Privacy Policy

How we protect your data

Security procedures are in place to protect the confidentiality, integrity, and availability of your data, including Google user data. We use encryption to protect your information — both in transit and at rest. Access to it is restricted to what is necessary to run the service, and we hold it no longer than we need it.

These safeguards apply to all of the sensitive data we handle: the Google user data we receive (the OAuth tokens that let Camoji send your mail, and your name, email address, and profile picture), your sign-in credentials, and the contact details you store in Camoji. The rest of this section sets out the specific mechanisms. Each one is implemented today, not aspirational.

Encryption in transit

• Every connection to Camoji — the web app at camoji.io and the API at api.camoji.io — is served over HTTPS (TLS). We do not serve the application over unencrypted HTTP.
• We send HTTP Strict Transport Security with a one-year lifetime, covering all subdomains and submitted to the browser preload list, so browsers refuse to contact us over an insecure connection even on a first visit.
• Traffic between our servers and our database, our file storage, and Google's APIs is TLS-encrypted on every request. Your Google OAuth tokens and the messages you send never travel over an unencrypted channel.

Encryption at rest

• OAuth tokens get a second layer. The Google token Camoji uses to send your mail is encrypted individually with AES-256-GCM authenticated encryption before it is written to the database. The key lives in an isolated secret store, never in our source code, and the stored value carries a key-version marker so keys can be rotated. A copy of our database on its own does not yield a usable token.
• Everything stored is encrypted at rest by the infrastructure underneath it: our database provider and our file and cache storage encrypt all data at rest as standard.
• Files you upload (business-card photos, form attachments) are stored in that encrypted storage under randomly generated, unguessable keys, and the storage is not publicly listable. No Google user data is ever written to file storage.

Credentials, secrets, and sessions

• We never store your password. Passwords are kept only as salted PBKDF2-SHA256 hashes with a random per-user salt, in a versioned format so the hashing can be strengthened over time without ever handling the original password.
• Session cookies are HttpOnly (scripts on the page cannot read them), Secure (sent only over HTTPS), and SameSite-restricted to defend against cross-site request forgery. We cap concurrent sessions per device and revoke older ones automatically.
• Changing your password requires a one-time code sent to your email, and those requests are rate-limited to block guessing.
• All API keys, provider credentials, and our encryption key are held in an encrypted secret store — none are present in our source code or in any client-side bundle. Development and production run on entirely separate databases and separate credentials, so test activity can never touch real user data.

Access control and least privilege

• We request the least we can. Our only Gmail permission is the write-only gmail.send scope. Because we hold no read permission, your mailbox content never enters our systems at all — the most effective protection available for data we simply never receive.
• Every API request is authenticated, and every database query is scoped to your own organisation, so one customer's data is not reachable from another's session. Shared campaigns use per-collaborator permissions granted deliberately per area, not blanket access.
• Human access to Google user data is restricted to the four narrow cases listed under Google user data & Gmail below. Administrative access to production systems is limited to a small number of named people, each using an individual account secured with two-factor authentication. There are no shared logins.
• You can withdraw our access at any time — disconnect in Settings and we revoke the token with Google and delete it from our systems immediately.

Limiting what leaves our systems

• Before any text is sent to an AI provider, an automated redaction layer masks email addresses, phone numbers, and credential-like strings. It runs at the boundary itself, so it cannot be bypassed by an individual feature.
• No data obtained through Google APIs is sent to any AI provider, and your Google profile name is never placed in an AI prompt. This is enforced in the code rather than by policy: our prompt builders cannot accept a user identity at all. See AI features and AI providers.
• Error and crash reports are recorded without Google user data, message content, or OAuth tokens, and no Google user data appears in analytics.

Monitoring and secure development

• Sign-in, upload, messaging, and public form endpoints are rate-limited to contain credential-guessing and abuse.
• Uploaded files are validated by inspecting the actual file signature, not the file name or the type the browser claims, and anything unrecognised is rejected.
• Changes are peer-reviewed and must pass an automated test suite before release, including tests that specifically assert these privacy guarantees — that no user identity reaches an AI prompt, and that our model-training opt-out is sent on every request. A change that breaks a guarantee fails the build.
• We keep dependencies patched and run automated linting and type checking on every change.

If something goes wrong: incident response

If we become aware of a security incident affecting your personal data, we will investigate immediately, revoke and rotate the affected credentials and OAuth tokens, and notify affected users and any applicable supervisory authority without undue delay — and within 72 hours of becoming aware, where notification is required. Notification will describe what happened, what data was involved, and what you should do.

Reporting a security problem. If you believe you have found a vulnerability in Camoji, please email teamcamoji@gmail.com. We aim to acknowledge security reports within three business days, and we will not pursue action against researchers who report in good faith and do not access other people's data.

Keeping data only as long as needed

Data you no longer need is not data we should be protecting. Disconnecting Gmail revokes and deletes the stored tokens immediately, and account deletion removes your personal data — including any stored Google user data — within 30 days. Full detail is in Data retention & deleting your account.

