Quill Brief

Privacy Policy

Quill Brief (“we”, “our”, “us”) is an iOS app and related online service that helps you sync mailboxes and generate AI-assisted daily briefs. This Privacy Policy explains what personal information we collect, how we use and disclose it, how long we keep it, and the choices and rights available to you. Depending on where you live, this may include rights under the EU GDPR, UK GDPR, California CCPA/CPRA, other U.S. state privacy laws, Brazil’s LGPD, Canada’s PIPEDA, Australia’s Privacy Act, and related rules such as the EU ePrivacy framework and EU AI Act transparency expectations for AI features.

This document is a product privacy notice, not legal advice. Thresholds and obligations can depend on your location and our size / processing activities. If our practices and this Policy conflict, this Policy controls for the topics it covers until we publish an update.

Notice at collection

At or before we collect personal information (for example when you create an account, connect a mailbox, import contacts, generate a brief, or use the website), we collect the categories described below for the purposes listed in this Policy. We do not sell personal information and do not “share” it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. Retention for each category is described under Retention.

If you do not want us to collect mailbox credentials or message content, do not connect a mailbox. If you do not want AI providers to process message excerpts, do not use generate / AI compose features.

Categories of personal information

Depending on how you use Quill Brief, we may collect:

Identifiers — Quill Brief account email, display name, user id, sign-in provider identifiers, device / installation identifiers, and optional Apple Push Notification service (APNs) tokens.
Customer records / account information — authentication session data, mailbox connection metadata (host, username, folder selection, sync cursors), and encrypted mailbox credentials needed to sync.
Mail content — message metadata and body content needed to list, open, search, compose, and summarize mail (treated as personal information; may also include sensitive personal information depending on what is in your mail).
Contacts — email addresses and optional display names you import, add, or send to, stored on your Quill Brief account for compose convenience.
Commercial information — App Store product identifiers, subscription / entitlement status we verify with Apple, and generate / compose usage counters tied to your account.
Internet or electronic activity — app interaction events (for example screen views and feature taps) and diagnostic / crash logs.
Inferences — limited operational inferences such as plan / quota band derived from entitlements and usage (not advertising profiles).
Sensitive personal information (CCPA/CPRA) — mailbox credentials (account log-in information); contents of mail and AI prompts/outputs that may reveal private communications; and, if present in mail you sync, other sensitive data you chose to store with your mail provider. We use sensitive personal information to provide the core service you request (sync, display, summarize, compose) and related security, fraud prevention, and debugging — not to infer characteristics for advertising.

We do not intentionally collect precise geolocation, biometric templates, government ID numbers, or payment card numbers. App Store payments are processed by Apple; we receive subscription entitlement signals, not your full payment card data.

Sources and purposes

Sources

Directly from you (account, preferences, contacts you select, compose content).
Your connected mail providers (via IMAP/SMTP or similar protocols you authorize).
Apple (Sign in with Apple where used, App Store / StoreKit purchase and restore receipts, APNs).
Google (Google Sign-In where used).
Your device / OS (installation identifiers, push permission state, crash diagnostics).
Service providers that support hosting, email delivery (for example one-time passcodes), AI inference, and crash/analytics tooling.

Business purposes

We use personal information to:

Create and secure accounts, authenticate sessions, and prevent abuse.
Connect mailboxes, sync and display mail, search, and send mail you compose.
Generate AI briefs and AI-assisted compose output using providers you select or that are available on your plan.
Store short-lived daily briefs for the Today experience and enforce usage limits.
Verify and honor App Store subscriptions and entitlements.
Send transactional messages (for example sign-in or delete-account OTP codes) and optional push notifications you enable.
Operate, debug, secure, and improve reliability of the app and servers (including crash reporting).
Comply with law, respond to lawful requests, and enforce our Terms.

We do not use personal information for cross-context behavioral advertising.

Disclosure to service providers and other parties

We disclose personal information to “service providers” / “processors” that help us run Quill Brief, under contracts that limit use to our instructions, for example:

Cloud hosting and infrastructure — to run the API, workers, and storage.
AI model providers / gateways (such as vendors reached directly or via a routing gateway like OpenRouter) — to generate summaries or compose suggestions from the content required for that request.
Transactional email providers — to deliver OTP and similar service emails.
Apple — App Store billing, push delivery, and related platform services.
Google — Sign-In where you choose that method; Firebase Analytics and Crashlytics for aggregated product analytics and crash diagnostics.
Your mail provider — when we sync or send mail using credentials you provided.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger, acquisition, or asset transfer (with notice where required). We do not disclose personal information to data brokers for their independent marketing use.

In the preceding 12 months we have not sold personal information and have not shared personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not have actual knowledge of selling or sharing personal information of consumers under 16.

