Privacy policy

Who we are

Phinly (“Phinly”, “we”, “us”) provides Phin, an AI business manager for creators, at phin.ly. This policy explains what personal information we process when you visit phin.ly, join the founding list, use the scam checker or use Phinly with your Gmail account. Questions go to privacy@phin.ly.

What we collect

• Founding list: your email address, main platform, audience size range, the referral source of the link you used and the signup time.
• Account: your sign-in email and account identifiers from our authentication provider.
• Creator profile: display name, main platform, audience range, rates, minimums, banned categories and reply preferences you enter.
• Gmail connection: your Gmail address, the permission you granted and an encrypted Google refresh token.
• Inbox-derived data: described in the next section.
• Billing: when paid plans are live, Stripe processes your payment details. We receive your subscription status and plan, not your full card number.
• Usage and technical data: AI usage counts without email content, hashed IP addresses for rate limiting, and aggregate, cookie-free page analytics.

Gmail data: what we access and why

With your permission, Phinly uses one Google permission: gmail.readonly. It lets Phin read your messages and settings. It does not let Phinly send, delete, archive, label or change anything in your mailbox, and Phinly does not access Google Drive, Calendar or Contacts.

We use Gmail data only to provide the features you see:

• Sorting business email into brand deals, collaborations, scheduling, admin, likely scams and noise, with a short reason.
• Showing budgets that a sender stated in the email.
• Drafting replies for you to edit, copy and send yourself.
• Learning your writing style, only with your consent (you press Learn my writing style or switch it on in Settings): Phin reads a sample of up to 40 replies you sent in the last six months and stores only a short description of your style, never the emails. You can delete it at any time.
• Tracking deal progress and writing your daily brief.
• Running a one-time 90-day inbox snapshot of up to 200 recent messages.

We store message and thread IDs, sender, subject, a short snippet, timestamps, the category and reason, any budget stated, your review state, deal progress, the drafts you save and, if you asked for it, the short writing-style description. Full message bodies are fetched from Gmail when needed for sorting, reading or drafting and are not stored in our database. No person at Phinly reads your email unless you ask us to look at a specific message for support, and then only that message.

Google API Services: Limited Use

In particular, we:

• use Gmail data only to provide and improve the features described above that you can see in Phinly;
• transfer Gmail data to others only as needed to provide those features (for example, to Anthropic for sorting and drafting), to comply with law, or as part of a merger or acquisition with notice to you;
• never use Gmail data for advertising, never sell it, and never use it to build or train general AI or machine learning models;
• never let humans read Gmail data, except with your explicit consent for specific messages, where needed for security or abuse investigations, or to comply with law.

AI processing

To sort messages and draft replies, relevant email content (sender, subject and message text) is sent to Anthropic's API, which runs the Claude models. Anthropic processes it under its commercial API terms, which do not use your data to train models. Anthropic may retain API inputs and outputs for a limited period for trust and safety under its own policies. AI output can be wrong. You review every draft before using it.

How we use data

• To run Phinly for you: sorting, flagging, drafting, tracking and briefs.
• To manage the founding list, send your invite and service emails.
• To bill you when paid plans are live.
• To keep the service secure, enforce usage limits and prevent abuse.
• To answer you when you contact us.

We do not sell personal information, share it for cross-context behavioral advertising, or use your email to market to you.

Retention and deletion

• Disconnect Gmail: we delete your Gmail connection and all inbox-derived data (stored messages, drafts, digests, snapshots and inbox activity) and ask Google to revoke Phinly's access. If revocation cannot be confirmed, you can remove access in your Google Account under Security, Third-party connections.
• Delete your account: we delete everything else tied to it, including your creator profile and sign-in account. Email privacy@phin.ly from your account address if you cannot do it in the dashboard.
• 90-day snapshot: message IDs are held only while it runs and erased when it completes or fails; abandoned runs are cleared within 24 hours. Summary counts stay until you disconnect.
• Usage records: AI usage records contain no email content and are kept for 30 days to enforce limits and prevent abuse.
• Founding list: kept until you join, ask to be removed, or we close the list.
• Billing records: kept as long as tax and accounting law requires.

Backups held by our providers roll off on their own schedules, and data already sent to a provider follows that provider's retention rules.

Subprocessors

Google provides the Gmail permission and API you connect. Each provider processes data under its own terms and privacy policy.

The free scam checker

Text you paste into the scam checker at phin.ly/scam-check is checked by our rules and sent to Anthropic's API for a second read, then discarded. We do not store or log it. We keep only a hashed IP address and a count to enforce the daily limit.

Your choices and rights

You can edit your profile, correct categories, delete drafts, disconnect Gmail and delete your account at any time. Depending on where you live, you may have rights to access, correct, export or delete your personal information and to object to or restrict processing. Email privacy@phin.ly from the address on your account and we will respond within 30 days. We may need to verify your identity first. We will not treat you differently for using these rights.

Email often contains information about other people. Connect only a mailbox you are allowed to use.

Security

Google tokens are encrypted with AES-256-GCM and bound to your account. Access to production data is limited to what running the service requires. No system is perfectly secure; see our security page for details and how to report a problem.

Children, changes and contact

Phinly is not directed to children under 13, and you must be at least 18 or have a parent or guardian's permission to subscribe. We will update this page when our practices change and change the date at the top; for material changes we will also email account holders. Contact: privacy@phin.ly.