Confluo Privacy Policy

Effective date: 2026-11-03 (or the date this policy version 6 is published, whichever is later)

Version: 6

Last updated: 2026-10-31

Confluo ("Confluo", "we", "us") is operated by Velocity Consulting Group Pte Ltd, a company incorporated in Singapore ("Velocity"). This policy explains what we collect, why, where it goes, and the rights you have over it. We aim for a policy you can read, not skim past.

The one-line version. Confluo reads recent messages from the accounts you choose to find action items. We keep the action items themselves — a short title, a summary, the sender's name, a link back to the original, and a few timestamps — for up to 90 days. Because the title and summary are generated from the message, they can contain words from it. Message bodies pass through our processing pipeline briefly and are not written to our database, with one exception: new Slack messages are held on our servers until they are processed, usually within hours (see Section 3). If you connect Gmail, Section 4 sets out the additional commitments we make for data we receive from Google. Backups of our database are retained for up to 35 days, and we set operational log retention to 30 days, to keep the service reliable.

1. What Confluo does

Confluo connects, with your permission, to Microsoft Outlook, Microsoft Teams (via Microsoft Graph), Slack and Gmail, using each provider's official OAuth sign-in, and to other email accounts such as iCloud Mail over IMAP, using an app-specific password you create with that provider where it offers no such sign-in. It scans recent messages, uses an AI model to identify action items (things that need your reply, your follow-up, or your attention), and presents them as a daily briefing and checklist. Tapping an item opens the original message in the source app. Confluo never sends messages on your behalf and never asks for the permission to do so, and it never marks messages as read, moves, labels or deletes them.

2. What we collect and store

Extracted action items. For each item: a short generated title and summary, the sender's name (or their email address when the message gives no name), the source (Outlook, Teams, Slack, Gmail or other email), a timestamp, a link reference to the original message (identifiers only; for Gmail, a link to the message or its conversation in Gmail), a thread/conversation identifier, and item state (open, done, dismissed, snoozed). For an item made from an email you sent, also the names and email addresses of the people you sent it to (To and Cc). The title and summary are written by an AI model reading the original message, so they can repeat words, names or details from it — they are a short rendering of your message, not an unrelated label. The link reference can include the address of the mailbox you connected.

Message metadata for processing integrity. Message identifiers, sender email addresses and display names, folder or channel identifiers, and processing verdicts — so we can avoid re-processing, deduplicate, and audit coverage. For Outlook, Teams, Gmail and other email, message bodies are not written to our database at all. For Slack, incoming messages are held as described in Section 3.

Account and connection data. Your email address and display name from sign-in (Sign in with Apple or provider OAuth); the address of each account you connect and, for Gmail, the other addresses that account can send mail as (so we can recognise mail you sent); encrypted OAuth tokens, or encrypted app-specific passwords, for the accounts you connect; for an account connected over IMAP, the mail server you chose; your timezone; your notification and check-in preferences.

Unsolicited-sender list. Confluo marks some items as unsolicited (cold outreach). When you dismiss such an item, we record the sender's email address and domain so that we can hold back their next messages; when you mark one done, we record them so that we stop flagging that sender. Each entry notes the item it came from.

Briefing content. The generated daily briefing text. It summarises your action items and the senders and subject lines of recent messages; it is not built from message bodies.

Device and notification data. A push notification token, device timezone, and app version, used solely to deliver the notifications you configure. We keep a record of the notifications we sent you for 30 days. Notification text is built from an action item's title and its sender's name, so it can contain words from the underlying message and can appear on your lock screen; delivering it means passing it to Expo and to Apple's push service (on Android, to Google's Firebase Cloud Messaging; see "On Android" below).

Subscription status. Whether you have an active subscription or trial, via our payments processor (RevenueCat) and Apple, or Google Play on Android (see "On Android" below). We never see your payment card details.

Diagnostics. Structured operational logs (processing counts, error states, service health). Our logging code is written to exclude message bodies and subject lines, with explicit filters for those fields and automated tests that fail the build if a known field starts leaking. We cannot promise that no fragment of a message ever reaches a log — an unexpected error can carry input into its message — so we treat logs as potentially content-bearing and keep them short-lived. We set operational log retention to 30 days.

Security and account records. Sign-in records, consent acceptances, connection and deletion events, and similar security audit entries. These contain no message content and are kept for 365 days (see Section 10).

