia AI plan, AI requests are routed through our Vercel-hosted server proxy and forwarded to one of our AI providers — OpenAI or Google Gemini. OpenAI is used by default; if it is unavailable or rate-limited, the request automatically falls back to Google Gemini so the feature keeps working. The proxy does not log, store, or inspect email content — it only forwards the request and returns the response.
- No email data is used for advertising, analytics, or any purpose beyond fulfilling your request.
3 What we never do
- We do not sell your data to third parties.
- We do not store your emails or their content on any server.
- We do not train any AI model on your data, and we do not authorise our providers to do so. Note the tier-dependent exception for Google Gemini described in section 5.
- We do not share your email content with anyone except the AI provider processing your request (OpenAI or Google Gemini on the paid plan, or your configured provider on the free plan).
- We do not log your email address in plain text — only an irreversible HMAC-SHA256 hash is used as an internal identifier.
4 Google API Services
Sylvia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train generalised AI/ML models and is not shared with any third party beyond what is necessary to provide the features you request.
5 Sylvia AI (Paid plan)
When you purchase AI replies on the paid Sylvia plan, the following applies:
- AI providers: OpenAI, Google Gemini. AI requests on the paid plan are processed by OpenAI (openai.com) by default. If OpenAI is unavailable or rate-limited, the request automatically falls back to Google Gemini, so a single request may be handled by either of the two. Each provider processes the message content in order to return a response. OpenAI does not use content submitted through its API to train its models. For Google Gemini, this depends on the API tier in use: content submitted through the paid tier is not used for model training, whereas Google may use content submitted through the free tier to improve its products. We use Gemini only as a last-resort fallback when OpenAI is unavailable, and we cannot rule out that a request handled by Gemini is processed under free-tier terms. See the privacy policies and terms of OpenAI and Google Gemini for full details.
- Server proxy via Vercel (Frankfurt, EU). AI requests are forwarded through our server hosted on Vercel, deployed in the Frankfurt, Germany region (EU). The proxy does not log or store email content. Vercel may capture standard infrastructure metadata (IP address, HTTP status code, response time) in its platform logs as part of normal hosting operations — this metadata does not include email content or message bodies.
- Reply-credit balance. Your remaining AI-reply balance is stored in our Redis database as a number associated with an irreversible one-way hash of your email address. The actual email address is never stored in the database. The Redis instance is provided by Upstash and is hosted in the Belgium, EU region.
- Session tokens. After you sign in, we issue a short-lived session token (valid for 1 hour) using an HMAC signature. This token is stateless — it is not stored in our database — and contains only your hashed identity and an expiry timestamp.
- Authentication. Your Google OAuth access token is verified directly against Google's token-info API to confirm your identity; it is never written to our database or logs.
- Payments. Payment is handled entirely by Stripe. We do not receive or store your card details. Stripe webhooks send us only a pseudonymous user hash and the number of replies purchased — never your name, card number, or billing address.
- Anonymous usage analytics. We collect anonymised event counts (e.g. "extension installed", "reply generated") and daily/monthly active user counts. Events are associated only with a client-side hash of your email — never with your email address itself — and are used solely to understand aggregate product usage.
6 Third-party AI providers (Free plan)
On the free plan, when you configure an AI provider (OpenAI, Google Gemini, or Azure OpenAI), your requests go directly from your browser to that provider and are processed according to their privacy policy. Sylvia does not control how those providers handle data once it is transmitted.
7 International data transfers
Our own infrastructure is hosted within the European Union: the server proxy runs on Vercel in the Frankfurt, Germany region, and the Redis database holding reply-credit balances is hosted by Upstash in the Belgium region.
However, the AI providers that generate replies operate globally. When you trigger an AI action on the paid plan, the message content is transmitted to OpenAI or Google Gemini, and may be processed on infrastructure located outside the European Economic Area, including in the United States. On the free plan, the same applies to whichever provider you configure yourself.
