The privacy policy.

This policy says what Noisy Brood, LLC ("we", "us"), which makes Noisy Brood ("Brood"), collects, why, who handles it for us, how long we keep it, and how you can have it removed. It covers the app at app.noisybrood.com, this site and the mail we send. The plainer account is Privacy; this is the one that binds us.

What we collect, and what we never read

From your mailbox, once you connect it, Brood reads:

• The sender's name, email and domain
• The date and time received
• How many people it was sent to
• Who you write to, from the To and Cc of mail you send, never its Bcc
• Which addresses you send from
• Existing labels on the message
• Whether it's a reply or a thread
• Whether a mailing offers a one-click unsubscribe, and whether Gmail confirmed its sender signed that offer
• How many messages your mailbox and its labels hold, never how many are unread, and how far back it goes

It never reads:

• The subject line of any message
• The body of any message
• Attachments of any kind
• Anything you've drafted but not sent
• Anything in Drive, Calendar, Meet, or Contacts
• Anything we'd use to train a model

The permission that lets Brood file your mail also lets it read your mail. Google does not offer a narrower one that can label a message you have already received. Brood never uses it to read. Every request it makes asks for metadata only, through one module, and the subject line is not among the headers it asks for, so it never arrives at all. So the promise is that Brood never reads what your mail says, not that it can't.

Brood writes what it works out back into your mailbox as labels, so anyone who can open this mailbox can read them, including a Workspace administrator if this is a work account. They could already read your mail. The labels add what Brood has worked out from it, and that part is Brood's doing.

About you: your name and email address, and when you sign in, kept by Clerk; and, when you start Pro, trial included, your billing address, and if you pay, your card, both kept by Stripe. What you tell us in the app, when you report a problem or answer a question we ask, is kept with your account and deleted with it, as are the record of what Brood did in your mailbox and the mailings you asked it to unsubscribe you from. If you allow a program to read your index for you, such as Brood's command line, we keep which program it is, when it was first and last used, whether and why it was revoked, and how many calls it made in the past minute, and delete that with your account too. The app uses cookies only to keep you signed in.

When you write to us: your message arrives in the company's mail, at Google Workspace, and is kept there. If you wrote to our support address, a copy is also kept in the app, where we keep track of what still needs an answer: your address, what you wrote with its subject line, and how many attachments it had, but never the attachments themselves. For a message too large to keep, the copy holds your address and how the message was delivered, and nothing you wrote. The copy is kept until we have answered it, filed it as work, or closed it, and for 90 days after.

On the waitlist: your email address, and your answer to its optional questions if you give them. An address nobody confirms is forgotten a week after we wrote, and a confirmed one is kept until you leave the list. Your answers are kept under a random id, and once you leave, nothing we hold links them to your address.

When you visit this site: a count of the visit, kept by Plausible without a cookie and, by its own account, without anything that recognises you on another day. The waitlist page also loads Cloudflare's Turnstile, which sees your visit to that page.

How we use it

To run Brood for you: to work out where your mail belongs, propose rules, file what you confirm, and show you what it did. To send you the mail you asked for or need, and to answer you when you write. To keep Brood secure and working.

We do not sell your data, and we do not use it for advertising. Brood decides what to propose by rules and counts you can read, and never sends your data to a model, its own or anyone else's. If you point an assistant of your own at what Brood has learned, that is your assistant, reading your record, because you asked.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Who handles it for us

These companies handle data on our behalf, each only for what it does for Brood:

• Vercel: Hosts the app and this site. Every request passes through it, and its logs hold requests' addresses for a time.
• Neon: Holds Brood's database, in the United States (AWS us-east-1).
• Amazon Web Services: Holds the key that seals each mailbox's access, and a record of each use of it, by an opaque id.
• Google: Gmail and Google Workspace, where your mail is and where Brood's labels and filters are written; and the company's own mail, where your messages to us arrive.
• Clerk: Signs you in: your name, email address and sign-in events.
• Stripe: Takes payment: your email address, and the name and billing details your payment needs. Card numbers go to Stripe and never to us.
• Cloudflare: Sends Brood's email, so it holds the addresses mail goes to and what it says; runs this site's domain; and, on the waitlist page alone, Turnstile, which sees your visit (your IP address and browser) to tell a person from a script.
• Better Stack: Keeps the app's logs and its audit trail for a few days. Opaque ids, never a subject or your mail.
• PostHog: Counts how Brood is used, under a random id that is not your account's, from a closed list of events.
• Plausible: Counts visits to this site, with no cookie and, by its own account, nothing that recognises you from one day to the next.

Beyond them, we share your data only if the law requires it, or to protect someone's safety, and we tell you when the law allows us to.

How long we keep it

The record of each message's arrival is kept for at least 120 days, and dropped within about a month after that. The counts Brood works from, such as how often a sender writes, are kept while your account exists. Logs are kept for a few days.

When you delete your account, we delete everything we hold about your account and your mailbox, and ask Stripe and Clerk to delete what they hold. Your place on the waitlist, if you have one, and messages you wrote to us are separate: the first goes when you leave the list, the second when you ask us. Copies in the database's backups expire within 30 days. A few records of ours are kept for a year after: the history of changes to your list of senders who must always reach you, a note that the account was deleted, and, if your sign-in was deleted outside Brood while some of Brood's filters could not be removed, your mailbox's address and those filters, so that we can tell you which are still at work. Amazon Web Services keeps its record of each use of a mailbox's key, by an opaque id, for about 400 days. Clerk, Stripe and Cloudflare keep what they hold under their own retention, and so does PostHog, whose events, once your account is gone, name no one.

Your choices

You can disconnect a mailbox, download the record of what Brood did, or delete your account, from the app, at any time. You can also remove Brood at any time from the apps linked to your Google Account. Every message from the waitlist says how to leave it.

Depending on where you live, you may have the right to ask what we hold about you, to correct it, to have it deleted, or to object to how we use it. Most of that is in the app; for anything else, write to us. We answer from your account, signed in, so that nobody can ask for your data by writing in your name.

Keeping it safe

The access you grant Brood to your mailbox is sealed with a key of its own, and deleted once Google confirms you have disconnected. Brood never reads the content of your mail, so it never holds it to lose.

Children

Brood is for people 18 and over, and we do not knowingly collect data from anyone younger.

Where it is kept

Brood's database, logs and product events are kept in the United States. If you use Brood from outside the United States, your data is transferred there.

Changes to this policy

If we change this policy in a way that matters to you, we will email account holders and post the change here before it takes effect.

Contact

Noisy Brood, LLC, formed in Delaware. hello@noisybrood.com. By post: 285 W Wieuca Rd NE, Ste 66880, Atlanta, GA 30342, United States.