Privacy Policy

1. Who we are

Otto is operated by Bytes2Pro (“Bytes2Pro”, “we”, “us”), which runs the Otto service at https://ottomail.app. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we act as the data controller for the personal data described here. For privacy questions or to exercise any of your rights, contact us at privacy@ottomail.app.

2. Data we collect and store

We only collect what we need to run the service. The categories of data we store are:

Account & identity

Your account identifiers, name, email address and avatar URL from the sign-in providers you connect.

Mailbox index (metadata only)

So your inbox loads quickly and updates in real time, Otto stores lightweight message metadata — sender, recipients, subject, a short preview snippet, labels, dates and read/star flags. Message bodies are normally fetched from the connected provider when needed. Content can also be retained in assistant conversations, scheduled-send payloads, notes and temporary memory-processing excerpts as described below. This index is kept until you delete your account.

Provider authorization tokens

The OAuth access and refresh tokens that let Otto act on your mailbox on your behalf. They are held server-side only (never sent to your browser), encrypted at rest by our database provider, and kept only until you disconnect the provider or delete your account.

Assistant conversations

Your chats with the Otto assistant. When you ask the assistant about an email, excerpts of that email (sender, subject, body text) become part of the conversation and are saved with it. Kept until you delete the chat or your account.

Saved work and review records

When you use Work, Otto keeps commitments and their source references, meeting preferences, prepared artifact versions and selected evidence or results needed to review what happened. A saved artifact may contain selected message text or user-authored content; it is not just mailbox metadata. Draft workspaces keep provider draft identifiers and revisions, while shared drafts and saved conversations have their own content records. Personal records follow account deletion; organization-owned records follow the organization's lifecycle. Short-lived job payloads have separate cleanup and do not set the lifetime of a saved artifact.

Optional mail and booking controls

If enabled, sender screening and Focus bundles keep your sender rules, bundle names and membership, schedule, and message references needed to show or notify you about selected mail. A Hide in Otto rule changes the Otto inbox view, not provider delivery or provider archive state. Booking links keep your availability policy and guest request details, including email address, chosen time, verification and management records. Temporary tokens and rate-limit records expire separately; terminal booking records are retained for up to 90 days after the meeting for recovery and audit, subject to account or organization deletion.

Settings & prompt templates

Your preferences (model, persona, signature, appearance), prompt templates, notes, snippets and custom notification sounds. Shared documents belong to their organization; deleting a personal account preserves the team’s independent records.

Mailbox change signals

To deliver real-time updates we store provider subscription state and mailbox sync cursors and, when new mail arrives, log the message id — never its content — to ping your browser.

Notification tokens

If you turn on closed-tab or mobile notifications, we store the push subscription or device token for that device (web push, Apple APNs or Google FCM) so we can alert you to new mail. Notification records can include titles, descriptions and links to relevant mail or other activity. Removed when you turn notifications off or delete your account.

Billing & subscription status

Your plan tier, subscription status, billing cycle and the identifiers our payment providers (Paddle, RevenueCat) use to reconcile your subscription. We never store your card details — web payment is handled by Paddle, and native purchases use the relevant app store.

Waitlist & email preferences

If you join the waitlist or opt in to product updates, we store your email address, your marketing-email consent, and an unsubscribe token. We send product-update email only with your consent, and you can opt out at any time via the unsubscribe link in any such email. Kept until you unsubscribe or we close the waitlist.

Chat attachments and private files

Ordinary chat uploads expire after 24 hours. When private file workflows are enabled, files you explicitly upload or import from mail or chat are stored for scanning and extraction. Temporary workflow copies expire after 24 hours; explicitly saved files remain until removed or the owning account is deleted. Extracted text and generated documents follow their source file's retention and access restrictions.

AI memory and selected learning sources

Eligible personal memory is on by default after the AI agreement, while existing opt-outs are preserved. Otto retains concise facts and preferences, source references and derived search vectors in your personal space or an authorized organization space. Temporary processing excerpts are removed after processing and expire within seven days. Private chats are not published to team memory without an explicit selected statement or proposal. Review learning, source selection, use and separate automatic-action controls in Settings → Memory. Personal account deletion removes personal memory and leaves the organization’s independent knowledge intact.

