Understand what
you share.

Information the pilot handles

Google sign-in provides identity details such as your email address, name and profile image. Connecting Google services provides the data needed for enabled features, including email messages and attachments, mailbox labels and contacts derived from conversations. Calendar events and tasks are accessed when you separately enable those services. The Google Chat launcher opens Google Chat directly; CAPAX does not request Chat API access. CAPAX also handles preferences, AI context you supply, scheduled-send instructions and operational records.

Why we use it

We use this information to identify authorized pilot users, display and sync your workspace, carry out actions you request, generate AI assistance and operate and troubleshoot the service. Mailbox organization and sending actions can update your connected Google account.

Service providers and AI

The hosted pilot runs on Render and connects to Google APIs. AI features use OpenAI’s API and can send relevant message content, conversation context and saved preferences to OpenAI for processing. AI processing requires an account-level permission in Settings → AI & Privacy. It starts off, with separate choices for background analysis and learning from received and sent email. Withdrawing permission blocks new AI transmissions across devices; a request already transmitted may finish. Learning sends bounded excerpts from recent synced conversations to OpenAI to propose facts, preferences and writing style. Proposals and supporting source excerpts are stored in your account. New proposals are excluded from AI context until you confirm them in My Context; older profile notes are reviewed in Settings. Confirmed context can inform Needs My Attention, Week Ahead and contextual replies within your own account; it is not shared with other pilot users. For contextual replies, you explicitly select the saved details you are comfortable including, and no details in that selection are included automatically. You can correct or forget learned facts; review dates exclude outdated context from use. Forgetting removes the active text and evidence and retains a content digest to avoid relearning the same fact. Different wording may still produce a new proposal. Existing encrypted backups may retain prior copies until expiry. The server uses your account’s saved profile and reviewed notes; stale browser memory is not accepted as saved context. Saved memory is managed separately. This broader learning scope requires a fresh AI permission choice. Browser push services process subscription details when notifications are enabled.

Provider terms and processing policies also apply. See Google’s privacy policy, OpenAI’s business data privacy information and Render’s privacy policy.

Google user data

Our use and sharing of Google API data must comply with the Google API Services User Data Policy, including its Limited Use requirements.

Storage and controls

CAPAX stores synced mailbox data and configuration in its server database. Stored Google refresh tokens are encrypted. The browser also stores workspace preferences and some draft or pending-action data, so use care on shared devices. When an account changes or old browser data has no established owner, CAPAX isolates that cached data from the active workspace instead of importing it into the new account. Inactive browser copies may remain until CAPAX site data is cleared or this browser completes account-deletion cleanup; they are not automatically restored or submitted. Signing out, disconnecting a mailbox and deleting stored data are different actions.

Disconnecting and deleting your account

You can disconnect a mailbox in Settings and revoke CAPAX in your Google Account permissions. To delete your CAPAX account, open Settings → AI & Privacy → Delete your CAPAX account. Review the affected data, sign in again if requested, and enter your account email and the confirmation phrase. Deletion removes your identity and owned connected credentials, synced mail, drafts, scheduled sends, saved AI memory, preferences, push subscriptions and linked usage/audit records from the active CAPAX database. Other users’ records and shared workspace information remain.

CAPAX account deletion does not delete your Gmail messages, Calendar events or Tasks, revoke Google’s app grant, remove downloaded files, or recall a provider action already in progress. This browser clears CAPAX drafts and preferences; other online devices with a valid session clear local CAPAX data when they detect deletion. Offline devices, expired sessions and downloaded files may require manual cleanup. An active send or required administrator handover can delay deletion.

If you cannot use the account controls, email support.capax@gmail.com from your pilot account. The team may need to verify your identity. Disconnecting and account deletion are different actions.

Retention and recovery copies

The current pilot keeps synced data while the account is active; it does not yet apply a fixed age limit to every message or operational record. Encrypted backups are scheduled daily to an operator-controlled external drive, subject to the Mac being awake, the desktop app running, the drive being mounted and the service being reachable. The backup target is 30 days. Expired authenticated archives are removed after a replacement backup succeeds; the latest verified recovery pair is preserved until replaced, and damaged or unrecognized archives require manual review. Hosting-provider snapshots have separate retention, so 30 days is not a promise of complete erasure from every recovery copy.

A minimal signed deletion record containing request/time and internal identity references with a keyed email hash is retained to keep deleted accounts from returning during recovery. It contains no message content, Google credentials or plaintext email address. Restores must apply available deletion records and remain isolated with credentials, AI permissions and pending delivery disabled until operator review. Because backups run periodically, recovery also requires checking requests received after the latest copy.

If you email support or request pilot access, the information you send is used to handle that conversation. Contact the team about retention before connecting sensitive information.

Public pilot requests

The request form stores your encrypted email address, chosen use case, contact permission implicit in submitting the checked form, and optional source or consented campaign attribution. We use a keyed email hash to prevent repeat requests from increasing counts during the 30-day request retention window. A request does not create an account, verify an email address or guarantee admission. Only the Capax operator may review requests. Active requests expire after 30 days; anonymous daily campaign totals expire after 90 days. Earlier removal can be requested by emailing support from the submitted address. Prior copies may remain in recovery archives under the retention limits above. Public intake uses short-lived keyed network-address hashes and an aggregate hourly limit to reduce abuse; raw network addresses are not stored in the intake tables.

Optional public website analytics

Google Analytics starts only after you choose Allow analytics, only on public Capax website pages, and respects Do Not Track and Global Privacy Control. It measures sanitized page paths, pilot-access and sign-in clicks with a fixed set of campaign labels. It does not receive form emails, mailbox content, private workspace routes, full query strings or referrers from this integration. The request form does not load Google Analytics. Our server totals are the source for unique received requests. Website analytics consent is separate from pilot contact permission and the workspace AI permission.

You can decline analytics and still request access. The Website analytics choices button lets you withdraw. The consent choice remains in this browser until changed or site data is cleared. Consented campaign labels remain in the current browser session for up to 30 minutes. Google analytics cookies are restricted to the analytics bridge path and removed when you withdraw using this control. Blocking analytics or cookies means some visits and campaign journeys will be missing; source answers on the request form are optional.

Changes to the pilot

We will update this notice as data practices change. The date at the top identifies this version. Contact the team if you need more information about the pilot operator, hosting or your data request.