Privacy Policy

The native Glidefeed apps keep their working email and RSS caches on your device. Glidefeed on the web uses server-side caches and processing to provide mailbox reading, search, and synchronization; Section 4 explains what that includes. Gmail tokens stay on your device in the native apps; Glidefeed on the web (app.glidefeed.com) is the one exception, and Section 2 explains how its server holds them encrypted. This policy explains how we handle Google account information, Gmail, optional Contacts and Calendar access, RSS, diagnostics, and support data. Glidefeed is developed and operated by Speedy Labs LLC (Speedy Labs Limited Liability Company). If you have questions, email us at privacy@glidefeed.com.

1. The Short Version

The native Glidefeed apps are local-first email and RSS readers. They connect directly to Gmail through Google OAuth and to RSS publishers for feeds, then keep the working mailbox cache on your device with platform storage protection. The web app connects through Glidefeed servers and stores a working mailbox cache there. Glidefeed does not sell your data. The native Glidefeed apps on Apple platforms and Android keep your Gmail OAuth tokens only on your device; if you sign in to Glidefeed on the web (app.glidefeed.com), its server holds your Gmail tokens encrypted with AES-256-GCM and never sends them to your browser.

2. Information We Collect

We collect minimal information strictly necessary to operate the service:

• Account credentials and identity: Gmail accounts use OAuth tokens issued by Google. Basic Google account information, including your name, email address, profile picture and account identifier, identifies your connection and distinguishes your accounts in the app. In the native Glidefeed apps on Apple platforms and Android, tokens are stored only on your device, in the platform's secure storage — the Keychain on Apple platforms, and app-private storage protected by Android Keystore on Android — and are not sent to Glidefeed servers. If you sign in to Glidefeed on the web (app.glidefeed.com), Google issues the tokens to Glidefeed's web server rather than to your browser. That server stores each token record in its database encrypted with AES-256-GCM using server-managed encryption keys, and your browser never receives the tokens.
• Gmail: After you authorize mailbox access, the app accesses messages, headers, labels, drafts and attachments to display, search, synchronize, compose and send mail, and to carry out actions such as archive, mark read or unread, star, label and move to Trash. Separate Gmail settings permission supports the vacation responder and signature editing where that feature is available.
• Optional Google contacts: When you use Google contact suggestions while composing mail, the app requests read-only People API permission to find contact names and email addresses. This permission does not create, edit or delete your Google contacts.
• Optional Google Calendar: When you connect Calendar, the app accesses calendar lists and event details, such as titles, times, locations, descriptions and attendees, to display your calendars. Event-write permission supports the event creation, editing or deletion you request. Native apps access this data directly from Google; web Calendar requests pass through the web app's server.
• Web mailbox data: When you use the web app, we keep a server-side mailbox cache and process email data for reading, search, synchronization, and actions you request. Section 4 lists the stored data and its protections.
• Local diagnostics: Some app versions keep limited crash or performance details on your device. These diagnostics exclude mailbox and account content and are not uploaded automatically; you choose whether to include diagnostic details when contacting support.
• Optional support information: If you contact us for support, we receive the message and any image you choose to attach from your photo library. Because the draft is sent from your own mail account, we also receive your email address. The in-app feedback form also places the app version, device model, and operating-system version in the email for you to review before sending. Do not include email content unless you intentionally want us to review it.
• Waitlist and support email: If you email us from this website, we receive the email address and message content you choose to send.
• News feed searches: In the native apps, when you search for a news source by name, the text you type leaves your device and goes to Feedly, a third-party feed-search service, so it can return matching feeds. Glidefeed does not receive or store that text. See Third-Party Services below.

3. What We Never Collect

We are explicit about what we will never do:

• The native apps do not send your mailbox content to Glidefeed servers. The web app processes and caches email data on its server for the features you request, as described in Section 4.
• The native apps do not send contacts or calendars to Glidefeed servers. If you enable contact suggestions, the app incrementally requests Google People API access with contacts.readonly and searches names and email addresses for compose suggestions. If you enable Google Calendar, the app incrementally requests Calendar API read access and requests event-write access only when you choose an event-changing action. Device-calendar events are read locally only if you enable the Device calendars setting. The native apps do not send your connected-account email address to Glidefeed servers.
• We never sell or rent your personal data, and we never pass it to data brokers or advertising networks. Some native features contact a third-party service directly from your device — for example, searching for a news source by name sends the words you type to Feedly. Web features may contact providers through Glidefeed servers. Third-Party Services below describes the services the app contacts.
• We never track your location.
• We never use advertising identifiers.