Google user data & Gmail

What we request, and why

If you choose to connect your Google account, Camoji requests only these permissions, and each one exists solely to power a feature that is visible to you in the Camoji interface:

• gmail.send — so Camoji can send the follow-ups and campaign messages you compose and approve inside Camoji, from your own address. Nothing is sent without your action. This scope is write-only: it permits sending a message and nothing else. It grants no ability to read, list, search, or download anything from your mailbox, so no message, thread, attachment, or label ever reaches our servers through it.
• openid, email, profile — your name, email address, and profile picture, used to create your account, sign you in, and show who you are in the app.

Camoji never requests read access to your mailbox. We cannot and do not read your inbox, your Google Contacts, your Calendar, or your Drive files.

How we use Google user data

We use Google user data only to provide and improve the user-facing features described above — delivering the email you asked Camoji to send, and authenticating you. That is the complete list of purposes.

We do not use Google user data for any of the following:

• advertising, retargeting, or personalised or interest-based ads;
• product analytics, usage measurement, market research, or profiling;
• developing, improving, or training generalised or non-personalised AI or machine-learning models;
• determining credit-worthiness or for lending purposes;
• selling, renting, or licensing it to anyone; or
• any purpose unrelated to the feature you enabled it for.

Storage and sharing

• Storage — the OAuth tokens Google issues are encrypted with AES-256-GCM before being stored, and are used solely to send the messages you initiate. We do not store any of your mailbox content. See How we protect your data for the full set of safeguards.
• Transfers — we do not transfer Google user data to third parties, except to Google's own APIs as required to deliver your email, and where necessary to comply with applicable law or as part of a merger or acquisition in which the receiving party continues to honour this policy.
• Human access — we do not allow humans to read Google user data unless (a) we have your affirmative agreement for specific messages, (b) it is necessary for security purposes such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data is aggregated and de-identified and used for internal operations.
• Revoking access — disconnect Gmail in Settings (we revoke and delete the stored tokens) or via your Google Account permissions page at any time.

Limited Use

Camoji's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. This applies to raw, aggregated, de-identified, and derived data alike. In particular, we do not use, transfer, or sell such data to create, train, fine-tune, or improve any foundational or generalised artificial-intelligence or machine-learning model, whether our own or a third party's.

AI features and AI providers

Camoji offers optional AI assistance — drafting and rewriting messages, reading business cards you scan, transcribing voice notes you record, and interpreting event floor plans you upload. These features operate only on content you create inside Camoji: the draft you are writing, the contact details you entered, and the images or audio you chose to upload. That content is sent to a provider to produce the result you asked for, on the terms set out below.

The AI providers we use, and on what terms

We are specific about this rather than general, including where the terms are less protective than we would like:

• Amazon Web Services — writing and rewriting assistance. Used on a paid account. AWS does not use inputs or outputs to train any model, and does not share them with the model provider.
• OpenRouter — writing assistance and reading text from images you upload. Used on a paid account. Model training is disabled on our account, and every request Camoji sends additionally instructs the service to route only to providers that do not retain or train on it.
• Google Cloud Vision — reading text from business cards and floor plans you photograph. Used on a paid account. Google does not use this content to train its models.
• Google Gemini — voice-note transcription and message classification. This one is currently used on Google's free tier, and under Google's terms for that tier Google may use the content submitted to it to improve its models. We are telling you rather than glossing over it. Note that no Google Workspace data can reach this path — as above, we hold none.
• ElevenLabs — speech-to-text and text-to-speech in the optional voice assistant, on the Starter plan. It receives only what you say to that assistant. Under ElevenLabs' terms, content submitted to it may be used to improve their models; their zero-retention option is available only to enterprise customers. As with Gemini, no Google Workspace data can reach this path.

Self-hosted and offline models

Some steps of our business-card scanning run on models we host and operate ourselves, in a strictly self-hosted, offline capacity inside our own isolated infrastructure. The data they process is processed locally on our own servers and is never transmitted to any outside model provider through an API, for training or for any secondary purpose. No third party receives your image or the text extracted from it at this step.

Google user data is likewise processed locally and is never shared with any model provider for training or secondary purposes. In practice no Google user data reaches these models at all, for the reason given above: our only Workspace permission is write-only, so we hold no Workspace or Photos data to feed them.

That is the complete list of AI providers. If we add or change one, this list is updated before the change ships. A more detailed breakdown is available on request.

Data retention & deleting your account

We keep your account data (your profile, contacts, forms, campaigns, and the messages you create) for as long as your account is active, so the service works when you return. We retain it only as long as needed to provide Camoji, or longer where the law requires.

• Disconnect Gmail — do this any time in Settings. We immediately revoke the OAuth tokens with Google and delete them from our systems.
• Delete your account & data — email teamcamoji@gmail.com and we will delete your account and all associated personal data, including any stored Google user data, within 30 days (except where we are legally required to retain it).

Changes to this policy

We keep this policy current. When it changes we update the Last updated date at the top, and we keep the policy at this same address so any link to it stays valid.

If we materially change how Camoji uses Google user data, we will notify you — in the app and by email to your account address — before the change takes effect, and where the change requires it we will ask for your consent again rather than assuming it. You can always disconnect Google access in Settings or from your Google Account permissions page.

Questions about this policy, or about the data we hold on you? Email teamcamoji@gmail.com.