Swoop Mail

Privacy Policy

Last updated October 15, 2026

Swoop Mail ("Swoop") helps you sort and clean your Gmail inbox. This policy explains what Swoop accesses, what it stores, who it shares data with, and what it never does.

What Swoop accesses

With your permission, Swoop uses Google's gmail.modify scope to read and organize your inbox. It requests only these headers of each email: From, To, Cc, Subject, Date, List-Unsubscribe, List-Unsubscribe-Post, List-Id, Precedence and Auto-Submitted, plus the email's Gmail labels and size. To and Cc are read only to count recipients; the addresses are not stored. Swoop also reads the senders of recent emails in your own labels, to learn where you file mail.

Swoop changes labels only when you ask it to, or when you turn on Autopilot: archiving, applying one of your labels, or moving mail to Gmail's trash. Swoop never requests message bodies or attachments, never sends email, and cannot permanently delete anything.

What Swoop stores

  • Your Google account id, email address and name.
  • For each inbox email: sender, subject, date, size, labels, recipient count and unsubscribe links, plus Swoop's own sorting (category, how likely it needs you, suggested label).
  • A history of the actions you or Autopilot took, so they can be undone.
  • Which of your labels each sender's mail tends to go to.
  • Your settings, and senders you've blocked.

How long Swoop keeps it

Swoop forgets an email 30 days after it leaves your inbox. Your account, settings and what Swoop has learned are kept until you delete your account. Sign-in sessions expire on their own.

How your data is used

Only to provide Swoop's features to you: sorting your inbox, suggesting what to clean, carrying out the actions you choose, and showing your history and stats. Swoop does not sell your data, does not use it for advertising, and does not use it to build profiles for anyone else.

To sort a new email, Swoop sends Jev, TypeSafe AI's reasoning model, the sender's name and address, the subject, the date, the recipient count, whether it looks automated and has an unsubscribe link, and the names of your Gmail labels (so Jev can suggest one). Jev never receives your own email address or any message body. TypeSafe processes this only to return a result to Swoop and states that it does not train its models on this input.

When you choose to unsubscribe from a sender, Swoop sends a one-click unsubscribe request to the address that sender provided in its List-Unsubscribe header. Swoop only uses secure (https) addresses and never contacts private or internal ones.

Google API Services User Data Policy

Swoop's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Swoop uses Gmail data only to provide and improve the features you can see in Swoop.
  • Swoop transfers Gmail data to others only as needed to provide those features (the service providers below), for security, to comply with the law, or as part of a merger or sale with your consent.
  • Swoop never uses Gmail data for advertising, including retargeting.
  • No person at Swoop reads your email data, unless you ask us to for support and give your permission, it's needed for security (such as investigating abuse), or the law requires it.
  • Swoop does not use Gmail data to develop, improve or train generalized AI or machine learning models.

Analytics

Swoop counts visits to this site and steps like signing up or upgrading as anonymous daily totals, in its own database. There are no cookies, no third-party analytics and no advertising trackers. To count a visitor once a day, Swoop keeps a hash of the visitor's network address and browser that includes the date, so it can't identify you or follow you from one day to the next, and it's discarded after two days.

Service providers

  • Google: Gmail API, sign-in, and Pub/Sub notifications of new mail
  • TypeSafe AI: Jev, which sorts email from the headers above
  • Neon: database hosting
  • Railway: application hosting and the job queue
  • Stripe: payments for the paid plan. Stripe gets your email address for receipts, never any Gmail data
  • Cloudflare: domain, network security and delivery

Security

Senders, subjects, unsubscribe links, your address, your name and your Google tokens are encrypted in our database (AES-256-GCM). All traffic uses HTTPS. Sessions are random tokens stored only as hashes, and Swoop's logs record ids and counts, never email content.

Deleting your data

In Settings, "Disconnect and delete everything" revokes Swoop's access to your Google account and permanently deletes everything Swoop stores about you. Your mail in Gmail isn't touched. You can also revoke Swoop's access any time from your Google Account's security settings, or email us and we'll delete your data.

Children

Swoop is not meant for children under 13 and does not knowingly collect their data.

Changes

If this policy changes in a way that matters, we'll update the date above and tell you in the app before the change applies to your data.

Contact

Privacy questions or data requests: [email protected]. Anything else: [email protected].