Privacy Policy

Last updated: October 17, 2026

Triage ("we," "us," "our") turns the emails that need your attention into a to-do list. It's available through the Triage mobile apps and is operated by Smartsby, LLC. This policy covers the apps and our website, triage.rest, and explains what information we collect, how we use and protect it, and the choices you have.

Information we collect

Account information. When you sign in (with Apple, Google, Microsoft, or an email address and password), we store your email address, a unique identifier for your account, and the workspace your tasks belong to.

Connected mailboxes. You can connect one or more mailboxes. For each one we store its email address and the provider's account identifier, an access token that lets Triage keep reading new mail (encrypted, see "How we protect your data"), and bookkeeping that lets us fetch only mail that arrived since the last check.

• Gmail: we ask Google for read-only access (Google's gmail.readonly scope) plus your Gmail address.
• Outlook and Microsoft 365: we ask Microsoft for read-only access to your mail (Mail.Read) and your calendar (Calendars.Read, for the Today view), your basic profile (User.Read, for your address) and permission to keep access while you're away (offline_access). Microsoft notifies us when new mail arrives through a subscription we register for that mailbox. Microsoft issues a new access token from time to time; we store the newest one, encrypted, in place of the old.
• Fastmail: Fastmail doesn't offer read-only permissions, so we ask for its mail and calendars permissions, on one consent screen. Triage only ever reads with them: it never sends, deletes, moves or changes your email or calendar events. Fastmail also issues new access tokens over time; we keep only the newest one, encrypted.

Calendars (the Today view). Today shows your day's events next to your tasks, from Google Calendar (read-only, Google's calendar.events.readonly scope, asked for only when you add your Google calendar), Outlook or Fastmail. Triage reads only your main calendar (your primary or default one), fetching that day's events when you open Today and showing them to you. Events pass through our servers only to reach your device; they are not stored or logged.

What Triage reads. Triage reads new messages in your inbox (sender, subject, date and message text) to decide which ones need your attention. Messages are read when they arrive; we don't keep their full text.

Reading an email in Triage. When you open a task's email in the app, Triage fetches that one message from your mail provider at that moment and shows it to you. The message passes through our servers only to reach your device. It isn't stored or logged. Images hosted by the sender are off until you tap Show images; when you do, your device loads them straight from the sender's servers, which can tell the sender that the email was opened, just as in any mail app.

What Triage stores, per task. For each message that becomes a task: the sender's name and email address, the sender's domain, the subject, the short preview your mail provider gives for the message (up to about 250 characters), a link to open the message in your mail app, and the task's status and dates. When you act on a task (for example, Ignore or Snooze), we record that action with a copy of the task's sender and subject, so Triage can learn which senders matter to you. All of these email-derived fields are stored encrypted. To recognize a sender you've seen before without storing their address in readable form, we also store a keyed fingerprint of it that can't be reversed and can't be matched across workspaces. Rules you set for a sender or domain (for example, always allow or always ignore), and any name or note you give them, are stored encrypted the same way.

How Triage decides what needs you

Most messages are sorted by rules and by your own history with the sender: for example, how often you've acted on that sender's emails before. These steps run entirely on our servers.

AI-assisted triage (optional, off by default). For messages the rules and history can't sort confidently, and only if AI-assisted triage is turned on for your workspace, Triage sends that one message's sender name and address, subject, the first 4,000 characters of its text, and a count of your prior messages from that sender to Google's Gemini API (a paid, commercial service) to suggest how to sort it. Each request is independent; no conversation or profile is kept between requests. Your email is never used to train AI models: not by us, and not by Google, whose terms for the paid Gemini API don't allow it. Google may keep requests for a limited period to detect abuse, under those terms. When AI-assisted triage is off, those messages are simply left for you to review.

Triage mobile apps

The apps show the tasks Triage found for you and let you act on them (ignore, snooze, schedule), connect or disconnect mailboxes, and open a task's email. They use the same account and data described above and don't collect anything beyond it.

