Privacy Policy

Overview

Zen Inbox is an email app for Gmail and Outlook on Android. It is made in Canada. This page explains, in plain language, what the app can see, what we keep, who else is involved, and how to delete it.

Questions: support@zeninbox.ca

What the app can access in your mailbox

When you connect an account, Google or Microsoft asks you to allow these permissions.

Gmail and Google Workspace

• Your name and email address, to show which account is which.
• Full access to your mail (read, organize, send and permanently delete). Google only offers permanent deletion with full access, which is why we ask for it.
• Send email for you when you press Send.
• Your calendar events, only if you turn on Calendar sync.

Outlook and Microsoft 365

• Your name and email address, and permission to stay signed in.
• Read and change your mail and send email for you.
• Read and change your calendar, only if you turn on Calendar sync.

What stays on your phone

• Your emails, attachments you open, folders and search.
• Your Planner cards, summaries and app settings.
• Planner backups, saved as files on your phone. Automatic backups keep the last 7. Backup files stay on your phone until you delete them.
• The information shown in home-screen widgets.

Removing an account deletes that account's mail and data from the app. Uninstalling the app deletes everything the app stored, except backup files you saved. Your phone's own backup (for example Google's Android backup) may keep copies according to your phone settings.

Calendar sync works from your phone directly with Google Calendar or Outlook. Events we add live in your calendar, and our servers are not involved.

What our servers keep

Our servers run on Google Cloud (Firebase) in Montréal, Canada. We do not store your email bodies or attachments there.

• Account record: your email address, your sign-in tokens (encrypted), which of your phones get notifications for it, the connection Google or Microsoft uses to tell us about new mail, whether Zen AI is on, and your time zone and clock format so dates in cards are right.
• Device record: a random ID for your phone, which email addresses are connected on it, and your Premium status from Google Play (the product, the purchase token and when it renews or ends). We never see your card number.
• Notification records: the ID of each email we sent you a notification about, so you don't get the same one twice. They contain no email content.
• Complimentary Premium: if we give you free Premium (for example as a tester), your email address is on that list.
• Server logs: technical logs to fix problems. They can include your email address, the sender name of an email we notified you about, and what kind of card the AI made (for example "bill, due Sept 25"). Kept for 30 days.

Until September 2026 these servers were in the United States. Those copies are being deleted.

Zen AI and email content

Zen AI uses Gemini, Google's AI, through Google Cloud. It only runs if you have Premium with the Planner turned on, or when you use AI writing help.

• Automatic summaries: when a new email looks like a bill, trip, appointment, event, subscription, receipt or task, its subject, sender name and up to 8,000 characters of its text are sent to Gemini. Most emails, including marketing, are filtered out before this and never sent.
• Summarize button: sends the same, using the full email text.
• Writing help: "Write a reply" sends the conversation (up to 6,000 characters). "Fix grammar", "Shorten", "More formal", "More casual" and "Expand" send only your draft.

We use the answer to build your card or draft and don't keep the email text. Google processes these requests on its global AI service, which may run outside Canada. Google Cloud's terms say it does not use this data to train its models, and we don't use your email to train AI either.

Turn off Show Planner in Settings to stop automatic summaries. Cards you already have are kept on your phone.

Other companies involved

• Google (Gmail) and Microsoft (Outlook) — your email provider, to read, send, organize and delete your mail, and to tell our server when new mail arrives.
• Google Cloud / Firebase — runs our servers and database in Montréal, Canada.
• Google Gemini (Vertex AI) — summaries and writing help, as described above. May run outside Canada.
• Firebase Cloud Messaging (Google) — delivers notifications to your phone. A notification includes the sender, subject and the short summary. Runs on Google's global network.
• Sentry — crash and error reports, stored in the United States. Reports include a random support ID, app version, device model and error details. We remove personal information like email addresses before sending. A small share of app sessions (about 1 in 10) also sends speed measurements.
• Google Play — Premium subscriptions and payments. We receive your subscription status, not your payment details.
• Web Hosting Canada — hosts this website and forwards email sent to support@zeninbox.ca. Support email is then kept in our support inbox at Microsoft Outlook.com.

Each company has its own privacy policy for the data it handles.

When you contact us

• Report a problem (Settings) sends a crash-style report to Sentry with your description and support ID. We ask you not to include personal information and remove what we can detect. It also lets you email support from your own account.
• Report a Planner card sends an email from your own mailbox to support with the card's details and your note. The original email is attached only if you choose to attach it, and you can remove it before sending.
• We read what you send us so we can help. It stays in our support inbox until we delete it, and you can ask us to.

Google user data

Zen Inbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: we use your Gmail and Google Calendar data only to run the features you see in the app. We don't sell it, use it for ads, or use it to train AI models. People don't read your email, except when you send it to us yourself (for example a card report), or when needed for security or the law.

How long we keep things

• On your phone: until you remove the account or uninstall the app.
• Account record and sign-in tokens: deleted when you remove the account from your last phone. Otherwise deleted automatically after 90 days without app activity, or after 30 days if your phone can no longer receive our notifications.
• Server logs: 30 days.
• Device records and notification records: these are not deleted automatically at the moment, including when you remove an account. Email us and we will delete them.
• Crash reports in Sentry: kept for Sentry's retention period. Send us your support ID and we will delete yours.
• Support emails: until we delete them. Ask us and we will.

See Delete Account for how to delete everything.

Your choices

• Remove account in Settings to disconnect a mailbox.
• Turn off Show Planner to stop automatic AI summaries.
• Leave Calendar sync off (it is off unless you turn it on).
• Keep Load images automatically off (the default) so senders can't tell when you open their email.
• Stop Zen Inbox's access anytime from your Google Account or Microsoft account.
• Email support@zeninbox.ca to ask what we have or to delete it.

Children

Zen Inbox is intended for users 18 and over. We do not knowingly collect data from children.

Changes

We will update this page when the app changes what it collects or who it shares with. The "Last updated" date below changes when we do.