Privacy

What we keep

Your name, email address and picture from Google, so you can sign in. Whatever you put into the sections you turn on. If you connect a bank: your accounts, balances, transactions and debts, through Plaid. If you connect Gmail: what the next section says, and nothing more.

Your Gmail

Connecting Gmail is your choice, made in Inbox → Settings, and Google asks you to agree to two permissions:

• Read your email (gmail.readonly). Each weekday morning, and when you press Sweep my inbox now, The Poindex reads messages from the last day of your inbox. It sorts them into what needs a reply today, what can wait and what needs nothing, writes a one-sentence summary of each, and drafts a reply to the ones that need one. The same sweep picks out receipts and order confirmations and files them in Household as receipts: the shop, the date, the items, quantities and prices. You can also ask it to sweep your receipts with a search of your own, such as one shop's orders over the past year. It never changes, labels, archives or deletes anything in your mailbox. It has no permission to.
• Send email as you (gmail.send). Used only when you press Send on a reply you have read, and edited if you wanted to. That one message goes from your address, in the same thread as the email it answers, and shows in your Gmail Sent folder like any reply. Nothing is ever sent automatically or in bulk.

What is kept. For each message it sorts: who sent it, the subject, when it arrived, the Gmail ids needed to reply in the same thread, the summary, a short excerpt, and any reply drafted, with each version you edited. For each receipt: the shop, date, totals and item lines as printed. The full text of a message is held only for the length of one sweep and then discarded. It is never stored.

Who processes it. The text of each message is sent to Anthropic's Claude API to sort it, summarise it and draft the reply. A receipt from a shop The Poindex has no reader for is sent there too, to read its lines. Anthropic processes it to give that answer back and does not use it to train its models. The Poindex runs on Cloudflare, which stores the records above. Google carries the reply you send. Nobody else receives your Gmail data.

How it is protected. Everything travels over HTTPS and is encrypted at rest. The key Google issues for your mailbox is sealed on its own (AES-256-GCM), tied to your account, and used only for these two things. Only you can read your Inbox. Receipts are filed to your household, where its members see them, like anything else in Household.

How long, and how to delete it. Sorted mail and drafts stay in your Inbox until you remove them or the mailbox. Disconnecting in Inbox → Settings tells Google to revoke The Poindex's access at once and deletes its key. Removing the mailbox there deletes everything that was sorted from it. Receipts stay in Household as your household's records until you delete them. You can also remove The Poindex's access from your Google account at myaccount.google.com/permissions. See Data deletion for your whole account.

Limited Use. The Poindex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Gmail data is used only to give you the features above. It is never used for advertising, never sold, never used to decide on credit or lending, never read by a person unless you ask for help with your own account, a law requires it or it is needed for security, and never used to train AI models, ours or anyone's.

The bank-linking waitlist

If you ask on thepoindex.com to be told when bank linking opens: your email address, where you came from if the link said so (for example a YouTube video), and when you asked. It's used for that one email, and nothing else. No cookie is set and your IP address isn't kept. To be taken off, write to the address at the bottom of this page.

Social

If you connect an Instagram or X account to Social: an access token for it, your account ID and username, the posts you choose to bring in, and their numbers (views, likes, comments, shares, saves). Social only reads; it never posts for you. Poindexter's reads of an account are written by Anthropic's Claude API, which is sent that account's posts and numbers for the read and does not train on them.

Talking to Poindexter

When you talk to Poindexter, what you say is turned into text by Deepgram's speech model running on Cloudflare, and his answers are spoken the same way. The recording is not kept. The text goes to Anthropic's Claude API to work out what to file, and Claude does not train on it. The conversation on his button stays in your browser tab; what he files is kept in the section it belongs to, like anything you add yourself.

“Hey Poindexter” is off unless you turn it on, on each device. When it is on, listening for the phrase happens on your device, in your browser, using the open-source Vosk engine and a speech model it downloads once (about 41 MB) from thepoindex.com: no sound leaves your device until you have said it. Then what you say, from the phrase to when you stop talking, is sent exactly as if you had tapped Talk, and the phrase is taken off before Poindexter reads it. It stops listening when you leave the page.

Deleting it

See Data deletion.

What we don't keep

Your Google password or your bank password. Neither ever reaches The Poindex. Nothing of yours is sold, shared for anyone else's use, or used to train anyone's AI models.

Who can see it

You. The code is built and tested so that no other account can read your records.

Questions

Write to James at james@james-poindexter-iv.com.