Your inbox, handled carefully.
Phin needs to read your email to find the money in it. Here is exactly what that means, written from the code, not from a marketing deck.
The facts
If anything here changes, this page changes first.
- Gmail access
- Read-only. Phinly requests one Gmail permission, gmail.readonly. There is no send, delete, archive or label permission, so Phin cannot change your mailbox even by mistake.
- Google sign-in token
- Encrypted with AES-256-GCM before it is stored. The key lives only in server configuration, and each token is bound to your account, so a copied token will not decrypt for anyone else.
- What we store
- Sender, subject, a short snippet, dates, the category Phin chose and its reason, your drafts and deal progress. Full email bodies are fetched from Gmail when needed and not kept in our database.
- Disconnect
- Disconnecting Gmail deletes your stored inbox data: messages, drafts, digests, snapshots and inbox activity. We also ask Google to revoke Phinly’s access.
- The 90-day snapshot
- Ephemeral. It reviews up to 200 recent messages from the last 90 days. Message IDs are held only while it runs and erased when it finishes; only summary counts remain.
- People
- No human at Phinly reads your email. Sorting and drafting are automated, and you see the result.
- AI processing
- Email text is processed by Anthropic’s API (Claude) to sort messages and draft replies, under Anthropic’s commercial API terms, which do not use your data to train models.
- Activity log
- Every email Phin reads, sorts, flags or drafts for is recorded in an activity log you can review in your dashboard.
- Abuse protection
- Per-account limits on AI usage, rate limits on public forms, and bot checks on sign-ups and the scam checker.
Verification status
- Google verification
- In progress
- Gmail read access is a restricted Google permission. Until Google completes its review, including an independent security assessment, you will see a notice on the Google sign-in screen and Phinly is limited to 100 users.
- Certifications
- None yet. We do not claim SOC 2, ISO 27001 or any external audit.
What we do not claim
AI can misread an email. A scam flag is a warning, not proof, and a clean result is not a guarantee. Deleting data in Phinly does not erase copies Anthropic or other providers keep under their own retention rules. Our privacy policy lists every provider.
Found a problem?
Report security issues privately to security@phin.ly. Please do not include anyone else’s email contents. We will reply and keep you posted while we fix it.
Read-only, approval-first, no commission.
Founding price for the first 100 creators.