Privacy policy

Last updated: November 6, 2026 · Deutsche Fassung (the German version is authoritative)

1. Controller

Levin Keller
Hohenzollerndamm 152
14199 Berlin
Email: post@levinkeller.de

2. What this is about

Swavo (app.swavo.de) is a privately run mail service with webmail, calendar, contacts and an AI assistant. Accounts are by invitation only. This policy describes what data the service processes, in particular when you connect a Gmail mailbox.

3. Sign-in and account

You sign in directly at Swavo with a passkey or a linked Google, GitHub or Microsoft account; for emergencies you provide a recovery address at another provider. We store your identifier, email address and name, a session (cookie mg_session, strictly necessary, valid until 30 days after last use) and your settings.

4. Connecting Gmail: what the service accesses at Google

Connecting is optional and started by you in the settings. You sign in with Google and grant these permissions:

• openid and email: your Gmail address, so the right mailbox is connected and your mail can be sent with this address as the sender.
• https://www.googleapis.com/auth/gmail.modify: reading all messages with attachments and labels, and the change history; changing labels (e.g. Inbox, Spam, your own labels), read and starred state; moving messages to Trash and back; sending messages on your behalf. The service never deletes messages permanently.

Purpose: the service keeps a synchronized copy of your mailbox so you can search, read, organize and answer it here. Changes you make here (read, starred, folders/labels, spam, trash) are written back to Gmail; deleting means "Trash" in Gmail. You send through Gmail, so sent mail also appears in Gmail's "Sent". New mail is fetched from Gmail about once a minute. Gmail drafts and chats are not synchronized.

The AI assistant can read mail and create drafts. Sending, moving, deleting and other changes by the AI need your explicit approval; only you send.

5. What is stored, and where

• Messages (complete, with attachments) in Cloudflare R2 object storage with EU jurisdiction.
• Index and search data (subject, sender, recipients, text, labels/folders, state) and search vectors in your account's database (a Cloudflare Durable Object with EU jurisdiction).
• Access to Google: the refresh token, encrypted (AES-256-GCM) in your account's database in the EU; short-lived access tokens only in memory. Tokens are never logged.
• Sync state: which Gmail message corresponds to which copy, its labels and Gmail's history position.

All stored data stays in the EU. Logs contain error types and counters only, never mail content, addresses or tokens.

6. Sharing

Gmail data is not sold, not used for advertising and not used to train generalized AI models. The only recipients are these providers, each for the stated function:

• Cloudflare, Inc.: hosting (servers, storage with EU jurisdiction, queues), as a processor.
• Lyceum Technology (data centers in the EU; as a fallback possibly OVHcloud, EU): computing search vectors from mail text for semantic search.
• Anthropic (Claude), only if you connect Claude to your account yourself: Claude then reads the mail you ask it about in order to answer you. Anthropic is based in the USA.
• Your push services (e.g. Google, Apple, Mozilla), only if you turn on notifications: encrypted notices of new mail, with sender and subject if you choose so.
• Spamhaus (block lists), if configured: lookups of IP addresses and domains from the headers of new mail, via DNS queries to Cloudflare.

Attachments may be passed to the same operator's documents service if it is set up for your account (never spam).

7. Google API Services User Data Policy

Swavo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the user-facing features described above. No human reads it unless you explicitly ask us to, it is necessary for security purposes (such as investigating abuse), or it is required by law.

8. Retention and deletion

• Disconnect: in the settings under "Gmail" you can disconnect at any time. The service then revokes its access at Google and immediately deletes the token and the sync state. You can also remove access at Google: myaccount.google.com/permissions.
• Copies already made stay in your account until you delete them or ask for your account to be deleted.
• Backups: daily database backups are kept for 9, 35 or 331 days depending on their tier; deleted messages are removed from storage for good after 340 days. Until then deleted data may still be contained in backups, which are used only to recover from failures.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection authority. The legal basis is Art. 6(1)(b) GDPR (providing the service you asked for) and, for the Gmail connection, also your consent given at Google (Art. 6(1)(a) GDPR), which you can withdraw at any time by disconnecting. Contact: post@levinkeller.de.