We can't read your email.
Architecture, not a promise.
Your email is encrypted in your browser before it reaches our servers. Personal data is stripped before any AI sees it. And nothing sends without your approval.
Three guarantees, built into the system.
Not policies we could quietly change — properties of how the product is put together.
Encrypted before it leaves you
Records, tokens and cache are encrypted with AES-256 at rest and in transit. Your decryption keys live in your browser and never reach our servers. Email content is processed in memory, not warehoused.
Never used for training
Your email is never used to train AI models — not ours, not our providers', not anyone's. What the AI reads to finish a task stays in that task.
Google OAuth, revocable
Maily connects to Gmail through Google's OAuth. We hold no password, we ask only for the scopes we use, and you can revoke access from your Google account in one click.
Three permissions. No more.
Exactly what the Google consent screen shows you — and why each one is there.
Read your mail
So it can triage what arrives and draft replies in context. Reading is where the work starts.
Label & organise
So it can archive, label and file — the tidying you'd otherwise do by hand. It cannot permanently delete on its own.
Send the replies you approve
So an approved draft actually goes out. Nothing sends without your say-so.
We never request access to Drive, Contacts, or the rest of your Google account.
What people ask before they trust us.
No hedging. If a question isn't here, the answer is one email away.
Can Maily read my email?
Stored data is encrypted into blobs we cannot read — the keys live in your browser. To do a task you ask for, like drafting a reply, the AI reads the relevant message in memory for that task only. It is never warehoused and never used to train a model.
What exactly can it access?
Only the three Google permissions listed above — read, organise, and send. Nothing else in your Google account: not Drive, not Contacts, not your password.
Do you sell my data?
Never. Your email content and identity are not sold to advertisers, data brokers, or anyone. We also set no advertising or cross-site tracking cookies.
What happens if I delete my account?
Your personal data is deleted or anonymised within 30 days, except where the law requires us to keep a record. Revoking Maily's Google access takes one click in your Google account and cuts off inbox access immediately.
Who else touches my data?
Only the vendors needed to run the service — cloud hosting, the payment processor, the AI model providers, and the email sender — each under a data-processing agreement that forbids using your data for their own purposes. Never for advertising or profiling.
Nothing sends without me, right?
Right. Every reply is a draft until you approve it. The agent proposes; you decide. There is no mode where it emails people on your behalf without a review step.
The full picture, in your own time.
The architecture, the policies, and the switch that's always yours to flip.
Every claim here is verifiable in how the product behaves: encryption happens in your browser, drafts wait for your approval, and revoking access takes one click in your Google account.
Security questions? Email support.maily@gmail.com — you'll get an answer from the person who wrote the code.