Privacy Policy

We built Soda Road to be your inbox — a mail app that reads, renders, and sends your Gmail, and keeps an encrypted copy of your mail so it opens instantly. This policy explains what data we collect, how we use it, who else processes it, how long we keep it, and the choices you have. We've kept it as clear as we can while covering everything that matters.

1. Information We Collect

Account Information. When you sign up, we collect your name and email address through Google OAuth. We do not collect or store payment information.

Email Data. Soda Road is an inbox backed by your Gmail. When you connect Gmail, Soda Road imports your mail — all of it except spam, trash, and drafts, starting from your 10,000 most recent messages — and then follows changes as mail arrives, is read, or is deleted. For every message Soda Road stores: the sender, recipients, subject, date, and Gmail labels are kept as plain metadata so your inbox list renders quickly; the message body, HTML, and preview text are encrypted with AES-256-GCM before they touch our database. Soda Road also sets up a Gmail watch (a push subscription on your mailbox) so it can learn about new mail without polling; the notifications carry no message content. When you send mail from Soda Road, it goes out through Gmail's API from your account.

Google Contacts (optional). If you choose “Import from Google” in Settings → Contacts, Google asks you separately for read-only access to your contacts. Soda Road then reads your contacts' names, email addresses, and photos into your Soda Road contact book, once per import; contact photos are stored encrypted. Soda Road never writes to your Google Contacts, and you can revoke this access at any time from your Google account.

Usage Data. We collect information about how you interact with Soda Road, such as session activity. We use essential cookies for authentication and session management. We do not use analytics cookies. One advertising-measurement cookie, on the public pages only. Our public marketing pages (the homepage, product, pricing and similar pages — never the signed-in inbox) load Google's advertising tag so we can tell whether a Google ad brought you to us, and so Google can show our ads to people who visited these pages. In the UK, the EEA and Switzerland the tag sets no cookie until you choose Allow in the banner; elsewhere it is on unless you choose Decline, which you can do at any time from “Cookie settings” in the footer. What Google receives is the page you visited and the fact that an account was created or a phone number confirmed — never your address, your name, your mail, or anything from inside the product. See §4 for Google's role and §6 for how to change your choice.

2. How We Use Your Information

To Provide the Service. We use your email data and account information to show your inbox, render your conversations, send the mail you compose, and keep your stored copy in sync with Gmail. This is the primary and essential use of your data.

To Personalize Your Experience. Soda Road may use automated classification to organize mail for your account. Soda Road does not train models on your email data. Your email data is not combined with other users' data to train generalized or non-personalized AI or machine learning models, and Google API data is not used to develop, improve, or train generalized, foundational, or frontier AI or ML models.

The Memory Feature (Decisions & Commitments). Soda Road offers an optional feature that finds decisions and commitments in your conversations and keeps them as a private record for you. To do this, Soda Road sends the text of a conversation — subject, sender, date, and message text, up to set limits — to an AI model provider we have verified does not use your content to train its models (Z.ai, Anthropic, or OpenAI — the candidate set named in the disclosure you consented to). What comes back — short claims about your own decisions and commitments — is encrypted like your mail. This feature is off until you explicitly turn it on at the memory consent page, which shows exactly what is sent before you consent. While it is off, nothing is sent and no memories are stored; only after you turn it on can Soda Road process your stored conversations, under the disclosure you consented to, until you withdraw consent — nothing is ever processed under a grant you have not given. Your consent record stores the date of your grant and the version of the disclosure you agreed to, and each extracted memory records the model that produced it. You can withdraw consent there at any time; withdrawing stops new processing but does not delete what was already extracted. Soda Road does not train models on your email data, and no provider in this feature does either.

Channel Rule Suggestions. The Channels page lets you describe a sorting rule in plain words (for example, "only email from my dad"). When you do, Soda Road sends what you typed — your description, and nothing else — to an AI model (Z.ai's GLM, through OpenRouter, on Soda Road's own account) to draft candidate rules. No content from your mail is sent: not messages, not subjects, not senders, not any other mailbox data — the model receives only the description text. The candidates come back as plain-language rules, each shown with a count of which of your stored conversations it would match today, and nothing is saved until you approve a rule through the standard rule editor — the same way a hand-typed rule is saved. The description itself is not stored; the only record kept is an audit-log entry noting that the call happened (your channel, the counts, and the model — never the description text).