• Sign-in. Sign-in is handled by Firebase Authentication (provided by Google), together with Sign in with Apple, Google Sign-In or Microsoft if you choose one of those. They process your email address, account identifier, your name if the sign-in provider shares it (Google and Microsoft do), and the technical information needed to sign you in, such as your IP address.
• Connecting a mailbox. Connecting opens your provider's own consent screen (Google, Microsoft or Fastmail) in a secure system sign-in window. We never see your email password.
• Subscriptions. Paid plans are bought through the App Store or Google Play, which handle payment; we never see your card details. RevenueCat keeps track of which plan your workspace has: it receives an identifier for your workspace (not your name or email) and the purchase details the store provides.
• On your device. Firebase Authentication keeps your signed-in session on your device (in the iOS Keychain, or in the app's private storage on Android) so you don't have to sign in every time. Signing out ends that session.
• Communication with our servers. The app retrieves your tasks and sends your actions to our servers over an encrypted (HTTPS) connection.
• Notifications. Off unless you turn them on in Settings, which is also when your phone asks your permission. When you do, we keep your device's push token (an identifier Apple or Google gives the app for delivering notifications) so we can notify you about email from contacts and domains you chose. The notification sent through Apple's and Google's push services contains no email content: only a random, single-use code. Your phone uses that code to fetch the text from our servers, showing as much as you chose (the sender, the sender and subject, or nothing about the email). The code expires after an hour. Signing out removes the push token, and you can turn notifications off at any time in Settings or your phone's settings.
• Contacting support. When you contact support from the app, your message goes to our support system with your account's email address, your workspace's identifier, and the app's version and platform. If you leave Include diagnostics on, it also includes your plan, your connected mailboxes' addresses and sync status, and recent sync error messages. It never includes the content of your emails or tasks. You can see the conversation in the app, and we email you a copy of each reply. We keep support messages for as long as we need them to help you.

The apps do not access your location, contacts, photos, camera, or microphone. They contain no advertising or third-party analytics, do not use your device's advertising identifier, and do not track you across other companies' apps or websites.

Connected assistants

You can connect your own AI assistant (such as ChatGPT, Claude, Gemini or Cursor) to Triage so it can work with your tasks. Nothing is connected unless you do it: the assistant shows a code, and you approve it in the Triage app (Settings → Connected apps), for one workspace.

• What the assistant gets. Your tasks as Triage shows them: the sender, subject, short preview, link to the email, your notes, priority and dates. It can also add, complete, snooze, schedule and edit tasks. It never gets the full text of your emails or access to your mailbox, and can't send or change anything there.
• Where it goes. To the assistant you connected, under that provider's own terms and privacy policy. You choose the assistant; Triage doesn't send your tasks to any AI provider on its own behalf this way.
• What we keep. The assistant's name, when you connected it and last used it, and its access tokens, stored only as one-way hashes. Changes an assistant makes are marked in the task's history.
• Stopping it. Disconnect it in Settings → Connected apps; its access ends immediately. Deleting your account removes every connection.

Our website and the launch list

Our website, triage.rest, has no advertising, analytics or tracking cookies.

Getting notified at launch. When you ask us to let you know when Triage is available, we collect your first and last name and email address, along with the time you signed up, the wording you agreed to, and a one-way fingerprint of your IP address used only to limit repeated sign-ups. We send one email to confirm your address. Once you confirm, your name and email are added to our customer list (kept in Twenty, the CRM we use) so we can let you know when Triage is available. We use them for nothing else and never share or sell them.

Leaving the list. Reply to any of our emails or write to hello@smartsby.com, and we'll remove you and delete your sign-up. Sign-ups that are never confirmed are deleted after 30 days.

How we protect your data

• Encrypted before storage. The sender, subject, preview and email link of every task, and the copies kept with your actions, are encrypted with a key unique to your workspace before they're written to our database. That key is itself encrypted by Google Cloud Key Management Service and never stored in readable form. Mailbox access tokens are encrypted the same way, with a separate key.
• Encrypted in transit and at rest. All connections use HTTPS, and our database and its backups are additionally encrypted at rest by Google Cloud.
• Least access. Each part of Triage can reach only the data it needs: for example, the service that reads your mailbox can add new tasks but can't change or delete existing ones, or read your account details. Workspaces are isolated from one another by the database itself, not just by our application code.
• No human access by default. We don't read your email or tasks. See the Limited Use section below for the narrow exceptions.

No system is perfectly secure; the server that shows you your tasks has to decrypt them to do so. Encryption protects your data in the database, its backups and exports.

Where your data is stored

Triage runs on Google Cloud in the United States (us-east1). If you use Triage from outside the United States, your information is transferred to and processed in the United States.

Service providers

We use these providers to run Triage, and share with them only what each needs:

