Privacy Policy
Effective August 5, 2026 · Brilliance Digital
The short version: we never store your mail. Linen syncs your mailbox directly from your provider into a database on your device, encrypted from app version 0.1.3 (earlier versions store it unencrypted). Our servers handle your account, your subscription, and your preferences; they are built so that message content cannot reach them.
What we store
- Your account. Name, email address, and a hashed password (or your OAuth identity). Device records for the devices you connect.
- Billing. Subscriptions are processed by Stripe or PayPal, whichever you choose. We keep plan and subscription status; your card number never touches our servers.
- AI credit ledger. Reserve and settle entries with token counts and timestamps: numbers only, never the text you worked with.
- Sender screening rules. Normalized addresses or domains you have accepted or blocked, so decisions follow you across devices. Never message content.
- The encrypted vault, if you opt in. Ciphertext blobs encrypted on your device with keys derived from your 12-word recovery phrase. We cannot read them, and we hold nothing that can decrypt them.
- Support conversations. Emails you send to support@linen.email.
What we never store
Message bodies, subjects, previews, attachments, contact lists, or mailbox structure. Your mailbox credentials (OAuth tokens, IMAP passwords) live in your device's platform keystore (Keychain, Credential Manager, Keystore, or Secret Service), not in our database. The one exception is the opt-in vault described above: it holds a copy of those credentials encrypted on your device, which we cannot decrypt.
AI, only on request
Nothing is sent to any AI model unless you explicitly ask. When you do, only the text you selected travels through our gateway to the model you chose, over zero-data-retention routing. We record how many tokens the request used for billing; we do not log the content. If you bring your own key, requests go to your provider under your terms.
Connecting a Google or Microsoft account
Linen is the client. When you connect a mailbox, the app on your device obtains the access it needs and keeps it in your platform keystore. Those credentials are never sent to our servers in readable form: if you turn on the multi-device vault, only a copy encrypted on your device with your recovery phrase is uploaded, and we cannot decrypt it. Your mail is read by the app in front of you and not by anything of ours.
These are the permissions Linen asks for, and the only reasons it asks:
- Gmail (
gmail.modify). Read your mail to show it to you, and write back the things you do to it: read state, labels, drafts, and sending. It cannot delete anything permanently. - Google Calendar (
calendar.events). When you accept a meeting invitation, put that event on your calendar. Nothing else on your calendar is read or changed. - Microsoft Graph (
Mail.ReadWrite,Mail.Send,Calendars.ReadWrite). The same two jobs on an Outlook or Microsoft 365 account. - Sign-in (
email,profile,User.Read). To show which account is connected.
Linen's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, and for Microsoft account data equally: we do not use your mail or calendar data for advertising, we do not transfer it to anyone for advertising or to build profiles, we do not sell it, and no human at Brilliance Digital reads it. The only exceptions are the narrow ones that policy allows: with your explicit permission, where necessary for security investigations, or where the law requires it. Because the content is on your device and not on our servers, we could not read it at will even if we wanted to.
You can disconnect an account at any time inside Linen, which discards the stored credentials, or revoke access from your Google account permissions or Microsoft privacy dashboard.
No ads, no trackers
We do not run advertising, analytics trackers, or third-party scripts on this site. Fonts are self-hosted. The client strips every remote image from incoming mail before rendering, so senders cannot track your reading.
Sub-processors
Stripe and PayPal (payments), our cloud hosting provider (account data), and, only when you invoke an AI action, the model provider you selected. Google and Microsoft are not sub-processors: your mailbox stays between your device and them.
Retention and deletion
Delete your account and we remove your account rows, sender rules, and vault ciphertext within 30 days; ledger entries required for accounting are kept only as long as tax law demands. Because your mail was never here, there is nothing else to delete; your mailbox remains untouched at your provider and on your devices.
Your rights
You can request a copy of the data we hold about you, correct it, or delete it by writing to support@linen.email. We answer within 30 days.
Changes
If this policy changes in a way that matters, we will email account holders before the change takes effect. The current version always lives at this address.