### On Android

Confluo's Android app, from Google Play, works as the rest of this policy describes. Two things differ: Google Play handles your subscription instead of Apple, and Google's Firebase Cloud Messaging delivers notifications instead of Apple's push service. The cancellation survey below works the same way on Android and iPhone.

Subscriptions through Google Play. On Android you subscribe with Google Play billing. Google takes your payment under its own terms and privacy policy, and we never see your card or other payment details. Google Play reports the purchase to RevenueCat, our payments processor, which tells us the result; RevenueCat knows your account by its Confluo account ID, not by your email address. We keep a purchase record for your account: the plan, its status (for example trial, active, cancelled or expired), the date it renews or ends, and when you cancelled. We use it to give you access to Confluo Pro, to manage your account and subscription, and to count subscriptions by plan for our own reporting. It is kept while your account exists and deleted with it (Section 10). You cancel in the Google Play app (Payments & subscriptions → Subscriptions).

Notifications through Firebase Cloud Messaging. On Android, the push token in "Device and notification data" above is an Expo token that wraps a token from Google's Firebase Cloud Messaging (FCM). Expo passes each notification, including its text, to FCM, which delivers it to your device. As on iPhone, that text is built from an item's title and its sender's name, so it can contain words from the underlying message. Notifications are optional: if you do not allow them, no push token is created and nothing is sent to FCM. If you allow them and later turn them off in your phone's settings, your phone stops showing them, but we keep the token and may still pass notifications to Expo and FCM; signing out of Confluo on that phone removes the token when the app reaches our servers to sign you out (if it cannot, for example because the phone is offline, the token can remain until you delete your account), and deleting your account always removes it.

Cancellation survey. When you cancel your subscription, the app asks you once, "What wasn't right?". If you have not opened the app 24 hours after cancelling, we may send you one notification asking the same question. Answering is optional. When the survey is shown, we record that it was shown, so that it is not shown again, together with a snapshot of your account taken when our server receives that record: your plan, whether you were on a trial, how many days you had had your account, which kinds of account you had connected, how many items you had seen, when your messages were last checked, and when you cancelled. We keep that record and snapshot even if you skip the survey. If you answer, we add the reasons you choose and anything you type (up to 500 characters). We use the answers only to understand why people cancel and to improve Confluo, and people at Confluo read them in our internal admin tools. What you type is not written to our logs and is not sent to Anthropic. The answers are kept until you delete your account (Section 10).

3. Message content in processing

To find action items we must read message content. This is the one place where message content is present in our systems:

Outlook, Teams, Gmail and other email: Message bodies are read from the provider directly into our processing pipeline in memory, passed to our AI provider (Anthropic) for extraction, and then discarded from memory when the request completes. For email, we read the headers first and fetch the text of a message only if it is not a newsletter or automated mail; attachments are never read, and at most the first 1,500 characters of a message's text are sent to Anthropic, with its sender, subject and date. Before any message content is sent to Anthropic, the app asks for your permission on a dedicated screen. If your account was created before the version of this policy that introduced that screen, the app asks you the next time you open it, and processing is paused until you answer. You can withdraw that permission at any time in Settings, after which no further message content is sent and automatic processing stops. Message bodies are not written to our database, and so they are not in our database backups either. We do not intentionally log them, and the fields that carry message content are filtered out of our logs — but, as Section 2 says, an unexpected error can carry a fragment of what it was processing into an error log, so we treat logs as potentially content-bearing rather than promise they never are.

Slack: Because Slack delivers new messages by webhook, they arrive in our system between processing runs. To avoid losing them, an incoming Slack message body is written to our database and held there until the next Slack processing run, which deletes it as it processes the message. The database is encrypted at rest, but this is ordinary storage — it is not a separate encrypted vault, and while the message is held, it is a copy of your message in our database.

How long that is. In normal use, minutes to hours. A message that is never processed — a channel you have switched off, a run that failed, an account you disconnected — is removed instead by a cleanup job that runs once a day and deletes anything older than 24 hours. That means a stuck message is normally gone within about two days, and longer if that job itself is delayed. We do not claim a 24-hour hard maximum, because the cleanup is daily rather than continuous.