Because we do not sell or share personal information, a “Do Not Sell or Share My Personal Information” opt-out link is not required for that purpose. If that ever changes, we will update this Policy and provide the required notice and opt-out mechanism (including honor for Global Privacy Control signals where applicable).

AI processing

When you generate a brief or use AI compose, necessary message content and prompts are processed on our servers and may be forwarded to the configured model provider to produce output. We aim to send only what is needed for that task. Model providers process data as our service providers for inference; their own retention of abuse-monitoring logs is governed by their terms and our configuration. Do not use AI features for content you are not allowed to process with third-party processors.

AI outputs can be incomplete or inaccurate. They are not legal, medical, or financial advice. Always verify important information in the original email.

Contacts and address book

When you import from the iPhone Contacts picker, Apple’s system UI shares only the contacts you select. We do not request ongoing access to your full device address book. Selected names and email addresses are stored on your Quill Brief account so you can reuse them when composing mail across mailboxes. You can edit or delete saved contacts in the app. Deleting your Quill Brief account removes these saved contacts from our servers.

Retention

Account and mailbox connection data — kept while your account remains active; deleted or de-identified when you delete your Quill Brief account, subject to short backup / security logs.
Synced mail content on our servers — retained as needed to operate sync, list, search, and open-message features while the mailbox stays connected; removed when you disconnect the mailbox or delete your account (this does not delete mail at your mail provider).
Daily briefs — server-side brief records are automatically deleted within 36 hours. A copy may remain temporarily in the app’s on-device cache until you refresh or clear app data. We do not keep a multi-day brief archive.
Usage and subscription records — kept as needed to enforce plan limits, prevent abuse, and maintain billing entitlement history required for App Store restores and support.
OTP / security logs — kept briefly for authentication security and abuse prevention.
Analytics and crash diagnostics — retained according to our analytics/crash tooling configuration, typically in aggregated or pseudonymous form for product reliability.

Where a fixed period is not listed, we use the criteria above (account life, feature need, legal hold, or security).

Security

We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS/TLS), access controls on production systems, and encrypted storage of mailbox credentials. No method of transmission or storage is completely secure. Please use strong unique passwords / passkeys for Quill Brief and for connected mailboxes, and enable provider-side security features where available.

International transfers

We and our service providers may process information in the United States and other countries where our providers operate. Those countries may have data-protection laws different from your home jurisdiction. Where required, we use appropriate transfer mechanisms (for example contractual protections with processors) for cross-border processing.

Analytics, crash reports, and push notifications

Firebase Analytics / Crashlytics — we use Google Firebase to understand feature usage and diagnose crashes. These tools may collect device and app instance identifiers and diagnostic data. We do not use them to build third-party advertising profiles.
In-app analytics events — Quill Brief also records product events (for example page views and generate success/failure) to operate and improve the service.
Push notifications — if you enable them, we store an APNs device token. Notification payloads are designed not to include full message bodies.

You can reset advertising / analytics identifiers in iOS Settings, disable push in system settings, or delete your Quill Brief account to stop server-side association with your user id.

Your rights (EU / UK GDPR where applicable)

If the EU GDPR or UK GDPR applies, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. You may also withdraw consent where processing is consent-based, and lodge a complaint with a supervisory authority (in the EU, in your Member State; in the UK, typically the ICO).

In the app you can disconnect mailboxes and delete your Quill Brief account (subject to verification such as OTP). You may also email us using the contact details below. We will verify requests to a reasonable degree of certainty before fulfilling them.

Where GDPR / UK GDPR applies, we process personal information based on: performance of a contract (providing the service you request), legitimate interests (security, abuse prevention, reliability — balanced against your rights), consent where required (for example optional push), and legal obligations.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the rights described below with respect to personal information we collect.

Categories collected, disclosed, sold, or shared (last 12 months)

Collected: identifiers; customer records / account information; mail content; contacts; commercial information; internet / electronic activity; limited inferences; and sensitive personal information as described above.
Disclosed for a business purpose: the same categories may be disclosed to the service-provider types listed under Disclosure (hosting, AI inference, transactional email, Apple, Google/Firebase, and your mail provider).
Sold: none.
Shared for cross-context behavioral advertising: none.

Your CCPA/CPRA rights

Right to know / access — categories and specific pieces of personal information we have collected about you, sources, purposes, and categories of recipients.
Right to delete — request deletion of personal information, subject to legal exceptions (for example security, debugging, or completing a transaction).
Right to correct — request correction of inaccurate personal information we maintain.
Right to opt out of sale or sharing — not applicable today because we do not sell or share personal information; contact us if you believe otherwise.
Right to limit use of sensitive personal information — we use sensitive personal information to provide the sync / AI / security purposes you request (CCPA permitted purposes). We do not use sensitive personal information to infer characteristics for advertising. If you want us to stop processing mailbox credentials or mail content, disconnect mailboxes and/or delete your account; you may also email a limit request and we will explain available controls.
Right to non-discrimination — we will not discriminate against you for exercising CCPA rights (for example by denying the app’s core free features solely because you submitted a valid request). Note that if you delete data that is required to provide a feature, that feature may no longer work.
Authorized agents — you may designate an authorized agent to submit a request. We may require proof of authorization and may still need to verify your identity directly.

