Privacy Policy

1. Overview

Nem is a personal AI assistant. It runs as a desktop app on your Mac and a hosted service ("the Nem Runtime") that the app talks to. This policy explains what data Nem collects, why, how it is used, who it is shared with, and the choices you have — including a dedicated section on Gmail, because reading and organising your mail is one of the most sensitive things Nem is asked to do.

"Nem," "we," "us" and "our" mean the team that operates Nem. Where this policy needs a registered legal entity name, trading address or governing jurisdiction, those fields are marked [to be completed by Nem's legal owner before publication] below rather than invented.

2. Information we collect

Nem collects different categories of data depending on what you connect and how you use it:

• Early-access requests. When you request an invite, we store your email address, your interest in personal or team use, and when you requested access. We use these details to manage requests and contact you about early access. Requesting an invite does not create an account or subscribe you to a newsletter.
• Account information. Email address and authentication data, managed through Nem's authentication provider (Supabase Auth). Sign-in with Google is handled separately from Gmail access — see §3.
• Context (your remembered information). The people, projects, commitments and preferences Nem learns about as you use it — derived from what you tell it and from connected sources, with provenance kept so you can see where a fact came from.
• Connected-app data. If you connect Gmail, Slack, iMessage (via Nem's Photon channel integration), calendar or other connectors, Nem reads the data those integrations need to do their job. Each connector has its own scope; connecting one does not grant access to another.
• Billing information. If you subscribe to a paid plan, payment is processed by Stripe. Nem does not store your card number; it stores subscription status and identifiers Stripe provides.
• Usage and diagnostic data. Product analytics (via PostHog) and operational logs, used to keep Nem working and to understand which features are used. Diagnostic logs are designed to exclude message content, access tokens and other sensitive payloads — see §7.
• Voice data. If you use Nem's voice features, audio is processed through ElevenLabs to provide speech capabilities.
• Support communications. Anything you send us directly when you contact support.

3. Gmail and Google Account data

This section exists because Gmail is the most sensitive data source Nem can connect, and because Google requires app developers to disclose exactly this. Read it even if you skip the rest of this policy.

Signing in with Google is not the same as connecting Gmail

You can sign in to Nem using your Google account. That only confirms your identity — it does not give Nem any access to your mailbox. Reading, organising or sending mail requires a second, separate step: explicitly connecting Gmail from Nem's Email settings, which takes you to a distinct Google consent screen listing the exact permissions below.

Exactly what Nem asks Google for

gmail.modify is the only Gmail permission Nem asks for. It is the narrowest single Gmail scope that covers everything above, sending included, so Nem does not additionally request gmail.send — that would be a second permission for something it can already do. Nothing broader is requested either: Google's widest Gmail scope, https://mail.google.com/, would also allow permanently deleting your mail, and Nem never asks for it.

Alongside it, Google's sign-in step shows its own basic account access — openid and userinfo.email — which tells Nem which mailbox you just authorised, so it can label the connection correctly. Nem does not request access to your Google Contacts, your Drive, your Calendar or any other Google product through this screen.

What Nem stores from your mailbox

• Always stored (for a connected mailbox): mailbox structure and labels; thread and message metadata — sender, recipients, subject, date, and a small set of headers used to detect mailing-list/unsubscribe signals.
• Stored when you open a message: the full message body. Nem does not download or store the body of every message in your mailbox up front — only when you actually read it. This keeps a newly connected mailbox from becoming a second copy of years of archived mail.
• Nem's own understanding, stored separately from Gmail's: Nem's classification of a message (for example, which of your labels or priorities it belongs under) is kept in its own table, clearly separated from Gmail's own label data, so Nem's interpretation is never confused with the provider's ground truth.
• Not stored: a bulk copy of your mailbox, attachment contents beyond what a feature you used actually needed, or your Gmail password (Nem never sees it — authentication happens entirely through Google's own sign-in page).

How sync and push notifications work

Nem asks Google to notify it (via Google Cloud Pub/Sub) when your mailbox changes. That notification carries no message content — it is only a signal that something changed. Nem then makes its own authenticated call back to the Gmail API to fetch exactly what changed. Nem verifies the cryptographic signature, issuer, audience and identity of every push notification before acting on it, and refuses ones it cannot verify.

Sending mail

Nem can prepare a reply or a new message, but it will not send anything without your explicit, informed approval of the exact recipients, subject and body. That approval is bound to the specific content you approved — if anything about the message changes afterward (a different recipient, a different sentence, even a swapped attachment under the same filename), the approval is invalidated and you are told what changed. No automation inside Nem — including Workflows that run automatically — can approve a send on your behalf.

Incoming mail is never treated as instructions

The content of an email you receive is data Nem shows you — never a command Nem follows. Email HTML is stripped down to a safe, minimal set of formatting (scripts, forms and tracking elements are removed entirely), and remote images are blocked by default so a sender cannot use them to confirm you opened their message. If an email contains text designed to look like an instruction to an AI system, Nem treats it as quoted content to show you, not as authority to act.