Channels you have switched off. Switching a Slack channel off stops us building action items from it. It does not stop the message reaching our servers: Slack delivers messages from the conversations your connected account is part of, and we hold each one briefly before we look at your settings. A message from a channel you have switched off is therefore buffered like any other and then discarded unread at the next processing run, or by the daily cleanup above — it is never turned into an action item. A message we cannot match to a Confluo account at all is dropped as it arrives and is not stored.

In every case, once processing completes, only the extracted action items and their metadata remain — and, as Section 2 says, those items can contain words from the message they came from. Our extractor and briefing generator run against the message content only long enough to produce the extracted item.

Deletion and backups. When we delete something from the live database it is gone from the service immediately, but copies can persist in automated database backups until those backups age out — up to 35 days (Section 10).

AI provider. We use Anthropic, PBC (Claude), as our processor, to extract and summarise. Per Anthropic's commercial API terms, prompt data is not used to train Anthropic's models, and Anthropic keeps it only for the period in Section 10. We do not use your messages, or anything derived from them, to develop, improve or train any AI or machine-learning model, ours or anyone else's.

4. Gmail and data we receive from Google

This section applies if you connect a Gmail account. It adds to the rest of this policy; where they differ, this section governs data received from Google.

Limited Use. Confluo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. (The policy: https://developers.google.com/terms/api-services-user-data-policy.)

What we access. We ask Google for three permissions only: “openid” and “email” (to identify the Google account you connect and its address) and “gmail.readonly” (to read your mail). We cannot send, delete, label or change your mail. We read messages in your inbox and sent mail from the last 14 days when you connect, then new messages as they arrive. When we look for new mail we skip the Promotions and Social categories, and messages in Spam, Trash or Drafts and chats are never processed (a message we had already found can have its headers read once more, to see where it now is). To clear an item once you have replied, we read the headers (sender, recipients, subject and date) of the messages in that item's conversation and use only a reply you sent; messages in Trash, Spam or Drafts are ignored.

How we use it. Only to provide the features you see in Confluo: finding the messages that need your reply, what you are waiting on from others and what you have promised; your briefings and check-in notifications; recognising your own sent mail; and clearing an item once you have replied. We use it for nothing else.

Who it goes to. We do not transfer data received from Google to anyone, except: to the processors in Section 7 that we need to provide those features — Anthropic (to read message text and write your action items and briefings, as described in Section 3), Amazon Web Services (hosting) and Expo and Apple or, on Android, Google's Firebase Cloud Messaging (to deliver the notifications you have turned on, whose text is built from an item title); where necessary for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition or sale of our assets, and then only after obtaining your explicit consent first.

What we never do with it. We do not sell it. We do not use it, or transfer it, for advertising, including retargeting or personalised ads. We do not use it to build profiles of you or of the people who write to you, to determine creditworthiness or for lending, and we do not give it to data brokers or information resellers. We do not use it to develop, improve or train any AI or machine-learning model, ours or anyone else's, and Anthropic does not use it to train its models.

People at Confluo. No one at Confluo reads your Gmail data, including the action items made from it, unless: you have given us your explicit permission to look at specific messages or items (for example, when you ask for help with one); it is necessary for security purposes, such as investigating a bug or abuse; it is required to comply with applicable law; or the data has been aggregated and anonymised and is used only for our internal operations.

How long we keep it. As set out in Section 10: action items for at most 90 days (30 days after you close one), briefings for 90 days, the record of which messages we have read for 90 days, and notification history for 30 days. Entries in the unsolicited-sender list (Section 2) made from Gmail items are kept until you disconnect Gmail or delete your account.

Disconnecting Gmail (Settings → Connections) deletes at once, from our live database:

• every action item made from that Gmail account, including one since moved under another connected mailbox that received the same email (Section 10), the stored notifications about those items, and every check-in notification we sent while that Gmail account was connected (its counts include your Gmail items);
• the unsolicited-sender entries made from those items;
• every briefing composed while that Gmail account was connected, including the parts of it about your other accounts, because a briefing is a single summary across all of them;
• the record of which of its messages we have read, our position in your mailbox, the account's address and the other addresses it can send as; and
• our copy of the access tokens.

We also ask Google to revoke Confluo's access. That request is best effort, and we do not make it if the same Google account is still connected to another Confluo account (Google's access is per Google account, so revoking it would disconnect that account too). In every case our copy of the tokens is gone, and you can remove Confluo's access yourself at any time in your Google Account (Security → Your connections to third-party apps & services).

