Privacy Policy

• Our access to Gmail is read-only. We never send, delete, move, archive or change anything in your mailbox.
• We keep details about your email (subjects, senders, dates) and summaries that our AI writes. We do not keep the full text of your emails or your attached files.
• To build your cases, the text of your emails and your attachments are processed by AI providers (Google Gemini and Anthropic Claude). Under our agreements with them, they do not use it to train their models.
• We do not sell your data, show you ads, or use your email to target anyone.
• You can delete your account, and the data tied to it, from Settings at any time.

When you connect Gmail, Buoykeeper asks Google for one permission: gmail.readonly. It lets Buoykeeper read your mail. It does not allow sending, deleting or changing anything, and Google enforces that before a request reaches us. You can see and remove this permission at any time on Google’s permissions page.

With that permission, Buoykeeper reads:

• Message details: subject, sender name and address, recipients (To and Cc), date, and Gmail’s message and conversation identifiers.
• Two Gmail markers: whether a message is unread, and which of Gmail’s own tabs it falls in (such as Primary or Promotions). We do not use or store the labels, filters or folders you have created.
• Message text of the emails that belong to the topics you set up, and of the newsletters in your newsletter brief if you use it.
• Attachments (PDFs, images and Office documents) on those emails, so their contents can be summarized.

When you first connect, Buoykeeper looks at about the last eight weeks of mail to suggest topics and build your first cases. To tell mail you care about from mail you don’t, it reads the details above for recent mail across your inbox, and short excerpts from some senders. After that, while Gmail stays connected, it checks for new mail about once an hour.

When you open an email inside Buoykeeper, we fetch it from Gmail to show it to you and do not store it. Images inside it load only if you choose to load them.

• Your account: your email address, name and profile picture from Google, and the access credentials Google issues when you connect (encrypted, see section 9).
• Email details: subject, sender, recipients, date, unread status, Gmail tab, Gmail identifiers, and the length of the message.
• What our AI writes: case titles and summaries, actions and due dates, dates of events you’ve been invited to, amounts, tags, and the names of people, organizations and places the emails mention.
• Attachment details: file name, type and size, plus an AI summary and the details extracted from it (such as amounts, dates and reference numbers).
• Your setup and corrections: the topics, people and hints you give Buoykeeper, and every correction you make, so Buoykeeper keeps learning from them.
• Your newsletter brief, if you use it: each edition, including short quotes taken from the newsletters it summarizes.
• Anything you type to us, such as notes you submit in the app.
• Usage records: which screens you open and what you click, when you were last active, how long processing took, and what each AI request cost us.

What we do not store: the full text of your emails, their HTML, or your attachment files. They are read to build your cases and then discarded.

Buoykeeper uses two AI providers. The email content described below is sent to them each time a case is built or updated.

• Google Gemini (Gemini API, paid tier) reads each email’s details and text (up to about 8,000 characters, or 60,000 for long digest-style emails) and attachment files, to summarize them and pull out dates, amounts and actions. It also writes the newsletter brief. Google’s terms for the paid Gemini API say Google does not use this content to improve its products, and keeps it for a limited period only to detect abuse and meet legal requirements.
• Anthropic Claude (Claude API) writes case summaries from the email details and summaries above, groups related emails, classifies senders (using short excerpts of up to about 300 words), suggests searches during setup (using the first 300 characters of a sample of emails), and reads the one email you choose as a starting point during setup. Anthropic’s commercial terms say it does not train on this content and deletes it within 30 days, except content it flags for a usage-policy violation, which it may keep for up to two years.

We do not use your email to train any AI model. AI makes mistakes: a summary, date or amount can be wrong, so check anything important against the original email.

Buoykeeper’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail data only to provide and improve Buoykeeper’s features for you.
• We do not use it for advertising, and we do not sell it.
• We share it only with the service providers in section 6 that we need to run Buoykeeper.
• We do not use it to train general-purpose AI or machine-learning models.
• People at The Control Surface LLC do not read it except as described in section 5.

No person reads your email as part of running Buoykeeper. The exceptions are:

• During the beta, with your agreement. As a beta tester you agree (in section 4 of our Terms) that our team may look at your cases, email details and the AI’s output to diagnose problems and improve Buoykeeper. We look only when we are working on a problem, and we do not share what we see.
• When you ask us for help with something specific.
• To investigate a security incident or abuse.
• When the law requires it.

