Privacy policy
What leaves your machine, to whom, and when
This is the privacy policy for Tenku, a local-first desktop email-triage app (open source). It is the same data-flow contract the code is held to; if the code and this document ever disagree, that is a bug.
Tenku talks to exactly two parties: Google (your mailbox) and Anthropic (message classification and explicit AI actions you ask for). There is no telemetry, no crash reporting, no analytics, and no other endpoint. Tenku does not sell, rent, or share your data with anyone, and shows no ads.
To Google
Google already holds your mailbox. Tenku is a Gmail client acting on the account connection you authorize (OAuth, the gmail.modifyscope plus any opt-in scopes). What it exchanges with Google:
| When | What |
|---|---|
| Sync (automatic) | Read-only fetches of message metadata and snippets. Full message bodies are fetched only for a message you open. |
| Action mirror (your gestures) | Archive / star / trash / spam / read / snooze label changes, sent through the outbox. |
| Send or save draft (your gesture) | The full composed message — recipients, body, and attachments. |
| Contacts refresh (opt-in, default off) | A read-only fetch of your contacts list. |
| Instant sync (opt-in, default off) | Pub/Sub pulls; the notification payload carries no message content. |
To Anthropic — the egress boundary
On classification (automatic, batched)
Per message, metadata and the stored snippet only. The classification path cannot read a message body — no body column exists in the local database. What is sent:
- sender name, sender email address, and sender domain;
- the subject line;
- the snippet, already truncated to 100 characters or fewer at ingest;
- boolean flags: unread, has-attachments, is-reply, is-sent.
Plus a small corrections block derived from your own recent reclassifications (sender email, truncated subject, and the importance you chose). Recipients — To, Cc, Bcc — are never sent to Anthropic.
On explicit actions only
- Summarize — the full text body of that one message.
- Draft or reply assist — the reply target's full text body, plus the instruction and draft text you typed.
The body and the returned draft or summary exist in memory for that one request only: never persisted, never cached to disk, never logged. Attachment bytes are never sent to Anthropic at all — they move only between Gmail and your disk, on an explicit save or send.
Never sent to Anthropic
- message bodies on the classification path (impossible by construction);
- recipients, attachment bytes, or your contacts;
- OAuth tokens, API keys, or the database key.
Retention and model training
Tenku uses the Anthropic API under its commercial terms: API inputs and outputs are not used to train models. Message data sent to Anthropic is used only to provide Tenku's triage and assist features to you. For how long Anthropic retains API data, consult the live policy at the Anthropic Privacy Center.
Tenku's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve, or train generalized AI/ML models.
On your machine
- The local cache — metadata, snippets of 100 characters or fewer, triage state, and action history — is SQLCipher-encrypted. The key lives in your operating system's keychain.
- Secrets (OAuth tokens, the Anthropic key, the database key) live only in the OS keychain — never in the database, logs, or IPC.
- Diagnostic logs are counts and durations only — never a subject, body, address, token, or key.
Kill switches and exit
- Pause AI stops all Anthropic traffic; Pause Gmail writes stops all mailbox changes. Both are enforced in the backend.
- Signing out revokes the Google grant (best effort) and clears the keychain tokens. Deleting the app's data directory removes the local cache entirely.
This website
This site (tenku.app) is a static page. It sets no cookies, runs no analytics, and makes no third-party requests. It exists only to describe Tenku and this policy.
Questions, or want to read the enforcing code? The contract and its source live on GitHub.← Back to home