• Google: Google Cloud (hosting, database, encryption keys, message delivery), Firebase (sign-in and hosting our website), the Gmail API and Google Calendar API (only for accounts you connect), and the Gemini API (only for AI-assisted triage, and only when it's turned on for your workspace; see above).
• Microsoft: the Microsoft Graph API, only for Outlook and Microsoft 365 mailboxes and calendars you connect, and Microsoft sign-in if you use it.
• Fastmail: Fastmail's mail and calendar APIs, only for Fastmail accounts you connect.
• Apple and Google Play: distribute the apps and process subscription payments. Apple also provides Sign in with Apple, and the Apple Push Notification service delivers notifications to iPhones (through Firebase Cloud Messaging, which delivers them to Android phones), only if you turn notifications on. Neither receives email content (see "Notifications" above).
• RevenueCat: keeps track of subscriptions (see "Subscriptions" above).
• Resend: sends our emails, such as the launch-list confirmation and copies of our replies to your support messages. It receives the recipient's name and email address and the message.
• OVHcloud: hosts our support system in the United States.
• Cloudflare: provides our website's domain name service and, on the launch-list form, a check that blocks automated sign-ups (Turnstile).
• Todoist (Doist): only if you connect it in Settings › Connected apps. Your tasks always stay in Triage; with sync on, each one is also kept in your own Todoist account with its title, your note, due date and duration, priority, labels, the sender's address and a link back to the email. Changes come back the other way too: completing a task, or a new date or duration from Todoist (or an app that schedules from it), updates Triage, and a task you add in Todoist, or bring over with Import from Todoist, appears in your Tasks. Triage keeps an access token for your Todoist account, encrypted like your task data. Disconnecting Todoist revokes that access; tasks already in Todoist stay there, under Todoist's own privacy policy.

We do not sell your information or share it for advertising.

Google user data & the Limited Use policy

Triage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide and improve Triage's user-facing email-triage features described in this policy.
• We do not use Gmail data for serving advertisements.
• We do not use Gmail data to train generalized AI or machine-learning models.
• We do not allow humans to read Gmail data except with your explicit consent for a specific support request, to comply with applicable law, or to investigate a security incident.
• We do not transfer Gmail data to third parties, except to the service providers above as needed to provide Triage (including AI-assisted triage, only when you've turned it on), to an AI assistant you choose to connect yourself (see Connected assistants), or as required by law.

We apply the same rules to email from Outlook, Microsoft 365 and Fastmail, and to calendar data from Google, Outlook and Fastmail.

Data retention and deletion

While you use Triage, we keep your tasks and their history so you can see and act on them.

After your free month or subscription ends, Triage stops checking your new mail, and AI-assisted triage, Todoist sync and connected assistants stop. Your tasks and calendar stay available in the app. Then:

• After 90 days without anyone using Triage, counted from when it ended or from the last time you opened the app since, we revoke Triage's access to your mailboxes and calendars (as described below) and delete your workspace and account: your tasks, their history and everything else in it, as if you had deleted your account yourself (below). Opening the app restarts the 90 days.
• If you create an account but never connect a mailbox, we delete it 30 days after you created it.

We email you when it ends, and again at least 30 days before your account is deleted (7 days for an account that never connected a mailbox); nothing is deleted without that notice. Subscribing at any time stops this. We also email you 10 days before your free month or your introductory price ends.

Disconnecting a mailbox. In the app, go to Settings → Mailboxes and tap Disconnect. Triage stops reading that mailbox immediately and deletes the tasks created from it (and their action history). Then:

• Gmail: we ask Google to revoke Triage's access, which also removes Triage from your Google Account's "Third-party apps & services" list. Once Google confirms, we delete the stored access token. If revocation can't be completed right away, the app tells you, and you can try again or remove Triage in your Google Account yourself.
• Fastmail: we ask Fastmail to revoke Triage's access, then delete the stored access token.
• Outlook and Microsoft 365: we delete the mailbox's notification subscription and the stored access token. Microsoft doesn't let an app revoke its own access, so to remove Triage from your Microsoft account entirely, use your account's app permissions page (account.microsoft.com, or myapps.microsoft.com for work and school accounts).

Deleting your account. In the app, go to Settings → Account → Delete account; you'll be asked to sign in again to confirm. This permanently deletes your account and, for any workspace you're the only member of, its tasks, history, encryption key and connected mailboxes. If you share a workspace with others, you're removed from it and its data stays with them. You can also ask us to delete your account by contacting us. Deleting your account doesn't remove Triage from your Google or Microsoft account's list of connected apps; disconnect your mailboxes first, or remove Triage there. Step-by-step instructions are on our Delete your account page.

Free-trial record. To give each mail account one free trial, we keep a one-way fingerprint of every mail account that has started one (it can't be turned back into the address), even after the account or workspace is deleted. Nothing else is kept with it.

Backups and logs. Deleted data is removed from our live database immediately, and from our database backups within 7 days, as they expire. Server logs, which record technical details of requests such as IP addresses and timestamps, are kept for up to 30 days.

Removing access at your provider. You can revoke Triage's access at any time from your Google Account's "Third-party apps & services" settings, your Microsoft account's app permissions, or Fastmail's settings. Triage then can no longer read that mailbox (or your calendar).

Uninstalling the app does not delete your Triage account or the data stored on our servers.

Your choices

You can disconnect mailboxes, delete your account, and revoke access at your mail provider at any time as described above. To ask for a copy of your data, or for any other privacy request, contact us at the address below.

Children

Triage is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We'll update the "Last updated" date above when this policy changes. Material changes will be communicated to account holders directly.

Contact

Questions about this policy: hello@smartsby.com