Privacy Policy
Citadel (“Citadel”, “we”, “us”) is a privacy-first email assistant operated by [legal entity name] (“the Operator”) at citadel.aletheos.tech. This policy explains what data we access when you connect a mailbox, how we use it, how long we keep it, and the choices you have. Citadel is built so that the honest answer to “what do you keep?” is almost nothing, and not for long.
The short version
- We only access your mailbox with your explicit consent, using the least-privilege scopes.
- Your raw email is processed in memory only and is never written to our database.
- The AI that reads your mail runs on infrastructure we control — not a third-party AI service.
- We store only AI-derived data (a short summary, a priority, an optional draft), each item encrypted with its own key.
- On a schedule you choose, that key is destroyed (“crypto-shredding”), making the item permanently unrecoverable.
- We never sell your data, never use it for advertising, and no human reads your email content.
Data we access (Google & Microsoft user data)
When you connect an account, you grant these scopes:
- Google Gmail —
gmail.readonly(to read messages we summarize and triage) andgmail.send(only to send a reply or message you explicitly compose and approve). - Microsoft 365 / Outlook —
Mail.Read,Mail.Send, andUser.Read(your basic profile, to identify the connected account).
We request the minimum needed for the features you use. We do not request or access your contacts, Drive/OneDrive files, calendar, or any data beyond your mail and basic profile.
How we use it
When you run “Process inbox,” Citadel fetches recent messages, and a language model running on infrastructure we control produces, for each message, a short summary, a priority/label, and (optionally) a suggested reply in your tone. The raw message body is held in memory only for that pass and is discarded immediately afterward — it is never stored. We use your data solely to provide these user-facing features to you. We do not use your email content to train models for other users.
What we store, and for how long
- Only AI-derived data (summary, priority/label, optional draft) is stored — never the raw email.
- Each stored item is encrypted with AES-256-GCM under a unique per-item key (envelope encryption); our database holds only ciphertext.
- You choose a forget schedule (e.g. 1 hour, 24 hours, 7 days, or on logout). When it elapses, the item’s one key is destroyed. Because the plaintext key was never written down, the item then becomes permanently unrecoverable — this is deletion by design, not a trash folder.
- We keep a content-free audit log that records that a message was processed and when it was forgotten — never the content, the summary, or any key.
- OAuth tokens are stored to keep your account connected and are deleted when you disconnect.
Google API Services Limited Use disclosure
Citadel’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not transfer or sell Google user data for advertising, market research, or any unrelated purpose.
- We do not use Google user data for personalized or any advertising.
- We do not allow humans to read Google user data, except: with your explicit consent for specific messages; as necessary for security or to comply with applicable law; or where the data is aggregated and anonymized for internal operations. Citadel’s processing is automated and does not surface your content to our staff.
Where processing happens (sub-processors)
The AI pass runs on compute infrastructure the Operator controls rather than a third-party AI API. During the current phase this compute may run on a rented GPU host in the United Kingdom or European Union; the application and database run on the Operator’s server. Encryption keys can be held on a separate host from the compute (“keys-off-host”), so the compute host holds only ciphertext it cannot decrypt alone. We will update this policy and, where required, notify you before adding sub-processors.
How we protect it
Encryption in transit (TLS) and at rest (AES-256-GCM, one key per item). Keys are never stored in the database, and can be held off the compute host entirely. Crypto-shredding provides an irreversible deletion guarantee that survives even compelled disclosure of the ciphertext.
Disclosure
We do not sell or rent your data. We may disclose data if required by valid legal process, but our design limits what any disclosure can reveal: raw email is never stored, stored items are ciphertext, and forgotten items’ keys are destroyed. We will resist overbroad requests to the extent permitted by law.
Your rights and choices
- Disconnect any mailbox at any time in Settings; we delete its tokens. You can also revoke access from your Google Account permissions or Microsoft account.
- Forget now — trigger crypto-shredding of any item or all items immediately.
- Export your content-free audit log.
- Depending on your location, you may have rights to access, correct, or delete personal data (e.g. under GDPR/UK-GDPR or Canadian privacy law). Contact us to exercise them.
Data retention & deletion
Derived items are retained only until your forget schedule elapses, then crypto-shredded. Disconnecting an account deletes its tokens. You may request deletion of any remaining data by contacting us; we honor it promptly.
Children
Citadel is not directed to children under 16 and we do not knowingly collect their data.
International transfers
Your data may be processed in the country where our compute and servers are located (see “Where processing happens”). We take steps to ensure appropriate safeguards for cross-border processing.
Changes
We may update this policy; we will change the effective date above and, for material changes, take reasonable steps to notify connected users.
Contact
Questions or requests: privacy@aletheos.tech. Operator: [legal entity name, address, jurisdiction].