How California residents can submit requests

Email quillbrief.support@gmail.com with the subject line “California Privacy Request” and tell us which right you want to exercise. You may also use in-app account deletion for deletion of your Quill Brief account data. We will respond within the time required by law (generally 45 days, with a permitted extension when reasonably necessary).

Shine the Light / notice: We do not disclose personal information to third parties for their own direct marketing purposes.

Other U.S. state privacy rights

Residents of U.S. states with comprehensive consumer privacy laws (including, among others, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and additional states as their laws take effect) may have rights to access, delete, correct, obtain a portable copy, appeal a refusal, and/or opt out of sale, targeted advertising, or certain profiling — as defined in the applicable statute.

We do not sell personal information or use it for cross-context targeted advertising. We aim to collect only what is reasonably necessary for the purposes described in this Policy (data minimization). Some state laws (for example Maryland’s online privacy act) additionally restrict sale of sensitive data; we do not sell sensitive personal information.

To exercise state privacy rights, email us and specify your state and request type. We will authenticate and respond as required by applicable law, including any appeal process the statute provides.

Brazil, Canada, Australia, and other regions

Brazil (LGPD) — If LGPD applies, you may have rights to confirm processing, access, correct, anonymize, block, delete, portability, information about sharing, and withdrawal of consent. Contact us to exercise these rights. You may also contact Brazil’s ANPD.
Canada (PIPEDA and provincial laws) — We collect, use, and disclose personal information for the purposes identified in this Policy, with consent where required (express or implied as allowed). You may request access or correction of personal information we hold about you, subject to legal exceptions. Questions or complaints may also be directed to the Office of the Privacy Commissioner of Canada where applicable.
Australia (Privacy Act / APPs) — Where the Australian Privacy Principles apply, we manage personal information in line with this Policy’s notice, use, disclosure, security, and access/correction practices. You may request access or correction, and complain to us first; unresolved complaints may be taken to the OAIC.
Other countries — If your local law grants additional rights, contact us. We will honor applicable requests to the extent required.

Electronic communications (ePrivacy / CAN-SPAM)

We send transactional / service emails needed to operate your account (for example one-time passcodes for sign-in or account deletion). Those messages are not marketing.

If we ever send promotional email, we will do so in line with applicable rules such as the EU ePrivacy Directive (as implemented in Member States), the UK PECR, and the U.S. CAN-SPAM Act — including clear sender identity, an unsubscribe method for marketing messages, and consent where required. Push notifications are optional and controlled in iOS Settings.

AI transparency (EU AI Act and similar)

Quill Brief’s brief and AI compose features use machine-learning models. Outputs are AI-generated (or AI-assisted), can be wrong or incomplete, and are provided so you can review them — not as a substitute for reading the original email or for professional advice. We do not intend these features to be used as prohibited AI practices under the EU AI Act. Where transparency obligations apply to limited-risk AI interactions, this notice and in-product AI labeling / disclaimers are meant to help you understand that you are interacting with AI-generated content.

Children (COPPA and similar)

Quill Brief is not directed to children under 13 (U.S. COPPA) or under 16 where that age is relevant for sale/share or consent rules, and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

Automated processing

We use automated systems to sync mail, enforce quotas, detect abuse, and generate AI summaries or compose suggestions. These processes help deliver the product; they are not used to make legal or similarly significant decisions about you without human involvement outside the app’s own feature limits (for example whether a generate request is within quota). California and other jurisdictions may provide additional notices or opt-outs for certain automated decision-making / profiling; contact us if you believe those rights apply to your use of Quill Brief.

Website cookies and similar technologies

Our marketing / legal website pages are primarily static. We do not run third-party advertising cookies on these pages. The app itself uses local storage, Keychain, and similar device technologies as needed to keep you signed in and cache limited data on device. Essential server logs may record IP addresses for security and reliability. Where a jurisdiction requires consent for non-essential cookies or similar technologies, we will not use those technologies on the website until an appropriate consent mechanism is in place.

Changes to this Policy

We may update this Privacy Policy from time to time. Where required, we will provide additional notice (for example in the app or by email). Continued use after an update means you acknowledge the revised Policy.

Contact / how to exercise rights

Privacy and support requests:
Email: quillbrief.support@gmail.com
Website: https://www.quillbrief.net

Please include your account email and the nature of your request. For California requests, use the subject line “California Privacy Request.” For EU/UK GDPR, LGPD, PIPEDA, or Australia Privacy Act requests, name the law if you know it.