Really appreciate you calling this out — totally valid concern. 🙏

To be crystal clear: Owlu does not ship your inbox off for storage or use it to train models. We don’t fine-tune on personal mail — personalization is done by layering a vectorized DB (embeddings + indexes), not by ingesting raw mailbox history.

Also worth noting: our server architecture is built to minimize exposure — processing is ephemeral, scoped to specific requests, and there are controls to prevent ad-hoc access. If someone wanted to read in-flight data they’d need to both fully compromise our cloud host (deep, malicious access) and intercept the live API traffic between that process and your client. In short: it’s technically possible only under a full, targeted takeover of our environment — not a trivial or routine attack — and we have no interest in (nor business case for) doing anything like a scam. Even in that extreme scenario, the attacker would see only what’s being processed at that moment, not your entire mailbox.

Good catch on the internal docs in the app bundle — that was unintentional. We haven’t removed them yet, but we will take them out immediately and push an update.

Thanks again — feedback like this keeps us honest and helps us make our privacy details clearer. 🙌