If you remove access in your Google Account instead of in Confluo, we stop reading your mail at the next check, delete our copy of the tokens and show the account as needing to be reconnected. What we had already derived from it is not deleted at that point. Action items, briefings and notification records age out on the schedule above; the account's address, our position in your mailbox and unsolicited-sender entries made from its items stay until you disconnect Gmail in Confluo or delete your account. To delete it at once, disconnect Gmail in Settings.

Deleting your account deletes everything above with the rest of your data (Section 10). Copies can remain in database backups for up to 35 days.

5. Other email accounts (IMAP)

Some providers, including Apple's iCloud Mail, offer no sign-in for mail apps. To connect one, you create an app-specific password with that provider and give it to Confluo. We store it encrypted under a key unique to your account (AWS Key Management Service). An app-specific password can do more than read mail (with Apple it can also send mail and reach other iCloud data, such as calendars); Confluo uses it only to read your inbox and sent mail over an encrypted connection, from the last 14 days when you connect and then new messages as they arrive. Confluo never marks messages as read, moves, deletes or sends mail. Message content is handled as in Section 3.

Disconnecting the account deletes at once, from our live database, the same as for Gmail (Section 4): every action item made from that account, including one since moved under another connected mailbox that received the same email (Section 10), the stored notifications about those items, and every check-in notification we sent while that account was connected (its counts include that account's items); the unsolicited-sender entries made from those items; every briefing composed while that account was connected, including the parts of it about your other accounts, because a briefing is a single summary across all of them; the record of which of its messages we have read, our position in the mailbox, and the account's address and the mail server you chose; and the password. Deleting your account deletes the password and everything else above. We cannot revoke an app-specific password at your provider; you can do that at any time (iCloud: account.apple.com → Sign-In and Security → App-Specific Passwords).

6. What we do NOT collect

We do not collect:

• Payment card details (Apple or Google Play takes your payment; we never see the number).
• Location beyond the timezone you provide.
• Advertising identifiers.
• Data from any account you have not connected.
• Contacts, calendars, or files from providers you have not connected. From Microsoft, we request only Mail.Read (for Outlook) and, if you choose Teams, Chat.Read and ChannelMessage.Read.All (for channels you choose). From Slack, we request only channels:history, groups:history, im:history, mpim:history and the identity scopes needed to render your name and workspace. From Google, we request only openid, email and gmail.readonly (Section 4). Over IMAP, we only read.

7. Sharing and processors

We use the following sub-processors:

Each sub-processor above processes your data only to provide its part of the service to us, under its terms with us, and provides data protection at least equivalent to that described in this policy. Microsoft, Slack, Google and your email provider are where your messages come from; we list them so the picture is complete.

We do not sell your personal data and we do not use it for advertising. We do not share it with anyone except the processors above, and only as needed to run the service. These are statements about how we run the business; they are commitments we are making to you, not something a reader can verify from the app.

8. Why we process this data (legal bases)

Under UK/EU GDPR our legal bases are: performance of a contract (providing the service you signed up for — connecting accounts, extracting items, delivering briefings and notifications); legitimate interests (service security, abuse prevention, diagnostics — balanced against your rights and using minimal data); and consent where required (for example push notifications, which you may withdraw at any time in system or app settings). For users in Singapore we comply with the Personal Data Protection Act (PDPA); for users elsewhere we apply the same standards globally.

9. Other people's data

Messages in your mailbox and channels inevitably mention other people. Confluo processes that content solely as your agent, to surface your action items, and retains only the fields described in Section 2 — which include a sender's name and email address, and can include their words inside a generated item. We never contact those individuals, never build profiles of them, and never use their data for any purpose beyond showing you your own briefing. If you are such a person and want data about you removed, contact us at the address below.

10. Retention

A cleanup job runs once a day and applies all of the following. Because it is daily rather than continuous, treat each figure as the point at which deletion begins, not a to-the-minute deadline.

