How FollowUpEasy handles your data

How FollowUpEasy uses your mailbox

We use your email history to find people you may want to reconnect with, explain where you left off, and help you write a follow-up. Selected conversation excerpts go to Fireworks AI for AI processing. The sections below explain what we read, what we keep, and when copies are deleted.

You review and edit drafts in FollowUpEasy and choose whether to save them to Gmail or Outlook. You send each email yourself. FollowUpEasy does not send emails to your contacts or call delete-email operations.

Microsoft permissions

Microsoft does not offer a draft-only delegated permission. FollowUpEasy requests mail read/write access so it can understand your mailbox and save drafts you approve. It does not request mail-send permission and does not call send or delete-email operations. Mail.ReadWrite is broad access; we also request User.Read and identity and ongoing-access scopes. You review each draft before it is saved and send it yourself. Until you disconnect, we can continue to access mail.

What we skip

We use broad message metadata to find relationships. We filter these from relationship evidence:

• Newsletters and mailing lists
• Automated notifications such as GitHub and Slack updates
• Marketing and transactional emails
• One-way bulk messages
• General attachments are not opened for analysis. Calendar-invite parts can supply meeting dates; we do not access your separate calendar service.

What data we access

• Message headers and metadata across the sent and received history included in your reading (sender, recipient, date, subject line). Used to identify relationships and measure how long they've been quiet.
• Email message content (selected messages). Relevant portions of conversation threads with contacts that qualify for judgment are processed to generate relationship summaries and draft follow-ups. Selected new replies may also be read to check whether a commitment was fulfilled. To learn your writing style, a small sample of your own recent sent messages is also read; those raw emails aren't kept, but a few example sentences from them are stored in your style profile (so drafts sound like you), and excerpts are sent to Fireworks AI to build it. We do not make copies of your full mailbox.

What data we store

• Contact records for the relationships in your map (name, email, last contact date, and the judged relationship summaries and prose shown on your desk)
• Conversation excerpts from threads with contacts our scan selects for judgment, used to generate summaries and drafts — up to roughly 1,500 characters per selected message, which for a short message can be its full text. Context saved for contacts the judge decides are not substantive relationships is currently retained too, until you delete your account. We do not make copies of your full mailbox.
• Generated drafts created for your review
• Style profile derived from a sample of your own recent sent messages — a description of how you write, plus a few characteristic example sentences quoted from that mail, used to make drafts sound like you
• Suppressed contacts you've dismissed, so we don't resurface them
• Account and billing records — your email address, subscription status, and Stripe billing references. Card details live with Stripe; we never see the full number.

What we never store

• A copy of your mailbox, or message content beyond the per-message excerpt cap above
• Attachments

How we protect your data

• Encryption in transit — All connections to FollowUpEasy use HTTPS/TLS encryption. Data transmitted between your browser, our servers, and third-party APIs (Google, Microsoft and Fireworks AI) is encrypted in transit.
• Encryption at rest — Stored data (contact records, conversation excerpts, drafts, style profiles) is held in a managed PostgreSQL database with encryption at rest enabled.
• OAuth token security — Google and Microsoft OAuth credentials are stored securely and used only to access your connected mailbox. When you disconnect, we delete our copy immediately. For Google we also ask Google to revoke the grant. For Microsoft the grant remains until you remove it in your Microsoft account or through your administrator; see Microsoft access removal. Deleting our copy is entirely up to us and always happens; the revocation is a request to Google, so if Google is unavailable it can fail — you can always revoke access yourself at Google Account Permissions, which is final either way.
• Access control — No user can access another user's data. Administrative access is limited to the application operator for debugging, support, and security/maintenance purposes.
• Minimal data retention — We store only the data needed to provide the service: capped conversation excerpts, judged summaries, drafts, and your style profile. Never attachments, never a copy of your mailbox.
• No data sharing or selling — Your data is never sold, shared with advertisers, or used for purposes other than providing the FollowUpEasy service.
• No training by FollowUpEasy — We do not train AI models on your email. Fireworks documents its handling of open-model prompts and responses in its data policy. Our stored batch datasets follow the retention process below.

Data retention

Fireworks AI processes selected thread excerpts for AI features, including relationship assessments, map regions, writing style, drafts, rewrites, and factual checks. Its synchronous open-model API does not persist prompts or responses by default; our native batch workflow separately uploads stored datasets. Batch input and output datasets are stored copies. We keep them while work is active or paused for recovery. Once work ends and the datasets are at least seven days old, they enter our daily deletion queue. Deleting your account queues provider deletion immediately, but pending provider jobs must finish before their datasets can be removed. Failed deletions remain queued for retry. These copies are not removed immediately with the live application data. Fireworks usage metadata may remain under its own retention policy.

Your data is retained while your account is active. When you delete your account, it is removed immediately from the live application; encrypted database backups that may still contain it roll off within a few days. Excerpts already sent to Anthropic for AI processing are deleted from Anthropic's systems within Anthropic's standard retention window (batched judging: up to 29 days; other API traffic: up to 30 days), subject to legal and abuse-prevention exceptions under which Anthropic may retain flagged inputs longer.

We never send anything on your behalf

FollowUpEasy creates drafts in your connected Gmail or Outlook mailbox after you approve them. You send from your own inbox.

Revoking access and deleting data

You can disconnect your mailbox or delete your account at any time from your account settings. Account deletion will:

• Delete our saved mailbox credentials immediately. We request Google revocation; Microsoft grants must be removed separately
• Delete all stored data (scan results, drafts, conversation excerpts, style profile)
• Sign you out

Drafts you already saved or sent in Gmail or Outlook remain in your mailbox. Disconnecting alone keeps your saved FollowUpEasy work and does not cancel billing. You can also revoke access directly from Google Account Permissions.

Third-party services

FollowUpEasy uses the following services to operate:

• Microsoft Graph API — to read mailbox metadata and selected content, and create or update approved Outlook drafts.
• Google Gmail API — to read email metadata and content, and to create drafts in your Gmail account.
• Anthropic Claude API (earlier processing) — New AI work uses Fireworks AI. Excerpts from earlier work may still be held by Anthropic. Anthropic retains API content for up to 30 days under its standard policy, subject to legal and abuse-prevention exceptions. Anthropic does not use API inputs to train models.
• Fireworks AI — AI processing for assessments, map regions, writing style, drafts, rewrites, and factual checks. Selected conversation excerpts are processed through its open-model API and native batch service. Batch datasets follow the deletion process above. See Fireworks data handling.
• Render — cloud hosting provider where the application and its database run.
• Cloudflare — CDN and edge network in front of the site; sees requests in transit to route and protect them.
• Stripe — payment processing for subscriptions. Your card details go to Stripe directly; we never see the full number.
• Resend — delivers the emails we send you (scan notifications and your weekly reading). Those emails include lines from your map, so Resend processes them in transit.
• PostHog — product analytics. Receives your account email address as the analytics identifier plus product events (pages viewed, actions taken). No email content is sent to PostHog.

Contact

Questions about how we handle your data? Email Dave directly: dave@followupeasy.com.