Privacy

Gmail stays canonical. Skim turns selected mail into a finite card deck, and is explicit about where that work happens.

Effective 31 July 2026

Current rollout: the public owner/test preview still scans Gmail in the browser. A server-assisted sync and derived-card plane is deployed behind disabled rollout flags and is not yet the primary deck.

What Skim accesses

After you connect Google, Skim can read Gmail messages and labels, create and update labels in the Skim/* namespace, and store Skim-created state in Google Drive’s hidden app-data folder. Google’s consent screen shows the current scopes before you approve them. Skim has no mail-send feature and does not delete Gmail messages.

Where processing happens

• Browser: the current preview fetches recent inbox and sent mail, builds the opening deck, and keeps access credentials in this browser’s encrypted local vault.
• Skim’s Cloudflare Worker: exchanges and refreshes Google tokens for the browser and serves the app. Its revision-002 server plane can keep encrypted refresh credentials and reproducible derived state when that rollout is enabled.
• Optional cloud classifier: DeepSeek classification is off unless you explicitly enable it. When enabled, selected personal message text is money-redacted before it is sent through Skim’s Worker to DeepSeek, and AI-derived cards are visibly badged. DeepSeek may cache provider-side inputs or outputs, and its current standard contract does not give Skim a zero-retention or no-provider-training guarantee. Skim does not use your Gmail content or these classifications to train a generalized model.

What can be stored

The current preview stores card mappings, feedback, and—only after cloud classification is enabled—AI classification results in Google Drive app data; swipe actions also become Gmail labels. This browser keeps account connection data, the versioned classifier-consent decision, settings, and temporary caches. The consent record contains only the decision, contract version, and time—not message content.

The new server plane is designed to store only encrypted credentials and derived state: pseudonymous account keys, Gmail source IDs, thread direction and label state, semantic booleans, confidence, evidence offsets, cards, actions, and content-free sync measurements. Its database and queues have no raw message-body, raw subject, attachment, or model-input/output field.

Operational logs

Automatic request-URL invocation logs are disabled. Skim retains only custom Worker records restricted to content-free operational fields such as operation, status, count, duration, and retry attempt. Its logging contract rejects fields named for message content, subjects, senders, email addresses, tokens, secrets, or prompts.

Retention and deletion

• Gmail messages and labels remain in your Google account until you change them there.
• Google Drive app data remains under your Google connection and Google’s retention behavior.
• Current “Sign out” disconnects accounts and clears the local credential vault on that device; it does not delete Gmail or legacy user-visible Drive files created by earlier preview builds.
• When the server account plane is enabled, server disconnect first stops the Gmail watch and revokes the Google token, then deletes the credential envelope, sessions, derived facts, cards, actions, and account state. Only a pseudonymous, content-free deletion receipt remains.
• Expired server sessions are removed automatically; personal cards and facts older than the 30-day derivation horizon are superseded.

Your choices

You can use preview mode without a Google account, use deterministic Gmail cards without DeepSeek, enable or withdraw cloud classification at any time in Settings, revoke Skim from your Google Account permissions, remove Skim-created Drive data through Google, and clear site data in your browser. Withdrawal stops future classifier requests; it cannot recall a request already received by DeepSeek. The developer-only quality-review export is an explicit local download: it contains private sender, subject, and snippet context, is never uploaded to Skim, and should be kept only in the gitignored private-corpus/ workflow. For an access or deletion request, use the operator contact shown on the Google OAuth consent screen through which you received access.

Changes

This notice will be updated before the server deck or a new inference provider becomes primary. Material changes to content processing, retention, or deletion will not be hidden behind unchanged copy.