Disconnecting Gmail

You can disconnect a Gmail account from Nem's Email settings at any time. Disconnecting does two things immediately: Nem asks Google to revoke its access token, and Nem permanently deletes the connected mailbox's data from its systems — the account record and everything associated with it (synced threads, messages, classifications, drafts). This is a real deletion, not a hidden or paused connection.

Credential storage

The OAuth credential Nem receives from Google (a refresh token) is encrypted (AES-256-GCM) before it is ever written to storage, and is kept in a separate, restricted store from your mail data — it is never exposed to the desktop app's interface, included in diagnostic logs, or visible to support tooling.

Google API Services User Data Policy

4. How we use information

Nem uses the information described above to:

• provide the core product — showing your mail, calendar, messages and tasks in one place, and helping you act on them;
• build and maintain your Context — the durable memory that lets Nem answer questions like "what do I owe Sarah" instead of you having to search for it yourself;
• generate suggested replies, summaries and other AI-assisted output, always subject to your review or approval for anything consequential;
• operate, secure, and improve the service — including debugging, fraud/abuse prevention, and understanding aggregate feature usage;
• communicate with you about your account, and respond to support requests;
• manage invite requests and contact you when early access is available;
• meet legal obligations.

We do not sell your personal information, and we do not use your mail content for advertising.

5. AI processing

Some Nem features — classification, reply preparation, summarisation — work by sending a bounded amount of relevant content to an AI model provider (currently OpenAI, via its API — not the consumer ChatGPT product). What is sent is deliberately limited: for mail specifically, quoted history in long threads is stripped before it reaches a model, attachments are not sent to a model, and only the content a feature actually needs is included.

Content sent to our AI provider is processed under that provider's API business terms, which — as of this policy's last review — do not use API inputs or outputs to train their models. Because this depends on a third party's current contractual terms rather than something Nem's own code can guarantee, we review this commitment periodically and will update this section if it changes.

6. Third parties we work with

Nem uses the following providers ("subprocessors") to operate the service. Each receives only the data it needs to perform its function.

If you connect optional integrations (for example, Slack or iMessage via Nem's Photon channel integration, or other connectors through our connector platform), those providers process the data each integration requires — only after you connect them, and only for the scope you authorised.

7. Security

Nem's security posture, as implemented today:

• Encryption in transit. All communication between the Nem app, the Nem Runtime, and connected providers (including Google) uses TLS.
• Encryption at rest for sensitive credentials. OAuth refresh tokens (including your Gmail credential) are individually encrypted (AES-256-GCM) before storage, and are never stored alongside the mail data itself.
• Tenancy isolation. Your data is protected by database-level row-level security rules that scope every read and write to your own account. Client applications cannot read or write another user's rows, and sensitive mutations are restricted to Nem's own service layer.
• Fail-closed design. Where a feature's required configuration or verification is incomplete or unavailable (for example, Nem's Pub/Sub push endpoint cannot verify a notification's authenticity), Nem refuses the action rather than degrading to an insecure default.
• Least-privilege access. Sensitive credentials are not exposed to the desktop app's interface, product analytics, or support tooling.

No system is perfectly secure, and this section describes current practice rather than a guarantee. If you believe you have found a security issue, please contact us at the address in §13.

8. Retention and deletion

Different categories of your data have different, specific deletion mechanisms today:

• Early-access requests. You can ask us to remove your request and email address by contacting us at the address in §13.
• Gmail data. Kept for as long as the mailbox is connected. Disconnecting it (§3) deletes it immediately and permanently, and revokes Nem's access with Google.
• Context (remembered information). You can erase your entire Context from any device at any time; this is a real, immediate deletion of the derived records, not a hide-and-keep.
• Account closure. If you want your account and all associated data deleted rather than disconnecting individual pieces, contact us at the address in §13 and we will process the deletion. We are completing a fully self-service "delete my account" control; until it ships, deletion on request is handled directly by the team rather than by an in-app button.
• Billing records. Where retention is required for tax, accounting or fraud-prevention purposes, we retain the minimum billing records necessary for that purpose even after other data is deleted.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise many of these directly in Nem today (disconnecting a connector, erasing Context); for anything else, contact us using the details in §13 and we will respond within a reasonable time and in line with applicable law.

10. Children's privacy

Nem is not directed at, and is not knowingly used by, children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. International data transfers

Nem's infrastructure providers may process data in countries other than your own. Where this policy requires a specific list of processing regions or transfer mechanism (e.g. Standard Contractual Clauses), that detail is [to be completed by Nem's legal owner] based on the current hosting configuration at time of publication.

12. Changes to this policy

We will update this page as Nem's data practices change, and update the "Last updated" date above. Material changes affecting Gmail data handling will be reflected here before they take effect.

13. Contact us

Questions about this policy, or a request to access, correct or delete your data: privacy@trynem.com. General support: support@trynem.com.

[Registered legal entity name, business address and governing jurisdiction to be added by Nem's legal owner before this policy is treated as final.]