Product-usage analytics

Structural events about how you use Otto — which features you open, onboarding steps, errors you hit, device/platform, performance timings and subscription changes — tied to your account id and processed by PostHog (EU-hosted) so we can measure and improve the product. We also record session replays, but ONLY on non-inbox pages (public marketing, sign-in and onboarding screens), with anything you type masked, to see where the sign-up and upgrade flows can improve. None of this ever includes your inbox, email content, subjects, recipients, attachments, search text or assistant messages. Used only to run and improve Otto, never to build an advertising profile or train models.

Email tracking you turn on (opt-in)

If you (a Pro user) opt an individual outgoing email into read receipts or link-click tracking, Otto stores — for that one message — its subject, recipients and send time, plus the resulting open count and timestamps and/or per-link click counts. This is off by default on every email and chosen per send. A read receipt records that the message was opened, not which recipient opened it, and won't register for inboxes that block remote images. Kept until you delete your account.

What we deliberately do not store

• Your mailbox password (mail access uses provider OAuth authorization).
• Your payment-card details — those go directly to our payment provider or app store, never to us.
• Third-party ad-network or behavioural ad-profiling data. Otto embeds no advertising trackers, builds no advertising profile of you, and never uses your email content or personal data to target ads. We do use a privacy-focused product-analytics processor (PostHog, EU-hosted) to understand which features are used and where the experience can improve — it records structural usage events, performance timings, and session replays limited to non-inbox pages (public marketing, sign-in and onboarding screens, with anything you type masked). It never records your inbox and never receives your email content, subjects, recipients or attachments. See subprocessors.

3. The Google data we access, and why

When you sign in with Google you grant Otto the following access. You can review and revoke it at any time at myaccount.google.com/permissions, or by disconnecting from within the app.

https://mail.google.com/

Read, search and summarize mail; send messages and replies; manage drafts and scheduled sends; organize your mailbox; and permanently delete messages when you use Delete forever or empty Trash or Spam.

gmail.settings.basic

Create and manage your mail filters (the rules that auto-label, archive or sort incoming mail).

calendar.events

View your schedule and create, edit or delete events on calendars you can access, including attendees and meeting links.

calendar.calendarlist.readonly

List your subscribed calendars so you can choose which ones to view and use.

calendar.events.freebusy

Check busy times so the assistant can suggest available meeting slots.

contacts.readonly

Match sender email addresses to photos in your Google Contacts. Otto does not edit your contacts.

tasks

View task lists and create, edit, complete, reopen or delete your Google Tasks.

drive.file

Save attachments you select to Google Drive and open the resulting files, without requesting access to your entire Drive.

openid, email, profile

Identify you and show your name and avatar in the app.

4. Google API Services — Limited Use

Otto’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, data obtained from Gmail is used only to provide and improve Otto’s user-facing features, and we:

• do not sell or rent your Google data;
• do not use it for advertising, profiling, or any purpose unrelated to the features you are using;
• do not use it to train generalized or foundation AI/ML models;
• do not allow humans to read it, except where you explicitly ask us to, where required for security or to comply with the law, or on data that has been aggregated and anonymized.

5. AI processing

Otto’s assistant is powered by third-party large language models (see Subprocessors below). When you use the assistant, the relevant content of your request — which may include text from emails you ask about — is sent to the model provider’s API through one of our AI routing services (the Vercel AI Gateway or OpenRouter) to generate a response. If you use the assistant’s web-research tool, your research query — which can include details you provide from an email — is additionally sent to Perplexity to search the web. Each routing service and model provider processes this only to return a result to you and, under its terms and our configuration, does not use it to train its models. We do not use your Gmail content to train any model ourselves. You are asked to consent to this AI processing before you first use the assistant, and again if we add a new AI service. Relevant chat attachments and requested email attachment content can be sent to the selected model to answer your request. Ordinary chat uploads expire after 24 hours. When private file workflows are enabled, files you explicitly upload or import from mail or chat are also stored for private inspection and extraction. Temporary workflow copies expire after 24 hours; files you explicitly save remain until you remove them or delete the owning account. Generated documents and extracted text follow the source file’s retention and access restrictions. We do not submit these files to public malware-analysis services.

6. Slack and other chat apps

If you connect Otto to Slack, you talk to it in a private message with the Otto app. Otto asks Slack for three permissions: chat:write to reply to you, im:history to read the messages you send it, and commands for the /otto command.

