Skip to content

Privacy Policy for Spillway

Effective date: July 31, 2026
Status: Pre-alpha / invited testing

Privacy in plain language

Spillway does not automatically collect your email, App data, usage history, diagnostics, crash reports, or other information from your device. We do not operate a server that receives a copy of your mailbox or local App records, and we cannot remotely access them.

We have no current plans to build automatic collection of user data into Spillway. We promise not to add any feature that sends data to us—or to an additional service—without first explaining in clear, specific language what would be sent, where it would go, why it would be sent, and what choices you have. Nothing would be transmitted through such a feature unless you explicitly opt in.

A general acceptance of this privacy policy would never count as that opt-in. The choice would be presented when the specific feature is used. Where possible, you would be able to review and limit exactly what is included, and potentially sensitive information would be excluded by default.

Our design goal is stronger than ordinary disclosure: we aim to build Spillway so that potentially sensitive information never needs to reach a Spillway-operated server at all. Local processing, user-controlled storage, minimized diagnostics, and direct connections to services you deliberately choose are preferred over centralized collection.

Spillway may still send information directly to a service or recipient that you intentionally choose—for example, Gmail, Apple Calendar, a cloud AI provider, an email recipient, or a storage location you select—because that transmission is necessary for the function you requested. Those services are separate from Spillway and do not automatically give the Spillway operator access to the information.

Spillway is the working name of an email organization application currently developed and, in some builds, displayed as EmailSorter (the “App”). The App is independently developed and operated by Josh Pasek. It is not a University of Michigan service and is not endorsed, operated, or supported by Google, Apple, Ollama, OpenAI, Anthropic, or any other third-party provider.

This policy explains how the App accesses, uses, stores, and shares information. Because the App is in pre-alpha testing, its features and this policy may change. Material changes will be reflected by a new effective date.

1. Summary

The App is designed to be local-first:

  • Mail and App-created organization data are primarily stored on the user’s own device.
  • Google OAuth tokens, API keys, and similar credentials are stored using Apple Keychain.
  • The current App does not include any operator-controlled server, telemetry channel, crash-reporting channel, support-upload channel, or other mechanism that sends App data back to the operator.
  • The operator cannot remotely browse or retrieve a user’s device, Gmail account, Apple Keychain, local App database, local diagnostics, or local backups through the App.
  • The operator generally has access only to information a user deliberately sends to the operator outside ordinary App operation, such as an email, support request, or beta-feedback submission, plus ordinary records held by the public website host.
  • The App does not sell personal information, use Gmail data for advertising, or operate its own behavioral advertising or analytics system.
  • Users may choose local AI through Ollama or explicitly configure a cloud AI provider. Cloud AI use sends selected content directly to that provider, not to the App operator.
  • Users control whether the App performs supported Gmail changes such as labeling, marking read or unread, starring, archiving, moving messages to Trash, managing drafts, or sending mail.

2. Current technical limits and any future transmission

The current version cannot send App data back to the operator

The current App has no technical pathway for automatically returning Gmail content, App-created records, local diagnostics, usage information, crash reports, local backups, or other data from the user’s device to the operator.

Installing or using the App does not create a remote operator account, remote support session, hidden upload service, remote-administration capability, or operator-accessible copy of the user’s local data. A legal request, support request, or software update cannot create access that the App does not technically provide.

The user may still direct information to third parties through features they intentionally configure or use—for example, Google, Apple, a cloud AI provider, an outbound email recipient, or a user-selected storage location. Those transmissions do not provide the same information to the operator unless the user separately sends it to the operator.

Any future operator-accessible or service-accessible transmission would require explicit confirmation

If a future version adds an optional feature that could transmit data to the operator or to any additional service—for example, optional crash reporting, diagnostic upload, hosted sync, support upload, or a bug-report submission—the feature must not silently begin sending information merely because the App was updated or opened.

Before the first such transmission, the App would present a clear, specific, just-in-time explanation stating:

  • what feature is requesting the transmission;
  • which destination would receive the information;
  • why the information would be transmitted;
  • what categories of information could be included;
  • whether potentially sensitive message content, identifiers, filenames, account information, diagnostics, or other records could be included;
  • whether the information would be retained and, if known, for how long; and
  • how the user can decline, limit, review, or later disable the transmission.

The user would need to affirmatively confirm that they understand and choose that transmission. A general acceptance of this privacy policy would not substitute for that feature-specific confirmation.