Chats with Email Participants. When you start or continue a chat that includes someone without a Soda Road address, Soda Road sends your messages in that chat to them by email (from an address like chat+<code>@in.sodaroad.com), so they can take part from their inbox. Their email replies are delivered into the chat as messages attributed to them. Soda Road stores those messages like any other chat content: encrypted at rest, retained as long as the chat exists. The email participant's own address is never shown to other members (display names only). Emails we send on a chat's behalf carry Soda Road's sending infrastructure, not yours, and replies are accepted only from the address the email was sent to.

Your Phone Number (optional). You may add a phone number to your account. It is not required to sign up or to use Soda Road. If you add one, Soda Road asks Twilio to send a one-time code to it by SMS so the number can be confirmed as yours (§4), and a confirmed number becomes the way you can reset your password if you forget it, at /forgot. A number that was typed but never confirmed cannot reset anything. Soda Road does not send you marketing by SMS and does not share your number with anyone but Twilio for the purposes described here. You can change or remove the number from your account settings.

To Communicate With You. We may use your email address to send service-related communications, such as account updates and responses to support requests. We do not send promotional emails to you on behalf of third parties.

3. What We Do Not Do with Your Data

We want to be explicit about what Soda Road will never do with your information:

No Advertising. We do not use your email data or personal information for advertising purposes, including serving ads, retargeting, personalized advertising, or interest-based advertising.

No Data Sales. We do not sell, rent, license, or trade your personal information or email data to any third party, including advertisers, data brokers, or information resellers.

No Unauthorized Human Access. Soda Road employees and contractors do not read your emails unless (a) you have given specific, affirmative consent to view a particular message (for example, as part of a support request you initiated), (b) it is necessary for security purposes such as investigating abuse or a security incident, (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymized such that it is no longer personally identifiable and is used only for internal operational purposes.

No Creditworthiness or Surveillance. Your data is never used to determine creditworthiness or for lending purposes, and is never provided to any entity for the purpose of conducting surveillance.

4. Sub-processors

Soda Road relies on the following third-party service providers to operate. Each is contractually bound to use your data only as necessary to provide services on our behalf and in accordance with this policy. We do not transfer your Google user data to any party not listed below, except as necessary to comply with applicable law or as part of a merger or acquisition (with prior explicit notice and consent).

Google (privacy policy) — provides OAuth authentication, Gmail API access, and (when enabled) Pub/Sub mailbox-change notifications. Google is the source of all email data Soda Road processes.

Supabase (privacy policy) — hosts our PostgreSQL database in US East. Stores your account, application-encrypted OAuth tokens, and the stored copy of your mail: metadata in plaintext and message bodies/previews encrypted at the application layer (AES-256-GCM, a key separate from Supabase's disk encryption). Also stores audit and rate-limit records.

Vercel (privacy policy) — is Soda Road's intended web application host. Soda Road has not yet launched its hosted service: today the Soda Road web application runs on infrastructure under Soda Road's direct control (a development machine in the United States), and Vercel processes no Soda Road data. At Soda Road's first deployment, Vercel will host the web application in US East and ingest structured logs; those logs will pass through an application-layer redaction pass that removes known PII keys (email addresses, OAuth tokens, OAuth state, cookies, Authorization headers) before write.

Google Sheets (privacy policy) — stores the public waitlist log (timestamp, email, ESP type only). Receives no Gmail-derived content.

Google Ads (how Google uses cookies for advertising) — measures whether our advertising works, on the public marketing pages only. Receives the pages you visit there, a click identifier from a Google ad if you arrived from one, and two events with no personal data attached: an account was created, a phone number was confirmed. Receives no Gmail-derived content, no account identifier, and nothing from the signed-in product, which does not load the tag. Subject to your choice in the cookie banner (§1).

AI Model Provider (the memory feature). When — and only when — you have explicitly turned on the memory feature at the memory consent page, Soda Road sends the text of your conversations (subject, sender, date, and message text, up to the limits disclosed there) to one AI model provider: Z.ai (GLM), Anthropic, or OpenAI — each contractually or by published API terms barred from using your content to train their models, and each verified by us as such before any content is sent. The date of your grant and the version of the disclosure you consented to are recorded with your consent, and each extracted memory records the model and prompt version that produced it. No content is sent to any of them while the feature is off. You can withdraw consent at the memory consent page at any time; withdrawal stops new processing immediately.