What we receive

• The workspace’s ID and name, your Slack user ID and the ID of your private message with Otto.
• The messages and /otto commands you send Otto in that private message. We don’t receive channel messages, group messages or other people’s conversations, and we don’t process files shared with the app.
• The bot token Slack issues when the app is installed. We store it encrypted (AES-256-GCM) and use it only to reply to you.

How we use it

Your messages are used to answer your request from the mailboxes you approved for that chat. The text of a request, and any email content needed to answer it, is processed by AI models as described in section 5. Messages from Slack users who haven’t linked an Otto account get a fixed reply, and their message text isn’t stored. Replies we post are also kept by Slack in your workspace under Slack’s own policies.

Routine delivery

Routines (also called automations) run on your behalf on the schedule or trigger you choose. A routine’s brief or digest can contain content from your mail, calendar and tasks. It is sent only to the destinations you picked for that routine, or asked for in chat: the in-app feed, your account email address, push notifications and the chat apps you have connected. Otto sends it there because you set the routine up or asked for it, and for no other reason.

• Email goes to the address on your account through our email provider, and push notifications go through Apple, Google or your browser’s push service (see Subprocessors). A push notification can show a short preview of the update.
• Chat apps receive the text of the update. Once a message is delivered, the chat service keeps it under its own terms and policies; we cannot recall or delete it there.
• Disconnecting or revoking a chat app stops future delivery to it. Messages already delivered stay in that service.
• Acting on a delivered update from a chat, such as archiving, marking as read, drafting a reply, muting or stopping the updates, works through the chat linked to your Otto account. Sending mail still needs your approval, unless you have separately enabled an automatic-reply rule.
• We keep a record of each digest, with its per-destination delivery status, for 180 days. Routine run records are kept for 30 days.

This is consistent with section 4. Mail content is sent to a chat service, an email address or a push service only because you explicitly set up a routine for it or asked for the update in a chat. It is not used for advertising and is not used to train generalized AI/ML models.

How long we keep it, and how to delete it

• Requests and answers from a chat are deleted after 30 days, or once work still running at that point finishes. Event and delivery receipts, which don’t contain message text, are deleted after 90 days.
• Within those requests and answers, the full text of tool results, such as the mail or calendar items read to answer you, is reduced to references 3 days after the request, once it has finished.
• Routine digests and their per-destination delivery status are deleted after 180 days. Routine run records are deleted after 30 days.
• Revoking the connection in Settings → Integrations → Slack stops Otto from reading or answering that chat. Records already kept are deleted on the schedule above.
• When the app is removed from a workspace, we delete our copy of its bot token and pause every connection in that workspace.
• Deleting your Otto account erases your chat connections, requests and answers. To ask for earlier deletion, email privacy@ottomail.app.

Telegram, Discord and other chat apps you connect follow the same retention and deletion rules.

7. How we use your data

• To authenticate you and keep you signed in.
• To read, search, compose, send and organize mail at your instruction.
• To run the optional sender, Focus, Work and booking settings you enable, and show the saved work and delivery history they create.
• To power the AI assistant’s responses and actions.
• To run the routines you create and deliver their briefs and digests on the schedule or trigger you choose, to the destinations you choose.
• To deliver real-time “new mail” updates to your browser.
• To remember your settings and saved prompts.
• To keep the service secure and to comply with our legal duties.

8. Legal bases (GDPR)

Where the GDPR applies, we rely on:

• Consent — for connecting your Google account and accessing your mailbox. You may withdraw it at any time by disconnecting or deleting your account.
• Performance of a contract — to provide the features you request.
• Legitimate interests — to keep the service secure and working, balanced against your rights.

9. Subprocessors

See our Subprocessors page for the service list, connected chat services and information about AI processing locations and retention.

