Privacy Policy

Last updated: September 15, 2026

1. Introduction

Welcome to The Gist ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use our application.

2. Data We Collect

Private beta requests: If you request access through our website, we store your email address, selected phone platform (iPhone or Android), language, and request date to manage your beta request and send installation instructions when access is available. This request does not connect Gmail or create an app account. To withdraw your request and remove these details, contact privacy@thegist.tech.

We collect the following types of information to provide the feed, classification, and summarization features you request:

Google User Data: Email address, name, and profile picture (via Google Sign-In).
Gmail content and metadata: Message body, subject, sender information, received date, Gmail message identifiers, and structural signals needed to identify supported messages, classify them, and generate feed items and summaries.
Usage Data: Product analytics events such as page views, onboarding progress, feed interactions, and feature usage.

Specifically, The Gist requests the following Google OAuth scopes:

https://www.googleapis.com/auth/gmail.readonly — Read-only access used to retrieve and automatically process messages for the user-facing feed, classification, and summarization features. We cannot send, delete, or modify any email.
https://www.googleapis.com/auth/userinfo.email — Your email address, used to identify your account.
https://www.googleapis.com/auth/userinfo.profile — Your name and profile picture, used to personalize the interface.

3. How We Use Your Data

Your data is used solely for the following purposes:

To identify supported messages and organize your private feed.
To classify messages (for example, distinguishing newsletters, promotions, informative messages, and personal threads).
To generate summaries, translations, and other feed elements requested by the product.
To provide the core functionality of The Gist application.

Crucial: We do not sell your data to third parties. We do not use your email content for advertising purposes.

4. Analytics and Error Monitoring

On the public landing page, we use Google Analytics 4 to measure aggregate visits, traffic sources, landing page interactions, and signup intent. Landing analytics events do not include Gmail content, email addresses, message metadata, or user-provided email text.

Google Signals, ads personalization signals, and advertising-related storage are disabled by default and are enabled only after cookie policy acceptance on the landing page.

We use PostHog Cloud EU, hosted in Frankfurt, Germany, to understand product usage and improve the application. PostHog may collect product events, page views, masked session replay data, device/browser metadata and, for signed-in users, a pseudonymous internal user ID. We do not send the user's Google email address, name, or profile picture to PostHog.

We configure PostHog to avoid collecting Gmail content, email subjects, sender information, raw message bodies, Gmail message IDs, and other email-derived content in analytics properties. Session replay masks text and element attributes.

We use Sentry for error monitoring and performance diagnostics. Sentry receives a pseudonymous internal user ID to correlate technical failures, but not the user's Google email address, name, profile picture, or Gmail content.

5. Google API Services User Data Policy

The Gist's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To provide the user-facing classification, summarization, translation, and feed-generation features, we use the following AI sub-processors:

Google Vertex AI (Gemini) — Primary summarization engine. Data is processed under Google's Cloud Data Processing terms and is not used to train models. Google Cloud DPA →
OpenAI — Fallback summarization and translation engine. API usage with data retention disabled (zero data retention). Data is not used to train models per OpenAI's API data usage policy. OpenAI API Data Usage Policy →

Depending on the feature and message type, the data sent to an AI sub-processor may include the message body, subject, sender name or address, and automatically derived structural signals needed to classify or summarize the message. Processing is automated. We do not permit these providers to use Google user data for advertising, data brokerage, credit decisions, or unrelated purposes, and we do not sell Google user data.

6. Security and Data Protection

We treat Gmail content, Gmail metadata, Google account information, and OAuth credentials as sensitive data. We use technical and organizational safeguards designed to protect Google user data against unauthorized access, use, alteration, disclosure, loss, or destruction, including:

Encryption in transit: Google user data is transmitted between your device, The Gist, Google APIs, and our disclosed service providers using HTTPS/TLS.
Credential protection at rest: Google OAuth access and refresh credentials are stored using authenticated encryption. The encryption key is kept separately from the encrypted credential store and is supplied through protected production secrets.
Access controls and isolation: Application authentication and authorization controls restrict each user to their own data. Production access is limited to authorized personnel who need it to operate, secure, or support the service.
Data minimization: We collect and retain only the data needed for the user-facing features described in this policy. Complete original message bodies are removed after successful processing as described below.
Privacy-safe monitoring: Our logging and error-monitoring controls redact OAuth tokens, Gmail content, email addresses, Gmail message identifiers, and other sensitive fields. We do not place Google user data in analytics properties.
Protected backups: Production backups are encrypted before transfer, access-restricted, and automatically removed after 30 days.

We review these safeguards, monitor the service for security issues, and maintain procedures to respond to suspected security incidents. No method of electronic transmission or storage is completely secure, but we work to maintain protections appropriate to the sensitivity of the data we process.

7. Data Retention and Deletion

We retain your data as follows:

Newsletter summaries: Retained for the lifetime of your account.
Original email content: The full raw email body is stored only temporarily until its AI summary is generated, then permanently deleted. We retain only a short text excerpt (a few hundred characters) as a display fallback, never the complete original message.
Feed metadata: Subject, sender information, received date, Gmail message identifiers, classifications, and generated feed data are retained with the relevant feed item for the lifetime of your account.
Account data (email, name, profile picture): Retained until you delete your account.

You can request the deletion of your account and all associated data at any time, directly from within the app (Profile menu → Delete account) or by contacting us at privacy@thegist.tech. Deletion is completed within 30 days of the request.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.