Privacy

We watch the barnyard.
Not what's in the letters.

Brood works from facts about your mail rather than what it says: who writes, how often, from where, to how many people. That is enough to build a filing system, and it is a great deal less than an inbox tool usually takes.

What follows is the whole account, including the parts that are less flattering than the headline. The legal document, the privacy policy, is separate and is not a substitute for reading this. The evidence for an organisation deciding, every company that handles data for Brood and where its compliance stands, is on the trust page.

What Brood reads.

What we see

  • The sender's name, email and domain
  • The date and time received
  • How many people it was sent to
  • Who you write to, from the To and Cc of mail you send, never its Bcc
  • Which addresses you send from
  • Existing labels on the message
  • Whether it's a reply or a thread
  • Whether a mailing offers a one-click unsubscribe, and whether Gmail confirmed its sender signed that offer
  • How many messages your mailbox and its labels hold, never how many are unread, and how far back it goes

What we don't

  • The subject line of any message
  • The body of any message
  • Attachments of any kind
  • Anything you've drafted but not sent
  • Anything in Drive, Calendar, Meet, or Contacts
  • Anything we'd use to train a model

The subject line is worth singling out. It is not read and then discarded; it is not among the headers Brood asks Google for, so it never reaches us. A header that never arrives cannot be stored by accident, written to a log by accident, or turn up inside an error report.

What Gmail's own filters, SaneBox, Clean Email and Unroll.Me each read, from their own pages, is set out beside this on the alternatives pages.

What Brood keeps.

Two different things, kept for different lengths of time. The individual records (this sender, at this hour, to this many people) are what Brood needs to notice a pattern, and they age out once they have done that job. What persists is the pattern itself: that a sender writes most weeks, that a domain has gone quiet, that a thread you are in is still moving.

That is a deliberate design rather than housekeeping. An index holding every arrival forever is a more interesting target than one holding a few counts per sender, and the cheapest data to protect is the data we stopped keeping.

The individual records are kept for 120 days, and then deleted. The picture of your inbox that Brood shows you covers the last 90 days. What persists past that is the pattern: a count of messages per sender per month, and when each last wrote.

Nothing here trains a model.

Nothing Brood holds about you is sent to a model, by us, for any purpose: not your metadata, your labels, or the patterns Brood works out about you. The filing does not need one. It runs on rules you can read, and the same inbox with the same rules produces the same result every time.

That is worth stating plainly because the industry has spent two years making it an unsafe assumption. If Brood ever needs to change it, the change will be announced before it happens and not discovered in a version history.

One distinction we intend to keep clear rather than quietly lose: if you later point your own tools at your own index (a thing we plan to make possible), that is you choosing what your data does, which is the opposite direction and is yours to decide. It is not us sending it anywhere.

Google's rules, too.

Google sets rules of its own for any app that reads Gmail: what it may use the data for, who may see it, and that it is never sold or used for advertising. Brood keeps to them, and says so in the words Google asks for.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Three things before you ask.

A privacy page built only from the flattering facts is a brochure. These are the three a careful reader would find, and each is better coming from us.

1

The permission is broader than the use.

The permission that lets Brood file your mail also lets it read your mail. Google does not offer a narrower one that can label a message you have already received. Brood never uses it to read. Every request it makes asks for metadata only, through one module, and the subject line is not among the headers it asks for, so it never arrives at all. So the promise is that Brood never reads what your mail says, not that it can't.

Without it, Brood could only ever file mail that arrived after you connected. You will see the permission described in Google's words on the consent screen, and you are entitled to weigh it.

2

The labels are new information in your mailbox.

Brood writes what it works out back into your mailbox as labels, so anyone who can open this mailbox can read them, including a Workspace administrator if this is a work account. They could already read your mail. The labels add what Brood has worked out from it, and that part is Brood's doing.

A label reading customers/orchard-tea says something you worked out privately. So we say it here, once, rather than burying it. The labels stay legible, because they exist for you and you are the one who has to live in them.

3

You can read the code.

You can read the code that talks to Gmail and see for yourself that none of it asks for a body.

The code that reads your Gmail is public, with the check that holds it to metadata, at github.com/Noisy-Brood/what-brood-reads.

Read it and you can see that every request able to return a message body asks for metadata instead, with a list of headers that leaves out the subject line.

It shows what we wrote, not what is running on the day you read it. And that no other part of Brood calls Gmail is checked on every change, over source that is not published, so for that half you have our word.

You can disconnect, or leave entirely.

  • Disconnecting takes Brood's filters out of your Gmail first.
  • Any filter it cannot remove is listed, with where to take it out yourself, and goes on filing mail until you do.
  • The labels stay, and so does the mail under them.
  • Then it asks Google to withdraw Brood's access, and deletes Brood's sealed copy of that permission once Google confirms; Brood stops looking at the mailbox.
  • What Brood has already noted about your mail goes when you delete your account. Copies in the database's backups expire within 30 days.

You can also remove Brood at any time from the apps linked to your Google Account, without telling us first, and you should be able to: the relationship is between you and Google. One practical note: Brood needs its access to take its filters out. Revoke there first and they stay, and we have no way to reach in and tidy up. Disconnecting from inside Brood does both in the right order.

Changing your Google password withdraws Brood's access too, without a word to us. Brood stops, and its filters keep sorting mail by rules nobody is maintaining. We notice, and we write to you, with a way back in if you want one and how to remove the filters if you don't: In Gmail on a computer, open Settings at the top right, choose See all settings, then Filters and Blocked Addresses, find the filter, and choose Delete.

We would rather tell you that here, now, than have you find it out from a message that never arrived.

Questions that this page does not answer are worth sending to a person, and they reach one.

The list, if you join it.

Joining the list on its page gives us your email address, your answer to its one optional question if you give one, and nothing else: no name, and not where you came from. We write once to ask you to confirm it. An address nobody confirms is deleted a week after we wrote, and we never write to it again.

Every message from the list says how to leave it, and your mail program’s own unsubscribe button works too, in one press. Leaving deletes the address. We keep a count of how many people join and leave, and how, with no address in it.

That page is the one place on this site that sends anything to someone else. So that a script cannot fill the list with strangers’ addresses, it loads Cloudflare’s Turnstile, which sees your visit to that page (your IP address and your browser) and, now and then, asks you to show you are a person. Nothing else on this site does.