We share data only with the service providers needed to run Otto. Each processes data on our behalf under its own terms:

Google (Gmail API & OAuth)

Sign-in and the mailbox itself. Otto reads, sends and modifies mail through the Gmail API using the access you grant. (Global)

Microsoft (Graph API & OAuth)

Connection to Outlook and Microsoft 365 mail, calendar and tasks. Otto reads and changes the selected account through Microsoft Graph using the access you grant. (Global)

AI model providers (OpenAI, Anthropic, Google, and others)

Generate responses and support AI features such as search and message classification. Available models include OpenAI, Anthropic, Google, DeepSeek, Z.ai, Moonshot AI, Alibaba (Qwen), Meta and Grok; specialized tasks also use Cohere and TypeSafe AI (Jev). The selected model depends on your plan, preferences and the feature. Relevant prompts, conversation context and authorized account content may pass through our routing services to the selected provider. Provider retention and data-use terms depend on the service and applicable routing settings. (United States and other regions)

Vercel (hosting & AI Gateway)

Application hosting and delivery. AI requests may be routed to the model provider through the Vercel AI Gateway, which passes the request through and does not train on it. (Global)

OpenRouter

AI request routing. When Otto routes a request through OpenRouter, relevant prompts and context (which can include email text you asked about) pass through its API to the selected model provider. Provider retention and data-use restrictions depend on the applicable account and routing settings; this listing does not promise zero retention for every route. (United States)

Perplexity

Powers the assistant's web-research tool. When you ask Otto to research a topic, your research query — which can include details you provide from an email — is sent to Perplexity's API to search the web and return current information. Perplexity processes this as our data processor and, per its API terms, does not use the data to train its models. (United States)

Convex

Our managed database and real-time backend. Stores account information, settings, assistant chats, mailbox metadata, saved work, private workflow files and subscription status, and powers live updates. (United States)

Google Cloud (private file processing)

Hosts Otto's private malware scanning, document extraction, OCR and file generation worker. Files selected for these features are processed temporarily; working copies are removed after processing. Saved files and extracted results are kept in Otto's Convex storage under the retention rules in our Privacy Policy. File contents are not sent to a public malware-analysis service. (United States (Iowa))

Paddle

Merchant of record for web/PWA subscriptions. Handles checkout, card processing, tax and refunds; receives your email and payment details directly (we never see your card number). (Global)

RevenueCat

Cross-platform subscription management. Reconciles entitlements and in-app purchases on iOS/Android; receives your subscription identifiers, not your payment card. (United States)

Apple & Google (push delivery)

If you enable notifications, a device token and the notification text are sent through Apple's APNs, Google's FCM or your browser's web-push service to alert your device. Most alerts are content-free “new mail” signals; a routine's push notification carries a short preview of the digest when you choose push for that routine. (Global)

Resend

Sends email from our no-reply address to your registered email: account notices (e.g. an account-deletion confirmation) and the routine digests you choose to receive by email. It receives only the recipient address and message content needed to deliver the email. (United States)

Sentry

Error monitoring and performance diagnostics to help us find and fix failures. Receives technical error reports and limited performance information. Otto removes request bodies, cookies, headers and URL query parameters from error reports before sending them. (European Union by default; depends on project configuration)

Apple (sign-in & App Store) and Google Play

Apple sign-in provides the account identity you authorize. Apple and Google process native app purchases and provide subscription records used to manage your plan. These services also operate under their own privacy terms. (Global)

PostHog

Product analytics. Records structural usage events (which features you use, onboarding steps, errors, subscription changes) and performance timings tied to your account id, plus session replays limited to public marketing, sign-in and onboarding pages, with typed input masked and private app pages excluded, so we can improve the product and its conversion flow. It never records your inbox and never receives your email content, subjects, recipients, attachments, search text or assistant messages. EU-hosted. (European Union)

We never sell your personal data, and we do not share it for cross-context behavioural advertising.