4. Data Storage by Platform

In the native apps, cached email content and app data are stored locally on your device. These apps use platform-specific protections:

• Apple platforms: Gmail OAuth access and refresh tokens are stored separately in Keychain. On iOS, local SQLite cache files use iOS Data Protection, are excluded from device backups where supported, and use secure deletion behavior for removed rows.
• Android: Connected-account credentials are stored in encrypted app-private storage protected by Android Keystore. Room/SQLite caches remain in app-private storage, and app databases, preferences, and files are excluded from cloud backup and device transfer.
• Use the native app's Remove Account action to remove the active connection and its account-specific cache. Follow the choices shown for scheduled messages and drafts; items you choose to keep remain on your device. Uninstalling removes the app's local container, subject to any device backups you separately maintain; credentials stored in Apple Keychain may remain after an uninstall. Removing local data does not delete the original messages, contacts or events held by Google.

Glidefeed on the web (app.glidefeed.com)

The web app uses Glidefeed servers to connect to Gmail and RSS publishers. Its database stores account and session records, encrypted Gmail token records, and a working mailbox metadata cache including subjects, snippets, sender display names, labels, message identifiers, attachment details, and encrypted reply headers. The server indexes cached subjects, snippets, and sender display names for search and caches sanitized email HTML for reading. It also stores RSS subscriptions and content, queued mailbox actions, and encrypted drafts and outbound-message payloads needed to carry out your requests.

Sanitization removes unsafe markup, and redaction removes selected identifiers; neither means that all message content is encrypted. Cached mailbox metadata and sanitized email HTML are not end-to-end encrypted. The server can process this data to provide the web app's features. Gmail token records and outbound-message payloads have separate encryption protections.

The mailbox cache is refreshed and evicted over time, with temporary protection for recently requested messages and pending work. This is not a fixed total-message storage limit. Uninstalling a native app does not delete data held by the web app. To request access to or deletion of web account data, contact us using Section 9.

5. Email Provider Authentication

Glidefeed currently connects Gmail accounts through Google OAuth. When you sign in:

• You authenticate directly with Google — not with us.
• Google issues a token granting Glidefeed access to your Gmail mailbox only after you approve the consent screen.
• In the native apps, credentials are stored only in platform-secure storage on your device and are not transmitted to our servers. On the web, Google issues the token to Glidefeed's server, which stores it encrypted as described in Section 2 and never sends it to your browser.
• You can revoke this access at any time from your Google Account security settings.

Permissions are requested in context: Connecting Gmail does not require Contacts, Gmail settings or Calendar permission. Each optional feature requests the access it needs. In the iOS app, viewing Google Calendar requests read access; saving an event change requests event-write access if it has not already been granted. The web Calendar connection requests its read and event-write permissions together when you connect that optional feature. You can decline an optional permission and continue using features you have already authorized.

Google API Limited Use Disclosure: Glidefeed requests only the Google access needed for user-facing mailbox, contact-suggestion, Calendar, and visible Gmail settings features. Glidefeed's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide features you request: reading, searching, syncing, composing, sending and managing mail; finding compose suggestions through the Google People API; showing Google Calendar data; changing events within the event-write permission you grant; and managing your vacation responder or supported signatures when requested.

We do not use Google user data for advertising, sell it to data brokers, or use data obtained through Google Workspace APIs to develop, improve or train generalized, non-personalized AI or machine-learning models. People may access Google user data only with your explicit consent for specific data, when necessary for security, or when required by law. Transfers are limited to providing the features you request, security, legal requirements, or an acquisition after obtaining the consent required by Google's Limited Use policy.