OpenRouter (channel rule suggestions). OpenRouter routes Soda Road's model calls for the channel rule suggestion feature described in §2: when you ask for a plain-words rule draft, your typed description (and nothing else — no mail content) is sent through OpenRouter to the model named there, on Soda Road's own account. For this feature OpenRouter receives description text only, and nothing from it is stored.

Twilio (privacy policy) — verifies a phone number, if you choose to add one (§2). Soda Road sends Twilio's Verify service the number you entered; Twilio delivers a one-time code to it by SMS and decides whether the code you type back is correct. Twilio holds the code — Soda Road never generates, stores, or compares one. Twilio receives your phone number and nothing else: not your mail, not your chats, not your email address.

Resend (privacy policy) — delivers and receives the email for chats with email participants, described in §2. When a chat includes someone without a Soda Road address, the text of the messages sent to that participant passes through Resend to reach their inbox, and their replies are received by Resend at in.sodaroad.com and passed to Soda Road. Resend receives the content of chats that have an email participant, and nothing else — not your mail, and not chats without one. Soda Road does not run its own mail servers; Resend processes this content only to deliver it.

5. Data Retention and Storage (the complete picture)

This section is the single, complete statement of what Soda Road keeps and for how long; the rest of this policy links here rather than restating it.

Your stored mail. Soda Road keeps the imported copy of your mail — all of it except spam, trash, and drafts, starting from your 10,000 most recent messages, plus the rest of any conversation you open in Soda Road — until you delete it or delete your account. There is no fixed retention clock: the copy exists so your inbox works, and you are the only person who can remove it early. Message bodies, HTML, and previews are encrypted with AES-256-GCM under keys that live only in Soda Road's encrypted environment; subjects, senders, recipients, dates, and Gmail label snapshots are stored as plaintext metadata. Your read/unread and archived state in Soda Road is Soda Road-local — it is not written back to Gmail. (An optional automatic-triage feature — off today — can archive bulk promotions in Gmail by removing Gmail's Inbox label; it is disclosed here and at connect before it is ever turned on.)

Deletion behavior. If you delete a message in Gmail, Soda Road removes its stored copy the next time it syncs; until that sync runs, Soda Road may still show the message from the stored copy. If you revoke Soda Road's access at Google, Soda Road stops reading your Gmail immediately, but revoking does NOT delete anything Soda Road has already stored — your stored mail remains (and keeps rendering in Soda Road) until you delete it from your account settings or delete your account.

Your phone number. If you add one, it is stored in normalized international form alongside the date it was confirmed, and kept until you change it, remove it, or delete your account. It is stored as ordinary text, not under the application-layer encryption used for tokens and message bodies, and is included in your data export. Removing or changing the number clears the confirmation, so the old number can no longer reset the account.

OAuth tokens. Encrypted at the application layer (AES-256-GCM) and held only while your account is active. Deleted immediately on account deletion.

Audit log. Append-only and retained indefinitely as a forensic record of consent grants, exports, and deletions. Audit rows reference your user id and event counts but contain no message content; the record of your deletion request itself survives your deletion.

Rate-limit records. Short-lived rows keyed by your account id or IP address plus timestamps. Your account-keyed rows are removed immediately when you delete your data; the remaining rows are removed by a periodic stale-record cleanup.

Extracted memories. If you turn on the memory feature, the short claims it extracts (decisions and commitments from your conversations) are encrypted with AES-256-GCM under the same application-layer keys as message bodies and are kept until you delete them: all at once from the memory consent page, or together with everything else when you delete your account. They are included in your data export. Withdrawing memory consent stops new extraction but does not delete the memories you already have — deletion is the separate action described above.

Backups. Soda Road's current Supabase Free Plan does not include provider-managed automated backups or point-in-time recovery. Account deletion removes records from the live production database immediately; because there are no managed backups, there is no backup-retention tail for those records.

6. Data Storage & Security

Your data is stored on US-based cloud infrastructure using industry-standard encryption in transit (TLS 1.2+) and at rest (AES-256 at the disk layer). OAuth refresh and access tokens, and all stored message bodies and previews, are additionally encrypted at the application layer with AES-256-GCM before they reach the database. We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include role-based access controls, append-only audit logging, row-level security policies on every user-data table as a forensic backstop, and regular security reviews. No method of electronic storage is 100% secure, and we cannot guarantee absolute security. For our security-disclosure process and contact, see /security.

