Privacy Policy

Whisk is a fast, keyboard-driven email client for Gmail, available at whisk.email and as an iOS app. It is made by Ashot Petrosian ("we"). This policy explains what data Whisk touches, why, and how you stay in control of it.

What Whisk accesses

When you connect a Google account, Whisk asks Google for permission to:

• Read, send, and organize your Gmail (gmail.modify). This is what makes Whisk a mail client: it shows your threads, lets you reply and compose, and archives, labels, stars, snoozes, and trashes messages when you ask it to. Whisk never permanently deletes mail on its own.
• Your email address and basic profile (userinfo.email, userinfo.profile). Used to label the account in the app and to sign you in.

What Whisk stores, and where

Whisk is local-first. Your mailbox is kept on your device so the app renders instantly and works offline. To keep several devices in sync and to fetch changes while the app is closed, Whisk also keeps a mirror of your recent mail on our servers, hosted on Convex in the United States.

That mirror holds:

• Thread and message metadata, bodies, and label assignments.
• Attachment metadata (name, type, size). Attachment contents are fetched from Gmail when you open them and are not stored by us.
• Drafts you write in Whisk, and messages queued to send.
• The OAuth tokens Google issues, so Whisk can sync on your behalf. Login sessions are stored as one-way hashes.

Data is encrypted in transit (TLS) and at rest by our hosting provider. Access to the servers is limited to the developer.

How Whisk uses your data

Only to provide the mail client to you: showing your inbox, searching it, sending what you write, and syncing your actions back to Gmail. Concretely, Whisk does not:

• Sell your data, or share it with third parties for their purposes.
• Use your mail for advertising, or to build profiles for advertising.
• Use your mail to train machine learning or AI models, whether ours or anyone else's.
• Let humans read your mail, except when you explicitly ask us to help with a problem, when required by law, or for security reasons such as investigating abuse.

Sharing

Whisk sends your data only to the services required to run the app: Google (the source of your mail) and Convex (our hosting). Neither is allowed to use it for anything other than providing that service to us. There are no analytics or advertising trackers in Whisk.

Retention and deletion

We keep the server mirror while your account is connected. You can stop Whisk's access at any time from your Google account at myaccount.google.com/permissions; once access is revoked, Whisk can no longer read or change your mail. To have your mirrored data and tokens deleted from our servers, email ashot@almostcandid.com from the connected address and we will remove them within 30 days. Data on your own device is removed when you sign out or uninstall the app.

Children

Whisk is not directed at children under 13 and does not knowingly collect their data.

Changes

If this policy changes in a way that matters, we will update the date above and, for material changes, tell you inside the app.

Contact

Questions about privacy: ashot@almostcandid.com.