These transfers rely on the transfer mechanisms offered by each provider under Chapter V of the GDPR — typically the European Commission's Standard Contractual Clauses, and where applicable the EU–US Data Privacy Framework. We do not currently offer an EU-only AI processing option; if data residency within the EEA is a requirement for you, do not use the AI features on email content that is subject to that requirement.
You can review each provider's transfer terms in their respective privacy policies, linked in sections 5 and 6 above.
8 Data protection & security
Protecting your Gmail data is fundamental to how Sylvia is built. We apply the following safeguards:
- Encryption in transit. All communication with Google's APIs, with our server, and with AI providers takes place over HTTPS/TLS. Email content and credentials are never transmitted in plain text.
- No server-side storage of email content. Email bodies and subjects are never written to any Sylvia-operated database, log file, or storage system — on either the free or paid plan.
- One-way email hashing. Your email address is hashed with HMAC-SHA256 using a server-side secret before being stored in Redis. The hash cannot be reversed to recover your email address, even with access to the database.
- OAuth tokens are not persisted by Sylvia. On the free plan, sign-in is handled by Chrome's built-in
chrome.identityAPI; tokens are managed by Chrome and never written to any Sylvia server. On the paid plan, your Google OAuth token is used only to verify your identity for one request, then discarded — it is not stored in our database or logs. - Stateless session tokens. After authentication on the paid plan, we issue an HMAC-signed session token valid for 1 hour. It is not stored server-side; validity is verified cryptographically on each request.
- Sandboxed local storage (free plan). Your AI-provider API keys and preferences are stored using Chrome's
chrome.storage.localAPI, sandboxed to the Sylvia extension and isolated from web pages and other extensions. - Minimum OAuth scopes. Sylvia requests only the Gmail, Contacts, and profile OAuth scopes that its features actively use. No scopes are requested speculatively.
- Rate limiting. Our server enforces per-IP rate limits on all endpoints to prevent abuse.
- Limited Use compliance. Sylvia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train generalised AI/ML models.
Responsible disclosure. If you believe you have found a vulnerability or a security issue affecting Sylvia, please report it to security@sylviamail.app rather than disclosing it publicly. Include enough detail to reproduce the issue; we will acknowledge your report and keep you informed while we investigate.
9 Data retention
The following summarises what we retain and for how long:
- Email content: never stored by Sylvia — not in our database, not in logs.
- Reply-credit balance: stored in Redis as a number keyed to your HMAC email hash, for as long as you have an account or credits remaining.
- Usage events: anonymised event counts are stored indefinitely; the event log (containing only event name, timestamp, and hashed user ID) is capped at the most recent 1,000 entries.
- Session tokens: stateless — not stored server-side. They expire after 1 hour.
- Free-plan local data: API keys, preferences, and local chat history are stored only in your browser's extension storage and retained until you clear them or uninstall the Extension.
- AI provider data: data forwarded to OpenAI or Google Gemini (paid plan) or your configured provider (free plan) is retained according to that provider's own policy.
10 Your controls & revocation
You remain in control of Sylvia's access to your data at all times:
- Revoke Gmail access. Visit myaccount.google.com/permissions at any time to revoke Sylvia's access to your Google account.
- Delete locally stored data. Uninstalling the Sylvia extension from Chrome removes all locally stored API keys, preferences, and chat history.
- Switch or remove AI providers (free plan). You can change or delete the AI provider and API key you've configured at any time from the Extension's settings.
- Exercise your GDPR rights. To request access, rectification, erasure, restriction, portability, or to object to processing of your personal data, write to privacy@sylviamail.app. We respond within 30 days as required by the GDPR.
11 Children's privacy
Sylvia is not directed at children under 13 and does not knowingly collect data from them.
12 Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page will always reflect the most recent revision. Continued use of the Extension after changes are posted constitutes acceptance of the revised policy.
13 Contact
For any question about this policy or about how your personal data is handled, contact us at:
- Privacy & data protection. privacy@sylviamail.app — privacy enquiries, GDPR requests and data handling.
- Security. security@sylviamail.app — vulnerability reports, security issues and incidents.
For technical assistance or billing questions, write to support@sylviamail.app instead.