6. Remote Email Media and External Links

In the native apps, email HTML preserves remote images/backgrounds in a non-persistent web view so messages render as sent, and external links open only after confirmation. The web app blocks remote email images by default. Remote email, RSS, feed-search, and icon requests can expose normal network data, including IP address and user agent.

7. Third-Party Services

Glidefeed uses a minimal set of third-party services. Native apps connect to providers from your device; the web app also uses its server and database providers to host and process the data described in Section 4.

• Google Sign-In, Gmail, People, and Calendar APIs: Google handles the OAuth consent flow. Glidefeed uses the resulting token — held on your device in the native apps, or in the web app's encrypted server-side vault — to connect only to the Google features you authorize. People and Calendar permissions are requested incrementally, not as part of baseline Gmail connection.
• RSS feed hosts: The app requests a feed from its publisher when you subscribe to it and when it refreshes. It also contacts a feed address you paste, and candidate feeds returned by a name search, before you subscribe — enough of them to fill the result list, not necessarily every candidate — to check that the feed is real and to read its title and icon. The words you typed are not sent to those publishers.
• Feedly feed search: Searching for a news source by name sends the text you type, and the number of results the app wants back, to Feedly's public feed-search service so it can return matching feeds. Glidefeed does not attach your account, email address, Gmail token, cookies, or any device or advertising identifier to that request; like any network request it still exposes normal network data such as your IP address and the app's user agent. Glidefeed does not control how Feedly handles the request. Pasting a valid HTTPS RSS or Atom URL instead is checked directly, without a Feedly search.
• Icon providers: To show a source or sender icon, the app may look one up from Google's favicon service, DuckDuckGo's icon service, or the publisher or sender domain itself, then falls back to initials. Those generated lookups carry only the domain, not your mail content. Separately, a feed or a Feedly search result can supply its own icon address, which can point at a different host such as a content delivery network; the app requests it only after the same public-HTTPS safety check it applies to any feed address, including for search results you have not subscribed to.
• Calendars you subscribe to: If you add a public calendar URL, the app fetches that calendar read-only from the host you supplied.
• Platform distribution services: TestFlight, the App Store, or Google Play may handle distribution when a build is offered through them. Their privacy policies govern those processes.

We do not embed advertising SDKs, social media SDKs, data broker services, or website analytics scripts.

8. Children's Privacy

Glidefeed is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@glidefeed.com and we will delete it promptly.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of support information you intentionally shared with us or web account data we hold.
• Deletion: Request deletion of support, waitlist, or web account information we hold. Removing an account from a native Glidefeed app removes its active connection and account-specific cache, while preserving any scheduled messages or drafts you choose to keep. To stop Google access as well, revoke Glidefeed in your Google Account security settings. Uninstalling deletes the app's local container, subject to any device backups you separately maintain; remove connected accounts before uninstalling.
• Support choices: Local diagnostics are not uploaded automatically. You decide whether to share diagnostic details when contacting support.
• Correction: If we have inaccurate information, contact us to correct it.

To exercise any of these rights, email privacy@glidefeed.com. We will respond within 30 days.

10. Data Security

We take the security of your data seriously. In the native apps, the working email cache is protected by operating-system security features such as device passcode, biometric unlock, and hardware-backed encryption where available. We encourage you to keep your device and operating system up to date.

Post-Quantum End-to-End Encryption: On supported Apple and Android platforms, this optional feature is off by default and stays off until you turn it on in Settings. Once on, it provides end-to-end encryption for supported one-to-one text messages between contacts whose compatible encryption keys are available and verified. It uses X-Wing (ML-KEM-768 + X25519) for hybrid post-quantum message confidentiality and Ed25519 for sender authentication. It does not cover every email: group mail and attachments aren't supported, each participant has to turn the feature on with compatible support, and normal provider email remains in use outside those supported conversations. This statement does not claim interoperability with every Glidefeed platform.

For any support information you choose to send us, we use encrypted connections (TLS) and industry-standard access controls.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you via an in-app notice. Your continued use of Glidefeed after changes take effect means you accept the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:

• Email: privacy@glidefeed.com
• General inquiries: hello@glidefeed.com