Security

Gmail

• Confirms which Google account you are connecting.
  openid
• Reads the address of the mailbox, so Tendthread sends from the right one.
  email
• Reads your name and picture, shown in Tendthread's settings.
  profile
• Reads messages so replies to your follow-ups are detected. This grant covers the whole mailbox — see below.
  https://www.googleapis.com/auth/gmail.readonly
• Sends your follow-ups from your own address, in the existing thread.
  https://www.googleapis.com/auth/gmail.send

Outlook

• Confirms which Microsoft account you are connecting.
  openid
• Reads your name, shown in Tendthread's settings.
  profile
• Reads the address of the mailbox, so Tendthread sends from the right one.
  email
• Keeps the connection working without asking you to sign in again every hour.
  offline_access
• Reads your basic profile to identify the connected account.
  User.Read
• Reads messages so replies to your follow-ups are detected.
  Mail.Read
• Creates the follow-up as a draft in your mailbox before sending it, which is what keeps it in the right thread.
  Mail.ReadWrite
• Sends your follow-ups from your own address.
  Mail.Send

The read permission Google grants covers your whole mailbox, not only those threads. Tendthread does not read the rest, but the permission is that broad and you should know before you grant it.

Tendthread reads the threads it manages for you, so it can tell when someone replies and stop following up.

We would narrow it if the provider offered a way to. It does not currently expose a permission for “only the threads this application created”, so the honest thing is to tell you how wide the grant is rather than imply it matches what we use.

• In transit — every connection is over TLS: your browser to Tendthread, Tendthread to your mailbox provider, and Tendthread to its database.
• Mailbox credentials at rest — the OAuth tokens that hold your mailbox access are stored encrypted, not in plain text. They are the most sensitive thing here, because they are the thing that would let someone else read your mail.
• Access — a signed-in account can only reach its own leads, messages and mailbox connection. Every server action checks ownership rather than relying on the interface not offering a button.
• One mailbox per account — Tendthread cannot be pointed at a mailbox you have not connected yourself, and it sends only from the one you did.

Message content is processed by an AI model to draft follow-ups and classify replies.

Model access goes through a single routing provider, configured to exclude any host that trains on what it is sent, with prompt logging switched off. What each request asked for and returned is recorded so that an email which went out can be explained afterwards — that record includes message content, because the content is the reason the record exists.

No follow-up is sent unchecked. Every draft is validated against the facts it was given before it can go out, and one that claims an attachment, a link, a previous email or a piece of research that does not exist is rejected rather than sent.

Tendthread uses other companies to run the product — hosting, the database, background jobs, AI models and email delivery. Each category, what it sees and where it operates is listed on who processes your data, which is kept current as part of the privacy policy rather than restated here.

A business customer entering a data processing agreement can request the named list behind those categories from privacy@tendthread.com.

Plainly: nothing is deleted on a schedule yet. There is no automatic retention window running today, so a lead and its replies stay until you delete them or close your account.

We would rather say that than publish a period nothing enforces. A stated retention window that no job carries out is worse than an unstated one, because it is a commitment already being broken. Scheduled deletion is built work that is planned, not shipped, and this page and the privacy policy will both state the periods when it runs.

You can disconnect at any time from Settings, or revoke access directly in your Google or Microsoft account.

• Gmail — Disconnecting revokes the grant with Google directly, so the access is gone at the provider and not only in our database.
• Outlook — Microsoft gives an application no way to revoke only its own access; the one call available would sign you out of every application you use, including Outlook itself, so we do not make it. Disconnecting in Tendthread stops all access from our side, and you can remove the grant entirely at myapps.microsoft.com.

Deleting your account removes your data and releases the mailbox grant on the way out. Provider outages cannot trap you in an account you asked to leave — deletion continues either way, and anything it could not revoke is reported to you so you can remove it yourself.

Send it to security@tendthread.com. It is a different address from general support on purpose, so a report is read as one.

Reports are welcome from anyone. Please give us a reasonable window to fix an issue before disclosing it, and we will not pursue you for finding one in good faith. The same details are published at /.well-known/security.txt.

Tendthread is built and run by one person. That means a report reaches the person who can fix it immediately, and it also means we are not going to pretend to a formal response-time commitment we cannot staff.