Least-privilege OAuth
Gmail and Outlook connect through Google and Microsoft's own consent screens — we never see or store your password for them, and you can revoke MorningZero's access from your provider at any time. Signing in and granting mailbox access are separate grants, so revoking one does not silently keep the other alive.
App passwords, for providers without OAuth
Some providers — Yahoo, iCloud, Fastmail and similar — offer no OAuth for mail, only an app-specific password you generate in their settings. Connecting one of those means we hold that password: encrypted with AES-256-GCM under its own encryption secret, separate from the one protecting our OAuth tokens, never logged, never returned by our API, and permanently deleted the moment you disconnect the mailbox. Gmail and Outlook never use this path, and MorningZero will refuse a Gmail or Outlook address here and send you to the OAuth screen instead.
Encrypted in transit and at rest
All traffic is encrypted in transit with TLS, and HSTS keeps browsers on it. Your OAuth tokens, app passwords, cached message bodies and any message queued for sending are encrypted with AES-256-GCM before they're written, and the storage our database sits on is encrypted at rest by our infrastructure provider. Connections to mail servers require TLS too — we never fall back to an unencrypted session, and we reject a server whose certificate does not check out.
We don't hoard your inbox
Message bodies are not warehoused: they are read from your provider when you open a message and held in an encrypted cache for about ten minutes, then discarded. Attachments never leave your provider. What we do store is what the features need — subjects, senders, labels, timestamps, previews, AI summaries and the search vectors built from them, plus the things you create here: drafts, messages queued to send, and your conversations with the assistant.
Never trained on your email
We do not use the content of your mail to train general-purpose AI models. The model providers that process it act as our processors and are contractually bound not to train on it — we pay for the tiers where that's the deal, because some free tiers let the provider learn from what you send. Your corrections tune labeling for your own account and nobody else's.
Nothing happens behind your back
No auto-send, ever: the assistant drafts and you press Send. When you mark a thread Done or Not for me, we add a MorningZero/Done or MorningZero/Not for me label at your provider, and archive it there if you chose that at setup. Copying your other labels and Zero's tags into Gmail or Outlook is a separate switch per mailbox, off by default. Every rule records what it did in an audit view, and sessions are revocable per device with a single “sign out everywhere”.
Delete means delete
Disconnect a mailbox and its messages, labels, rules, drafts, assistant conversations and learned preferences are deleted in one transaction, along with the token or app password we held. For Google we also revoke the grant at Google; Microsoft offers no revocation call, so remove the app from your Microsoft account to cut it there too. Delete your account and all of it goes, along with your access tokens. You also choose how much history is imported in the first place.
No ads. No selling.
Your mail is never sold, never shared with advertisers, and never used for ad targeting. Our use of Google and Microsoft data follows their Limited Use requirements — full stop.