We also look at totals across all members, such as how many people finished setup or what the service costs to run. These do not show any one person’s email.

These service providers process data for us, only to run Buoykeeper:

• Google: Gmail access and sign-in, Gemini AI (section 3), Google Analytics (section 7), and web fonts.
• Anthropic: Claude AI (section 3).
• Supabase: our database and sign-in system, hosted in the United States.
• Vercel: hosts the app, hosted in the United States, and keeps short-lived server logs.
• Inngest: runs our background jobs, such as checking for new mail.

We do not sell your data, share it for advertising, or give it to data brokers. We may disclose data if the law requires it or to protect our rights and safety. If The Control Surface LLC is part of a merger, acquisition or sale of assets, your data may transfer as part of it; we will tell you before it becomes subject to a different privacy policy.

Buoykeeper uses cookies to keep you signed in. On the live site we also use Google Analytics to count visits to pages. We send Google only the general shape of the page address (for example /feed), never the details that follow it, so no email content, email addresses or case identifiers reach Google Analytics. Google Analytics sets its own cookies; you can block them in your browser without affecting Buoykeeper.

We also record product events (such as which screens you open) with your account, to understand how Buoykeeper is used. We do not use advertising cookies.

We keep your data for as long as your account exists. Nothing expires on its own while you use Buoykeeper.

Deleting your account. In Settings, choose Delete account and type DELETE to confirm. If you haven’t signed in recently, we ask you to confirm with Google first. When you confirm:

• We revoke Buoykeeper’s access to your Gmail at Google.
• Everything tied to your account is deleted immediately: your cases, email details, AI summaries, attachment details, newsletter briefs, setup, corrections and usage records.
• Your sign-in record is removed shortly after.

Some information outlives the deletion:

• An anonymous record of how your time with Buoykeeper went: dates, counts (such as how many cases were built) and what it cost us to run. It contains no name, email address or email content, and it is keyed by a one-way code that cannot be traced back to you. We keep it to understand how Buoykeeper is used overall.
• Shared sender profiles. For bulk senders such as newsletters and marketing lists, Buoykeeper keeps one profile per sender (its address, name and the kind of mail it sends) that helps sort that sender’s mail for every member. These profiles are not linked to you and contain no text from, or description of, your messages.
• Backups and logs. Our database backups, and the short-lived logs kept by our hosting and background-job providers, can briefly hold copies of your data. They are deleted on those systems’ normal schedules, within 30 days.

You can also disconnect Buoykeeper from Google’s permissions page at any time. Buoykeeper then stops reading your mail; your account and cases stay until you delete them.

Data travels over encrypted connections. The credentials Google issues when you connect are encrypted by our application (AES-256-GCM) before they are stored, and are never written to logs. Our database is encrypted at rest, and access to it is limited to the people who run Buoykeeper. No system is perfectly secure, and we cannot guarantee that yours will never be exposed. If you find a security problem, please email support@thecontrolsurface.com.

• See and correct: your cases, topics and corrections are all visible and editable in Buoykeeper.
• Delete: from Settings, as described in section 8.
• Get a copy: email us and we will send you your data.
• Stop access: disconnect Buoykeeper on Google’s permissions page.

California residents. Under the California Consumer Privacy Act you can ask what personal information we hold about you and where it came from, ask us to delete it, and ask us to correct it. We do not sell or share your personal information as those terms are defined in that law, and we will not treat you differently for using these rights. The categories we collect are identifiers (name, email address), your email details and the AI output described in section 2, and usage information. To make a request, email support@thecontrolsurface.com; we respond within 45 days.

Buoykeeper is for adults 18 and older in the United States. We do not knowingly collect data from anyone under 18; if you believe we have, email us and we will delete it. Your data is stored and processed in the United States.

If we change how we handle your data in a way that matters, we will tell you by email or in the app before the change takes effect, and update the date at the top of this page.

The Control Surface LLC, 4212 Woodhead Street Unit #2014, Houston, TX 77098. Email support@thecontrolsurface.com.