Privacy Policy

Last updated: August 23, 2026

1. Introduction

Welcome to The Gist ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use our application.

2. Data We Collect

We collect the following types of information to provide the feed, classification, and summarization features you request:

Google User Data: Email address, name, and profile picture (via Google Sign-In).
Gmail content and metadata: Message body, subject, sender information, received date, Gmail message identifiers, and structural signals needed to identify supported messages, classify them, and generate feed items and summaries.
Usage Data: Product analytics events such as page views, onboarding progress, feed interactions, and feature usage.

Specifically, The Gist requests the following Google OAuth scopes:

https://www.googleapis.com/auth/gmail.readonly — Read-only access used to retrieve and automatically process messages for the user-facing feed, classification, and summarization features. We cannot send, delete, or modify any email.
https://www.googleapis.com/auth/userinfo.email — Your email address, used to identify your account.
https://www.googleapis.com/auth/userinfo.profile — Your name and profile picture, used to personalize the interface.

3. How We Use Your Data

Your data is used solely for the following purposes:

To identify supported messages and organize your private feed.
To classify messages (for example, distinguishing newsletters, promotions, informative messages, and personal threads).
To generate summaries, translations, and other feed elements requested by the product.
To provide the core functionality of The Gist application.

Crucial: We do not sell your data to third parties. We do not use your email content for advertising purposes.

4. Analytics and Error Monitoring

On the public landing page, we use Google Analytics 4 to measure aggregate visits, traffic sources, landing page interactions, and signup intent. Landing analytics events do not include Gmail content, email addresses, message metadata, or user-provided email text.

Google Signals, ads personalization signals, and advertising-related storage are disabled by default and are enabled only after cookie policy acceptance on the landing page.

We use PostHog Cloud EU, hosted in Frankfurt, Germany, to understand product usage and improve the application. PostHog may collect product events, page views, masked session replay data, device/browser metadata and, for signed-in users, a pseudonymous internal user ID. We do not send the user's Google email address, name, or profile picture to PostHog.

We configure PostHog to avoid collecting Gmail content, email subjects, sender information, raw message bodies, Gmail message IDs, and other email-derived content in analytics properties. Session replay masks text and element attributes.

We use Sentry for error monitoring and performance diagnostics. Sentry receives a pseudonymous internal user ID to correlate technical failures, but not the user's Google email address, name, profile picture, or Gmail content.

5. Google API Services User Data Policy

The Gist's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To provide the user-facing classification, summarization, translation, and feed-generation features, we use the following AI sub-processors:

Google Vertex AI (Gemini) — Primary summarization engine. Data is processed under Google's Cloud Data Processing terms and is not used to train models. Google Cloud DPA →
OpenAI — Fallback summarization and translation engine. API usage with data retention disabled (zero data retention). Data is not used to train models per OpenAI's API data usage policy. OpenAI API Data Usage Policy →

Depending on the feature and message type, the data sent to an AI sub-processor may include the message body, subject, sender name or address, and automatically derived structural signals needed to classify or summarize the message. Processing is automated. We do not permit these providers to use Google user data for advertising, data brokerage, credit decisions, or unrelated purposes, and we do not sell Google user data.

6. Data Retention and Deletion

We retain your data as follows:

Newsletter summaries: Retained for the lifetime of your account.
Original email content: The full raw email body is stored only temporarily until its AI summary is generated, then permanently deleted. We retain only a short text excerpt (a few hundred characters) as a display fallback, never the complete original message.
Feed metadata: Subject, sender information, received date, Gmail message identifiers, classifications, and generated feed data are retained with the relevant feed item for the lifetime of your account.
Account data (email, name, profile picture): Retained until you delete your account.

You can request the deletion of your account and all associated data at any time, directly from within the app (Profile menu → Delete account) or by contacting us at privacy@thegist.tech. Deletion is completed within 30 days of the request.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.