TrustMynd reads the mail and calendar entries you connect, extracts a small set of structured facts from them — an amount, a date, a vendor, a renewal — and tells you about the few that carry a consequence. This policy says exactly what we take, why we take it, where it goes, and how to make all of it disappear.
It is written to be checked rather than trusted. Where we make a claim, we have tried to make it one you can verify for yourself.
TrustMynd LLC operates the TrustMynd service at trustmynd.ai. For any question about this policy, or about data we hold, write to privacy@trustmynd.ai. We answer privacy requests within 30 days and usually much sooner.
If you connect a Google account, TrustMynd requests exactly two OAuth scopes and nothing else. One is classified by Google as a restricted scope — the most tightly governed category Google operates, which subjects us to an independent annual security assessment.
| Scope | Google’s classification | Why TrustMynd needs it |
|---|---|---|
gmail.readonly |
Restricted | To read the body of a message long enough to extract the facts inside it — the renewal date on a receipt, the new price in a change notice, the refund a vendor promised. No narrower Gmail scope permits reading a message body, and the obligations we exist to find are written in the body. |
calendar.readonly |
Sensitive | To see what is already on your calendar, so we can stay quiet about it. Most of what this scope does is suppress findings: a date already in your calendar is not something you have forgotten. |
We request read-only access only. TrustMynd cannot send, modify, label, archive or delete anything in your mailbox, because we never ask for the permission that would let us. Nor do we request contacts, Drive, or your profile beyond the address you connected. If a narrower scope would do the job, we would be required to request it — and we would.
TrustMynd’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Because TrustMynd requests a restricted scope, those requirements apply to us in full. They are restated in plain language below.
Concretely, and without exception:
Message text is sent to Google’s Gemini service to identify obligations, under terms that forbid training on it. Google may retain a prompt for up to 90 days, stored in the United States, and only where its automated abuse detection flags that prompt for human review. It is never written to our database and never appears in a log.
We state it at that length on purpose. The shorter version — “your mail is never copied into our database” — is true, and it can be misheard as “your mail never leaves your machine.” That was never true of this product and it is definitively not true now. We will never tell you your mail never leaves your machine. Section 6 names exactly who receives it and under what terms.
When we process a message we hold it in memory long enough to extract structured facts, and then it is gone. What persists is a row of typed fields — a vendor, an amount, a date, a confidence score — plus a pointer back to the message in your mailbox. That pointer is why every finding we send you can name its source.
This is checkable from your side: every finding names the email it came from, and that email is in your mailbox, not ours.
Our application logs contain identifiers, record types, counts, decisions and outcomes. They do not contain message content, subject lines, or the text of anything you send us. This is enforced in code at the single point where data is written, rather than left to the discipline of whoever writes the next feature.
Your Google refresh and access tokens, and any app-specific password you give us for a non-Google mailbox, are held encrypted at rest and used only to fetch your mail. Our database stores a reference to the secret, not the secret itself.
TrustMynd can also read a second mailbox over IMAP using an app-specific password you generate yourself, and can read a transaction export you upload. Everything in section 4 applies identically: no bodies stored, no content logged, structured facts only. For an uploaded transaction file we store the extracted rows and a hash of the file; we do not keep the file.
We use a small number of service providers, and we name them, because “trusted partners” is not a disclosure. Each is bound by a written agreement forbidding use of your data for its own purposes.
We do not otherwise disclose your data, except where legally compelled, or to protect the safety of a person. If we are ever compelled and permitted to tell you, we will.
If TrustMynd were acquired or merged, Google user data would be transferred only after we obtained your explicit prior consent, as the Limited Use requirements demand. Consent buried in an updated terms page is not consent, and we will not treat it as such.
TrustMynd is not HIPAA compliant, and we will never tell you that it is. HIPAA binds covered entities — health plans, clearinghouses and most healthcare providers — and their business associates. TrustMynd is neither, so the phrase would be meaningless as applied to us, and companies that use it anyway are usually saying something they cannot back.
What is true is that we built the data handling to the standard that regime demands, because doing it once at the start is cheaper than retrofitting: content is never warehoused, every call leaving our system passes a policy gate, every stored fact carries a sensitivity label that can escalate but never quietly downgrade, and every finding is traceable to its source. Those are engineering properties we can show you. A compliance badge is not.
We also do not sell or share your personal information as those terms are defined under US state privacy laws, and we do not engage in targeted advertising or in profiling that produces legal or similarly significant effects.
We keep your structured facts for as long as your account is open, because a renewal firing in fourteen months needs the fact we extracted today. Facts whose validity window has closed, and which no longer support any open obligation, are removed on a rolling basis.
Write to privacy@trustmynd.ai, or send the word delete on the channel you talk to us on, and we will delete your account and every row associated with it. This is a single operation in our database, by design: your data is not scattered across tables joined by convention, so there is nothing that can be missed. Deletion completes within 30 days, and within 7 days in the ordinary case. Encrypted backups are purged on a rolling 30-day cycle, after which no copy exists.
Revoking TrustMynd’s access from your Google Account permissions page stops us reading anything new immediately. It does not by itself delete what we already hold — ask us, and we will.
Whoever and wherever you are, you may ask us for a copy of what we hold about you, ask us to correct it, delete it, or stop processing it. We will not make you justify the request and we will not charge you for it. If you are in the EEA or the UK, our lawful basis is the performance of our contract with you and, for the security measures described above, our legitimate interest in operating the service safely; you may also complain to your local supervisory authority. If you are in California, you may exercise the rights described in the CCPA as amended, and we will not discriminate against you for doing so.
Data is encrypted in transit and at rest. Access to production systems is limited to the smallest possible number of people, protected by multi-factor authentication, and logged. Because we request a Google restricted scope, TrustMynd undergoes an independent third-party security assessment under the App Defense Alliance’s Cloud Application Security Assessment (CASA) framework, repeated at least once every twelve months for as long as we hold that access.
No system is perfectly secure. If we discover a breach affecting your data, we will tell you and the relevant authorities within the time the law requires, and we will tell you what actually happened rather than what sounds best.
TrustMynd is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has connected an account, write to us and we will delete it.
If we change this policy in a way that materially affects how we handle your data, we will tell you on the channel you already talk to us on, before the change takes effect — not by silently updating a date at the top of a page. Every version is dated, and we keep the old ones.