What Otto stores

What stays in your provider

Your mail stays in your provider (Gmail or Outlook) — Otto reads it to help you, it does not move it. Otto never stores the body of your emails or your attachments; they are fetched live from your provider each time you open one.

Attachment bytes stream through without being written to Otto's storage. Search of older mail runs on your provider. Opening a message and asking the assistant about it are different uses of its content; the exceptions below explain what a chat can retain.

What Otto keeps, and why

Otto keeps a lightweight metadata index: sender, recipients, subject, a short snippet, labels, dates and read/star flags. That lets folders load quickly and update in real time. The search index uses subject, addresses and snippet only, never a message body.

OAuth access and refresh tokens stay server-side so Otto can act on the mailbox you connected; they are never sent to your browser. Settings, snippets and notes keep your preferences and your own writing available in your workspace, separate from the mailbox index.

The exceptions, named plainly

When you ask the assistant about an email, excerpts of it (sender, subject, body text) are saved with that chat until you delete the chat or your account.

Undo Send holds the outgoing message for the undo window, seconds, then sends it; a scheduled send parks a real draft in your provider and Otto keeps its id.

AI memory keeps concise facts and preferences you can review in Settings → Memory, while temporary processing excerpts expire within seven days.

Deleting it

You can delete your account in Settings → Privacy & data. After a short grace period, your personal account data is purged. Shared documents and an organization's independent knowledge remain with that organization.

There are no advertising trackers, no ad profile, and your mail is never used to train any AI model. The privacy policy is the full record of what Otto keeps, why it keeps it and how deletion works.