7. Your Rights & Choices

Self-serve export. You can download a JSON export of every record we hold about you — your account, linked email addresses, stored mail (with bodies decrypted into the file), mailbox state, classification decisions, and extracted memories (with their claim text decrypted into the file) — from the dashboard at any time. The export deliberately omits OAuth tokens. Rows that cannot be decrypted are exported with a placeholder and listed in a decryptWarnings section, so a single damaged record never blocks your export.

Self-serve deletion is immediate. When you trigger deletion from the dashboard, Soda Road asks Google to revoke every linked OAuth token (best-effort — if you want certainty, check your Google Account permissions afterward), writes a final audit entry, and permanently removes, in one operation: your account, your stored mail (every thread and message), your extracted memories, your sync state, your classification decisions, your mailbox-watch state, and your account-keyed rate-limit records. There is no 90-day delay and no soft-delete period. The only record that survives is the append-only audit entry showing that your deletion was performed (see §5).

Email-based requests. If you cannot reach the dashboard, you may also request export, correction, or deletion by emailing hello@sodaroad.com.

Revoke Google access. You may revoke Soda Road's access to your Google account at any time through your Google Account permissions. Revoking access immediately stops Soda Road from accessing your email — and, as §5 states, it does not delete the stored copy; use the dashboard deletion, or the step-by-step guide at Managing and deleting your data, when you want the data gone.

Cookies. Most browsers allow you to manage cookie preferences through their settings. Soda Road only uses essential cookies for authentication and session management; disabling them will prevent you from signing in.

8. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the purposes for which it is used, and whether it is sold or disclosed. You have the right to request deletion of your personal data and to opt out of the sale of your personal information. Soda Road does not sell your personal information. To exercise your rights, contact us at hello@sodaroad.com. We will not discriminate against you for exercising any of your CCPA rights.

9. European Users (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation, including the right to access, rectify, port, and erase your data, as well as the right to restrict or object to certain processing. Our legal bases for processing your data are: (a) your explicit consent, provided when you connect your email account and authorize Gmail API access; (b) performance of a contract, as processing is necessary to deliver the Service you have requested; and (c) our legitimate interest in maintaining the security and integrity of the Service. You may withdraw your consent at any time by revoking Soda Road's access through your Google Account settings, by withdrawing memory-feature consent in the product at the memory consent page (the most precise withdrawal point Soda Road offers — it stops memory processing immediately without affecting anything else), or by contacting us. To exercise any of these rights, contact us at hello@sodaroad.com.

10. Children's Privacy

Soda Road is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@sodaroad.com.

11. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users by email and, where required by applicable law, notify the relevant supervisory authorities within the timeframes required by law. Our notification will describe the nature of the breach, the data affected, and the steps we are taking in response. Our security-disclosure contact and process are documented at /security.

12. Google API Services — Limited Use Disclosure

Soda Road's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Soda Road:

(a) Only uses access to Google user data to provide and improve user-facing features that are prominent in Soda Road's user interface, namely reading, rendering, and sending your mail and keeping the stored copy described in §5 in sync.

(b) Does not transfer Google user data to third parties except as necessary to provide or improve user-facing features (with user consent), to comply with applicable law, or as part of a merger or acquisition (with explicit prior consent). Soda Road does not transfer Google user data to any advertising platform, data broker, or information reseller.

(c) Does not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.

(d) Does not allow humans to read Google user data unless the user has provided affirmative consent to view specific messages, it is necessary for security purposes, it is required by applicable law, or the data is aggregated and anonymized for internal operations.

(e) Does not use Google user data to develop, improve, or train non-personalized AI or machine learning models. Any machine learning applied to your email data is personalized to your account only and is not co-mingled with other users' data for generalized model training.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date below. If we make material changes — particularly changes to how we access, use, or share your Google user data, or the addition of a new sub-processor that receives Gmail-derived content — we will notify you by email before the changes take effect and will request your consent before accessing any types of data not previously disclosed. Your continued use of Soda Road after any non-material changes constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, contact us at hello@sodaroad.com. For security-disclosure inquiries, see /security.