Where technically possible, the user would be given granular choices over what is included—for example, metadata only, sanitized diagnostics, selected logs, a user-reviewed attachment, or no submission. A future bug-report or support-upload flow should show the user what will be sent before sending and should exclude message bodies, attachments, credentials, personal names, addresses, identifiers, and other potentially sensitive material by default unless the user deliberately selects or includes them.

Privacy-preserving design goal

The project’s goal is to develop the App so that potentially sensitive user information does not need to be sent to an operator-controlled server at all. Local processing, user-controlled storage, minimized data, privacy-safe structural diagnostics, and direct user-to-provider connections are preferred over centralized collection.

This is a design goal, not a claim that no information can ever leave the device. Users may intentionally use Google, Apple, cloud AI, outbound email, or other third-party services, and those services receive information necessary for the requested function. Any future departure from the current no-return-channel architecture would require both an updated policy and the explicit feature-specific confirmation described above.

3. Information the App accesses

Google account and Gmail data

When a user connects a Google account, the App running on that user’s device may access:

  • the account’s email address and basic account identity;
  • messages and threads, including senders, recipients, subject lines, headers, snippets, message bodies, dates, labels, and read/star/archive/Trash state;
  • attachments or attachment metadata when needed to display, analyze, download, draft, or send them;
  • Inbox, Sent, Draft, and related Gmail state needed for App features; and
  • provider identifiers needed to reconcile messages, threads, drafts, and user-directed actions.

This access occurs through the App on the user’s device. It does not give the operator independent access to the user’s Gmail account or mailbox. The App requests Gmail permissions needed to read and organize mail and to perform user-controlled Gmail actions. The exact permissions appear on Google’s consent screen.

App-created data

The App creates local data such as:

  • categories and category hierarchy;
  • classifications, summaries, extracted requests, dates, opportunities, and other AI-derived information;
  • user corrections, filing decisions, workflow status, sender preferences, and Work Ledger items;
  • drafts, Outbox state, templates, and links to supporting messages;
  • settings, connection status, and limited operational metadata; and
  • local backups and recovery records when those features are used.

These records are ordinarily stored on the user’s device or in a storage or sync location the user separately chooses. The operator does not have routine access to them.

Credentials

OAuth tokens, AI-provider API keys, and client secrets are stored in Apple Keychain where supported. They are not intentionally included in ordinary data files, backups, diagnostics, or the source repository. The operator cannot retrieve a user’s Keychain contents through the App.

Information a user submits directly

If a user contacts the operator or submits beta feedback, the operator receives the information the user chooses to provide. This is the principal category of user-specific App information the operator can actually possess. Users should not submit email bodies, credentials, student/patient/client information, private links, or other sensitive content unless they have deliberately decided that the operator should receive it. Feedback may be stored using the communication or form provider used for the submission.

Website information

Visiting the App’s public web pages may cause the website host to receive ordinary request information such as IP address, browser type, requested page, and time of access. The App does not combine ordinary website logs with Gmail content. Any cookies or measurements present on the broader joshpasek.com website are governed by that site’s configuration and hosting providers.

4. How information is used

Google user data and App-created data are used by the App on the user’s device only to provide or improve user-facing App functions, including:

  • displaying, searching, threading, and organizing mail;
  • classifying messages and extracting possible requests, commitments, dates, and opportunities;
  • learning from the user’s corrections on that user’s device;
  • performing actions the user initiates or enables;
  • creating, editing, scheduling, and sending drafts or messages;
  • supporting Calendar and Reminders actions the user reviews and confirms;
  • preventing duplication, recovering from interrupted operations, and protecting local data; and
  • diagnosing errors using local, minimized diagnostics.

Information voluntarily sent to the operator is used to respond to support, feedback, security, or privacy requests.

The operator does not use Google user data to create advertising profiles, sell data, determine creditworthiness, or train a general-purpose AI model.

5. Local and cloud AI

Ollama or another configured local endpoint

When the user selects Ollama at a local address, inference requests are sent to the Ollama service configured by the user, normally on the same Mac. The operator does not receive those requests. A user who changes the endpoint to another computer or hosted service is directing data to that endpoint and is responsible for its security and policies.

Cloud AI providers

The user may explicitly configure OpenAI, Anthropic, or Google Gemini. When a cloud provider is enabled, the App sends selected message content and task instructions directly to that provider to perform the requested classification or extraction. The App shows a privacy acknowledgement before cloud AI is enabled.

