Privacy Policy

Last updated: June 28, 2026

1. Introduction

Welcome to The Gist ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use our application.

2. Data We Collect

We collect the following types of information to provide our newsletter summarization service:

Google User Data: Email address, name, and profile picture (via Google Sign-In).
Email Content: We access your Gmail messages strictly to identify newsletters and generate summaries.
Usage Data: Product analytics events such as page views, onboarding progress, feed interactions, and feature usage.

Specifically, The Gist requests the following Google OAuth scopes:

https://www.googleapis.com/auth/gmail.readonly — Read-only access to your Gmail messages, used exclusively to identify and retrieve newsletter emails for summarization. We cannot send, delete, or modify any email.
https://www.googleapis.com/auth/userinfo.email — Your email address, used to identify your account.
https://www.googleapis.com/auth/userinfo.profile — Your name and profile picture, used to personalize the interface.

3. How We Use Your Data

Your data is used solely for the following purposes:

To summarize newsletters and organize your feed.
To classify emails (e.g., distinguishing between promotions and personal threads).
To provide the core functionality of The Gist application.

Crucial: We do not sell your data to third parties. We do not use your email content for advertising purposes.

4. Analytics and Error Monitoring

On the public landing page, we use Google Analytics 4 to measure aggregate visits, traffic sources, landing page interactions, and signup intent. Landing analytics events do not include Gmail content, email addresses, message metadata, or user-provided email text.

Google Signals, ads personalization signals, and advertising-related storage are disabled by default and are enabled only after cookie policy acceptance on the landing page.

We use PostHog Cloud EU, hosted in Frankfurt, Germany, to understand product usage and improve the application. PostHog may collect product events, page views, masked session replay data, device/browser metadata, and pseudonymous user identifiers.

We configure PostHog to avoid collecting Gmail content, email subjects, sender email addresses, raw message bodies, Gmail message IDs, and other email-derived content in analytics properties. Session replay is configured to mask text and element attributes.

We also use Sentry for error monitoring and performance diagnostics. Sentry is used to debug crashes and application failures, not to analyze newsletter content.

5. Google API Services User Data Policy

The Gist's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To provide the summarization service, we send email content to the following AI sub-processors exclusively for generating summaries. No other data sharing occurs.

Google Vertex AI (Gemini) — Primary summarization engine. Data is processed under Google's Cloud Data Processing terms and is not used to train models. Google Cloud DPA →
OpenAI — Fallback summarization and translation engine. API usage with data retention disabled (zero data retention). Data is not used to train models per OpenAI's API data usage policy. OpenAI API Data Usage Policy →

Email content sent to these providers is limited to the body of identified newsletter emails. We do not send email metadata (recipients, timestamps) or personal emails that are not newsletters.

6. Data Retention and Deletion

We retain your data as follows:

Newsletter summaries: Retained for the lifetime of your account.
Original email content: The full raw email body is stored only temporarily until its AI summary is generated, then permanently deleted. We retain only a short text excerpt (a few hundred characters) as a display fallback, never the complete original message.
Account data (email, name, profile picture): Retained until you delete your account.

You can request the deletion of your account and all associated data at any time, directly from within the app (Profile menu → Delete account) or by contacting us at privacy@thegist.tech. Deletion is completed within 30 days of the request.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.