Privacy Policy

1. Who we are

MorningZero is an AI email assistant operated by Serveka, based in Jaipur, Rajasthan, India. It connects to your mail accounts to label, search, answer questions, and draft replies. For any privacy question, contact us at [email protected].

2. Information we collect

• Account information — your name, email address, and authentication identifiers when you sign in.
• Mailbox access tokens — OAuth tokens for the mail accounts you connect (e.g. Gmail or Outlook). Tokens are encrypted at rest with access restricted to the systems that operate your account, and used only to access your mail on your behalf.
• Email content and metadata — message subjects, senders, recipients, thread identifiers, labels, timestamps, short previews (snippets), AI-generated summaries, and vector embeddings of subject and preview text (numeric representations that power search and labeling) that we store to provide the service. We process full message bodies transiently to label, summarize, and answer questions about your mail: bodies are never written to our database, and the short-lived cache that makes a reopened message load instantly holds them encrypted for a few minutes before it expires. If you install our desktop app, it keeps a rolling local copy of recent messages (including bodies) on your device so mail loads instantly and works offline; uninstalling the app or deleting its data removes that copy.
• Attachments — we show the name and type of files attached to a message. When you ask a question that needs an attachment's contents, we fetch that file and extract its text so the assistant can read it. Attachment files themselves are not stored on our servers.
• Calendar data — your events are read from Google Calendar or Microsoft Graph each time you open the calendar, and are not stored on our servers. The one exception is an event you create in MorningZero that could not be written through to your provider: we keep it (title, time, location, description, attendees, recurrence) so the event is not lost, and delete it when you disconnect the mailbox.
• Usage data — logs, device/browser information, and feature usage needed to operate and secure the product.
• Billing data — if you purchase a paid plan, payments are handled by a third-party payment processor; we do not store full card numbers.

3. How we use your data

• Provide core features: AI labeling, search, plain-English Q&A over your mail, and reply drafting.
• Personalize labeling for your account: your in-app actions (such as correcting a label, replying, or archiving) are used as feedback signals to tune how your own mail is labeled.
• Maintain, secure, debug, and improve the service.
• Communicate with you about your account and support requests.

We do not sell your data, and we do not use the content of your email to train general-purpose AI models.

4. AI processing

To label messages, answer questions, and draft replies, relevant email content is sent to AI model providers acting as our processors. They process it transiently to return a result and are contractually bound not to use it to train their models. This includes the embedding provider that converts subject and preview text into the vectors used for search and labeling. These embeddings exist solely to power user-facing features inside your account — searching and organizing your own mail — and are not used to develop or train generalized AI or machine-learning models.

5. Google & Microsoft API Services

MorningZero's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We access your Gmail data and your Google Calendar events only to provide and improve user-facing features within MorningZero (such as triage, search, drafting and sending email at your direction — including rules and scheduled sends you set up — showing your daily agenda, and creating, updating, or responding to calendar events at your direction; RSVPs and event changes may notify the other attendees of that event), never for advertising, and we do not transfer or sell this data to third parties except as needed to provide the service, for security, or to comply with law. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.

When you connect an Outlook or Microsoft 365 account, we access your Microsoft mail and calendar data through the Microsoft Graph API under the same restrictions: only to provide user-facing features within MorningZero, never for advertising, and never sold. Our use of Microsoft APIs is also subject to Microsoft's applicable terms.

6. Sharing and subprocessors

We share data only with service providers that help us run MorningZero: cloud hosting and database providers (Google Cloud), AI model and embedding providers (Amazon Bedrock, Google, Voyage AI), product analytics (PostHog), our payment processor (Lemon Squeezy), transactional email (Resend), and push notification delivery (Expo, Apple, Google — notification text can include a message's sender, subject, and a short preview). Each is bound to use the data only to provide their service to us. We may also disclose data if required by law or to protect rights and safety.

7. Data retention

We retain your data while your account is active. You control how much mail history is imported, and you can delete messages, disconnect a mailbox, or delete your account at any time. Disconnecting a mailbox withdraws our access to it and permanently deletes every record we derived from it. On account deletion we promptly remove your stored mail content and access tokens; residual copies in encrypted backups are overwritten on our normal backup cycle within 30 days. We keep a minimal inactive account record and aggregate usage history for security, accounting, and abuse-prevention purposes, and where retention is legally required.

8. Security

All traffic is encrypted in transit with TLS. At rest, we encrypt your OAuth tokens, cached message bodies, and any AI API key you provide with AES-256-GCM before they are written, and our managed database and its backups are encrypted at rest by our cloud provider. Access is restricted to the systems that operate your account.

When you disconnect a Google mailbox, we call Google's token revocation endpoint so the grant is withdrawn and MorningZero disappears from your Google account's third-party access list. Microsoft offers no equivalent revocation endpoint, so for Outlook and Microsoft 365 accounts we delete the stored tokens instead, and you can also remove our access from your Microsoft account settings. Either way, the data derived from that mailbox is purged at the same time.

No system is perfectly secure, but we work to protect your data and to respond promptly to incidents.

9. Your rights

Depending on where you live (including under the GDPR and similar laws), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection authority.

10. International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

11. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to operate the app, and product analytics (PostHog) to understand feature usage — with autocapture and session recording disabled, and never reading your mail. Our site also uses the Meta Pixel and Conversions API to measure our sign-up campaigns; this shares page-visit events and a one-way SHA-256 hash of your account email address with Meta, so that a signup can be attributed to an ad. No Gmail, Outlook, or calendar data is ever shared with Meta or any other advertising platform, and your mail is never used for advertising or ad targeting.

12. Children

MorningZero is not intended for anyone under 16, and we do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notifying you.

14. Contact

Questions about this policy or your data? Email us at [email protected].