• Action items: closed items (done or dismissed) are deleted 30 days after you close them; every item is deleted 90 days after it was created, whatever its state. You can delete items sooner in the app.
• Briefings: deleted 90 days after creation.
• Slack messages held for processing: deleted as the message is processed — usually within hours. Anything still held after 24 hours is deleted by the daily cleanup, so in practice a stuck message is gone within about two days (see Section 3).
• Message content sent to Anthropic: the copy sent to Anthropic is not stored by Confluo (Slack messages waiting to be processed are covered above); it is held by Anthropic only as needed to return the result and for the limited period permitted under its commercial API terms (currently deleted within 30 days, or kept for up to 2 years if flagged as violating Anthropic's usage policy), then deleted.
• Message-processing metadata (which messages we have already looked at): 90 days.
• Sender name and address caches: 90 days.
• Unsolicited-sender list: kept until you delete your account. Entries made from Gmail or other email (IMAP) items are also deleted when you disconnect the account they came from.
• Notification history: 30 days.
• Subscription records (plan, status, renewal or end date, cancellation date): kept while your account exists.
• Cancellation survey answers: kept until you delete your account.
• Sign-in codes sent by email: 30 days.
• Expired or revoked sign-in sessions: 30 days.
• Security audit records (sign-ins, consent acceptances, connection and deletion events — no message content): 365 days. We keep these longer than everything else because they are how we can tell you what happened to your account.
• Connection tokens and app-specific passwords: kept while the connection exists, and deleted when you disconnect it, when the provider tells us access has ended, or when you delete your account.
• Disconnecting an account: for Gmail, see Section 4; for other email, Section 5. When the same email is in two of your connected mailboxes (for example, one you sent from Gmail to your work Outlook), Confluo keeps a single action item, under the mailbox that received it. If that item was first made from your sent copy and then moved under the receiving mailbox, it still counts as made from the mailbox you sent from: disconnecting that Gmail or other email (IMAP) account deletes it. An item made from the receiving mailbox's own copy is not deleted when you disconnect the other mailbox. For Outlook, Teams and Slack, we delete our copy of the tokens (and ask Slack to revoke Confluo's access); action items already made from that account stay in your History until they age out above.
• Account: kept while your account exists. When you delete your account (Settings → Delete account) your items, briefings, processing metadata, unsolicited-sender list, any held messages, tokens and app-specific passwords, preferences, subscription records, cancellation survey answers and account record are deleted straight away. Your security audit records are not deleted with them — instead they are anonymised (your user ID, IP address and device string are erased from them) and the anonymous remainder ages out on the 365-day schedule above, so that a record of the deletion itself survives.
• Database backups: automated snapshots are retained for up to 35 days. Anything deleted above is gone from the live service immediately but can persist in a backup until that backup ages out.
• Operational logs: we set log retention to 30 days.

11. Where your data lives

Our servers and database run on Amazon Web Services in London, United Kingdom (eu-west-2). Data is encrypted in transit (TLS) and at rest, with OAuth tokens and app-specific passwords additionally protected by per-user envelope encryption using AWS Key Management Service.

Where a sub-processor processes data outside the UK/EEA (e.g. Anthropic, Expo and Google in the United States), transfers are protected by appropriate safeguards such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses as applicable.

12. Security

Encryption in transit (TLS) and at rest; per-user envelope encryption for OAuth tokens and app-specific passwords; least-privilege infrastructure access; logging written to exclude message content, with automated tests over the known fields; monitoring and alerting on processing failures. No system is perfectly secure, and Section 2 is honest about the limits of the logging claim. If a breach affecting your personal data occurs we will notify you and the relevant authority as required by law (within 72 hours where GDPR applies).

13. Your rights and controls

Directly in the app you can disconnect any account (what that deletes is in Section 10) and delete your account (Settings → Delete account, see Section 10). How to delete your account without the app is at confluoapp.com/delete-account.

You also have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent for a connection at any time. There is no self-service export button today; email us and we will send you a copy of your data. To exercise a right, or to complain about our processing, email privacy@confluoapp.com. We respond within one month. If you are dissatisfied with our response you may complain to your data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EU your local authority, in Singapore the PDPC.

14. Children

Confluo is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

15. Changes

We may update this policy. We will notify you in the app before a material change takes effect and, where required, ask you to re-accept the updated policy before continuing to use the service.

16. Contact

Velocity Consulting Group Pte Ltd — 77 Robinson Road, #16-00 Robinson 77, Singapore 068896 — privacy@confluoapp.com.