10. Data retention

• Authorization tokens are kept until you disconnect the provider or delete your account.
• In-app chats, settings, templates, rules and the mailbox metadata index are kept until you delete them or your account.
• Conversations started through connected chat services and their response-delivery records are scheduled for cleanup after 30 days; active work may be retained until it is safely settled. Compact incoming-event and delivery receipts are scheduled for cleanup after 90 days. Separately saved work follows its own lifecycle. Disconnecting a chat service stops future access but does not immediately erase these records or messages already delivered to that service. The full text of tool results stored with those conversations is reduced to references after 3 days.
• Routine digests and their per-destination delivery status are kept for 180 days. Routine run records are kept for 30 days.
• Saved commitments, prepared artifacts, meeting preferences and optional Focus rules follow the personal or organization account that owns them. A temporary job payload can expire before a saved artifact or its compact result record.
• Pending booking verification and rate-limit records expire on their own schedules. Terminal booking records are retained for up to 90 days after the meeting, subject to account or organization deletion.
• The ordinary mailbox index does not copy full message bodies. Message bodies and email attachments are normally fetched from the connected provider when needed. Selected content in a saved chat, note, shared draft, scheduled-send payload or prepared work record follows that feature’s lifecycle; it is not erased merely because a short-lived processing job expires. An explicit private-file import stores the selected attachment separately from the mailbox index. Deleting or disconnecting its source blocks future source-bound reads. Copies explicitly attached to an external draft, sent to another service or downloaded are independent copies and follow that destination’s retention rules.
• Per-feature usage counters used for rate-limiting are bounded: daily counters are pruned after 45 days.
• When you delete your account it is first deactivated and then permanently erased after a 30-day grace period, during which you may restore it. A minimal account identifier and suppression status remain to prevent delayed analytics from recreating your profile. We retry failed processor requests and periodically reconcile deletion, including after acceptance; data arriving late may remain until the next reconciliation, which is normally within 30 days when the processor is available.

11. Cookies & local storage

Otto uses cookies for sign-in and security. When product analytics is enabled, PostHog also uses cookies and local storage to recognize visits, connect usage events and measure the experience. We do not use advertising cookies. Session replay is limited to public marketing, sign-in and onboarding pages, with inputs masked; private app pages are excluded. Local storage also holds on-device preferences and demo conversations. You can clear cookies and local storage in your browser settings; clearing the session cookie signs you out.

12. Your rights

Subject to applicable law — including the GDPR/UK GDPR, India’s Digital Personal Data Protection Act 2023, and, for California residents, the CCPA/CPRA — you have the right to access, correct, export (portability), restrict, object to, and delete your personal data, to withdraw consent, and to grievance redressal. We do not “sell” or “share” personal data as those terms are defined under California law, and we will not discriminate against you for exercising any right.

You can exercise these directly in the app:

• Access & portability — export all your stored data as a file from Settings → Privacy & data.
• Erasure — delete your account (and disconnect Google) from Settings → Privacy & data.
• Withdraw consent — disconnect Google at any time.

You can also email privacy@ottomail.app and we will respond within the timeframe the law requires. You may also lodge a complaint with your local data-protection authority.

13. Security

Data is transmitted over HTTPS and stored on managed infrastructure that encrypts data at rest, with access controls. OAuth tokens are held server-side only and are never exposed to the browser. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data — and, above all, we limit what we hold in the first place.

14. International transfers

Our subprocessors may process data in countries other than yours, including the United States. Where required, such transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

15. Children

Otto is not directed to children and is not intended for anyone under 18. We do not knowingly collect data from them.

16. Changes to this policy

We may update this policy from time to time. We will update the effective date above and, for material changes, take reasonable steps to notify you.

17. Email open & click tracking (opt-in)

Otto offers an optional, Pro-only feature that lets you see when an email you send is opened and which of its links the recipient clicks. It is strictly opt-in: off by default on every message, chosen per send, and recorded only for messages you turn it on for.

Read receipts. When you enable a read receipt, Otto adds an invisible 1×1 image (a “tracking pixel”) to that message. When the recipient’s email client loads the image, we record that the message was opened and when. We record an open for the message as a whole — we cannot tell which recipient opened it — and many email clients block remote images, so an open may never register (notably for other Otto users, whose image proxy blocks such pixels).

Link clicks. When you enable link tracking, we rewrite the links in that message to pass through a signed redirect on our servers, which records the click and immediately forwards the recipient to the original, unchanged destination. Clicks are counted per link, not per recipient.

Recipients & your responsibility. Recipients are not notified that a message is tracked. The data we collect is your own send metadata and aggregate open/click counts; we do not build a profile of your recipients, sell this data, or use it for advertising. Depending on your jurisdiction and your relationship with the recipient, tracking another person’s opens or clicks may carry obligations (for example under the GDPR/ePrivacy rules) — you are responsible for using the feature lawfully. You can turn it off for any message, and account deletion erases all tracking records.

18. Contact

Questions or requests: privacy@ottomail.app.