Privacy

Gmail stays canonical. Skim turns selected mail into a finite card deck, and is explicit about where that work happens.

Effective 30 July 2026

Current rollout: the public owner/test preview still scans Gmail in the browser. A server-assisted sync and derived-card plane is deployed behind disabled rollout flags and is not yet the primary deck.

What Skim accesses

After you connect Google, Skim can read Gmail messages and labels, create and update labels in the Skim/* namespace, and store Skim-created state in Google Drive. The current scopes and their purpose are listed in the product guide. Skim does not delete Gmail messages.

Where processing happens

• Browser: the current preview fetches recent inbox and sent mail, builds the opening deck, and keeps access credentials in this browser’s encrypted local vault.
• Skim’s Cloudflare Worker: exchanges and refreshes Google tokens for the browser and serves the app. Its revision-002 server plane can keep encrypted refresh credentials and reproducible derived state when that rollout is enabled.
• Cloud classifier: in the current owner/test preview, selected personal message text is money-redacted before it is sent through Skim’s Worker to DeepSeek for classification. AI-derived cards are visibly badged. DeepSeek documents provider-side context caching; this path is blocked from public personal-message background processing until acceptable contractual retention and no-training controls exist.

What can be stored

The current preview stores card mappings, feedback, and AI classification results in Google Drive app data; swipe actions also become Gmail labels. This browser keeps account connection data, settings, and temporary caches.

The new server plane is designed to store only encrypted credentials and derived state: pseudonymous account keys, Gmail source IDs, thread direction and label state, semantic booleans, confidence, evidence offsets, cards, actions, and content-free sync measurements. Its database and queues have no raw message-body, raw subject, attachment, or model-input/output field.

Operational logs

Automatic request-URL invocation logs are disabled. Skim retains only custom Worker records restricted to content-free operational fields such as operation, status, count, duration, and retry attempt. Its logging contract rejects fields named for message content, subjects, senders, email addresses, tokens, secrets, or prompts.

Retention and deletion

• Gmail messages and labels remain in your Google account until you change them there.
• Google Drive app data remains under your Google connection and Google’s retention behavior.
• Current “Sign out” disconnects accounts and clears the local credential vault on that device; it does not delete Gmail or user-visible Drive files.
• When the server account plane is enabled, server disconnect first stops the Gmail watch and revokes the Google token, then deletes the credential envelope, sessions, derived facts, cards, actions, and account state. Only a pseudonymous, content-free deletion receipt remains.
• Expired server sessions are removed automatically; personal cards and facts older than the 30-day derivation horizon are superseded.

Your choices

You can use preview mode without a Google account, revoke Skim from your Google Account permissions, remove Skim-created Drive data through Google, and clear site data in your browser. The developer-only quality-review export is an explicit local download: it contains private sender, subject, and snippet context, is never uploaded to Skim, and should be kept only in the gitignored private-corpus/ workflow. For an access or deletion request, use the operator contact shown on the Google OAuth consent screen through which you received access.

Changes

This notice will be updated before the server deck or a new inference provider becomes primary. Material changes to content processing, retention, or deletion will not be hidden behind unchanged copy.