Privacy policy

The short version: this site runs no analytics, shows no ads and sets one functional cookie. It stores what you type into the beta form, because that is what the form is for. The Meltemi desktop app keeps your mail on your own machine; the only mail text that ever passes through this site is what you send to the managed AI tier, if you use it, and that text is forwarded to the model provider and not stored here. The sync backend described below is run for one person’s own devices and is not open to sign-ups.

Who is responsible

The controller for everything on this page is Entro314 Labs ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (Entro314 Labs Single Member P.C.), Cheimarras 3, 135 61 Agioi Anargyroi, Greece — reachable at ⟨contact email — fill before deploy⟩. Full identification is on the legal notice.

Visiting the site

There is no analytics script, no advertising code, no tracking pixel and no third-party embed on any page. Vercel, which hosts the site, processes your IP address and request metadata in its ordinary request logs for the period its platform keeps them; this site does not export those logs or keep them anywhere else. The legal basis is legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR).

To stop scripted abuse, the beta form, device registration and the sync endpoints count requests per address. The counter stores a SHA-256 hash of your IP address, which route group it is for, and how many requests arrived in the current window (an hour or a minute). A hash of an IP address can be matched against a guessed address, so treat it as pseudonymous, not anonymous. Rows more than a day old are deleted the next time any counter starts a new window; there is no separate timer. The legal basis is the same legitimate interest.

The one cookie, NEXT_LOCALE, remembers which language the site shows you. It is set when you pick a language with the switcher, when you open a page under a language prefix such as /el/, and on a first visit to the home page when the site sends you to the language your browser asks for. It is described in full in the cookie statement.

The beta form

The form asks for your email address and, optionally, what you use now and what you hate about it. Those three fields and the time you sent them are the whole record. The address is stored trimmed and lowercased so asking twice stays one entry, and there is no way to read the list back over the web.

• Purpose: sending you beta access and the messages around it. Nothing else — the address is not added to any other list.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Retention: until the beta ends or you ask to be removed, whichever comes first. There is no automatic deletion: write to ⟨contact email — fill before deploy⟩ and the row is deleted by hand.

The sync backend

The desktop app can connect to a small backend on this site to share a few things across machines. It is single-tenant: it is operated for the controller’s own devices, and registering a device needs a secret that is not published or offered to the public. Every registered device shares one settings record and one unsubscribe list, so it is not a service for several people. The legal basis for what it holds is performing the service its user asked for (Art. 6(1)(b) GDPR). What it stores, table by table:

• Devices — a label chosen at registration, a SHA-256 hash of the device token (the token itself exists only on the device), when it was registered and when it last made a request.
• AI usage ledger — accounting rows the app uploads for every AI call it makes on any tier: feature, provider, model, status, duration, tokens, estimated cost and where the estimate came from, prompt version and error code. Numbers about calls, never the content of a message or of the call. Linked to the device that uploaded them.
• Managed AI relay — if you choose the hosted AI tier, the app sends the request’s text here: instructions, the conversation, and for mail features the text of the mail being worked on. The server forwards it to the Vercel AI Gateway, which passes it to the model provider serving the request, and streams the answer back. None of that text is stored here. The server keeps one row per call, linked to the device: model, status, tokens, the cost the gateway reports, the gateway’s generation id, duration and, for failed calls, the provider’s error message.
• Settings — one encrypted blob shared by every registered device, the version counter that keeps two devices from overwriting each other, when it last changed and which device changed it. The app encrypts before upload; the server stores ciphertext it cannot read.
• Gmail change notices — if Gmail push is set up, Google Cloud Pub/Sub delivers a notice when a watched mailbox changes, and the server keeps the Gmail address, Google’s history number and the two times involved, one row per address. No message content is delivered. Separately, each device records which Gmail addresses it watches, and a device is only ever shown the notices for its own addresses.
• One-click unsubscribe — when someone presses unsubscribe in a mail sent from the app, their mail client calls this site and the server records a campaign number, a token, whether it came by the one-click or the web route, and the time. The token is a keyed hash of the campaign, the recipient’s address and the endpoint, made with a key that stays on the sender’s machine: this server cannot turn it back into an address, and neither can anyone who guesses one. Links sent by earlier versions of the app carry an older, unkeyed token that someone holding a candidate address could check. The people these rows concern are the recipients of the sender’s mail, not users of this site.
• Image proxy — when the app loads a remote image through the proxy, the image’s host sees the proxy instead of you. The proxy forwards no cookies and no referrer and stores nothing; the request appears in Vercel’s request logs like any other.

What never happens

Your mail is never stored on this site. Its text passes through only on the way to the managed AI tier’s model provider, and only if you choose that tier. Nothing here is sold, rented or handed to advertisers. Credentials for your mail provider travel from your machine to your provider and stop there — no route on this site accepts them.

Who processes it, and where

• Vercel Inc. hosts the site. Pages are served from its network worldwide; the code behind the forms and the sync backend runs in its Washington, D.C. region (iad1), in the United States. Everything the forms and the backend receive is processed there first.
• CapyDB runs the database, in Helsinki, Finland (EU). Every row described on this page is stored there.
• Vercel AI Gateway receives the managed AI tier’s requests and routes each one to a provider hosting the DeepSeek model asked for. The gateway picks whichever of those providers it currently measures as fastest, which can include DeepSeek itself, so the provider and the country a given request is processed in are not fixed. Each provider handles the text under its own terms for the duration of the call and whatever retention those terms set.
• Google Cloud Pub/Sub carries the Gmail change notices from Google to this site.

Where these providers process data outside the EU, the transfer relies on the safeguards in their data processing terms.

How long it is kept

Only the rate-limit counters expire on their own. Everything else stays until it is deleted, and deletion is done by hand by the controller, on request: there is no deletion button or route.

Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing (Arts. 15–21 GDPR) by writing to ⟨contact email — fill before deploy⟩. You can also complain to the Hellenic Data Protection Authority (dpa.gr) or the supervisory authority where you live.

Leaving, with your data

Your mail is a file on your own disk, any conversation exports as .eml, and triage state rides standard IMAP keywords other clients can read. On this site, the settings blob is ciphertext only your devices can read; the ledger, the managed-AI rows and the Gmail addresses are stored as plain data, and all of it can be exported or deleted on request.

Changes

When this page changes, the date at the top changes with it. A change that widens what is collected will be announced to beta participants at the address they gave, before it takes effect.