The operator does not receive that content merely because the user selected a cloud AI provider. The operator also does not control a provider’s infrastructure or retention practices. The provider’s terms, privacy policy, account type, and data controls apply. Users should not enable cloud processing for information their employer, institution, client, or law does not permit them to send to that provider.

6. When information is shared

The App does not sell or rent personal information. Information may leave the device only in circumstances such as:

  • Google: to authenticate the user and read or modify Gmail as necessary for requested App functions;
  • User-selected AI providers: when the user enables cloud AI or configures a nonlocal inference endpoint;
  • Apple Calendar or Reminders: when the user asks the App to create or work with an item and grants the relevant system permission;
  • User-selected storage or sync locations: when the user enables a backup, export, or experimental folder-sync feature;
  • Outbound recipients and Gmail: when the user sends, schedules, or saves a draft; or
  • Support/feedback services: when the user deliberately submits information outside ordinary App operation.

These transmissions go to the selected service or recipient. They do not make the transmitted information available to the App operator unless the user separately sends it to the operator or the operator independently controls the receiving service.

The App’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

The operator can disclose only information the operator actually possesses or controls. That may include support correspondence, beta feedback, privacy requests, security reports, and ordinary website-host records available to the operator.

The operator does not have an App-operated copy of users’ Gmail content and cannot use the App to remotely access or retrieve a user’s:

  • device or files;
  • Gmail account or mailbox;
  • Apple Keychain credentials;
  • local App database;
  • local diagnostics or recovery snapshots; or
  • backups, exports, or sync folders controlled by the user or a third-party provider.

A subpoena, court order, or other legal request directed to the operator cannot create technical access the operator does not otherwise have. If legally required, the operator may disclose information actually in the operator’s possession, but cannot provide locally stored or third-party-held data that the operator does not possess or control. Google, Apple, an AI provider, a website host, or another third party may separately receive legal requests for data that it holds under its own systems and policies.

Human access to Gmail content by the operator is not part of App operation. The operator may see Gmail or other sensitive content only when a user deliberately sends that content to the operator, for example in a support message or a future user-confirmed diagnostic submission.

7. Storage and retention

Mail caches, App-created organization data, and settings are stored on the user’s device. Some files may contain sensitive message content in readable form. Users are responsible for protecting the device, operating-system account, and any copies or backups.

The App may create local recovery snapshots. Credentials are excluded. Cached message content is excluded from portable backups by default; if a user chooses to include it, the resulting backup may contain plaintext sensitive content.

Local data remains until it is removed through App controls, deleted by the user, removed with the App’s data container, or otherwise cleared by the operating system. Disconnecting Google access does not necessarily delete local backups or exported copies. Users should remove those separately.

Third-party providers retain data under their own policies. Deleting local App data does not delete source mail from Gmail unless the user separately performs a Gmail deletion action.

8. User choices and deletion

Users may:

  • decline or revoke Google access;
  • choose local AI, cloud AI, or no AI classification;
  • disable supported Gmail write-back controls;
  • remove connected accounts and local data using available App controls;
  • delete local backups and exported files; and
  • ask the operator to delete support or beta-feedback information associated with them, subject to legal or security retention needs.

Because the operator does not possess ordinary local App data or Gmail content, deletion requests sent to the operator ordinarily apply only to information the user directly submitted to the operator or that the operator otherwise actually holds.

Google access can be reviewed or revoked from the user’s Google Account security settings. Revoking access prevents new API access but does not itself remove local files or backups already created by the App.

9. Security

The App uses measures such as Apple Keychain for credentials, PKCE for supported OAuth flows, atomic local writes, validated recovery snapshots, and minimized diagnostics. No software or storage method is perfectly secure. The App remains pre-alpha software and should not be treated as institutionally approved or as satisfying FERPA, HIPAA, IRB, records-retention, or other legal requirements without an independent review.

10. Children

The App is intended for adults and is not directed to children under 13. The operator does not knowingly collect children’s personal information through an App-operated service.

11. International use

Users who access third-party services or cloud AI may cause information to be processed in countries other than their own. Those providers’ terms and privacy notices govern their processing.

12. Changes to this policy

This policy may be updated as the App changes. The updated policy will show a revised effective date. If a change materially expands how Gmail data is used or shared, users will be given appropriate notice or choice before the new use applies. Any future feature that creates a new operator-accessible or service-accessible transmission would also require the feature-specific confirmation described in Section 2 before transmission.

13. Contact

Questions, privacy requests, deletion requests, and security concerns may be sent to software@joshpasek.com.