Privacy policy

Last updated November 9, 2026

Who we are

Merritt is an email app for iPhone, run by David Abernathy, who is responsible for your data under this policy (the “controller” under EU and UK data protection law). Questions about this policy or your data: support@trymerritt.com.

The short version

• Merritt connects to your email so it can sort, summarise and draft replies.
• Your message bodies are never stored on our servers. We fetch them when needed and drop them after use.
• What we do store about your mail (subjects, senders, folder names, AI summaries and drafts) is encrypted with a key for your account.
• To summarise and draft, parts of your email are sent to our AI provider, Anthropic. See “AI processing” below.
• We don’t sell your data, show ads, or track you across other apps or websites.
• You can delete your account and everything we hold at any time, in the app.

What we collect, and why

Your Merritt account. You sign in one of three ways:

• Sign in with Apple. We ask Apple for no name and no email address. We keep only Apple’s anonymous identifier for you, so we know it’s you next time.
• Sign in with Google. Google confirms who you are to Google Firebase Authentication, our sign-in service, which keeps your Google account’s email address and name. Merritt’s servers keep only Firebase’s identifier for you.
• Email and password. Firebase Authentication keeps your email address and a one-way hash of your password, and sends the emails that verify your address and reset your password. Merritt’s servers keep only Firebase’s identifier for you, never your password.

Email accounts you connect. For each one: its address, which provider it is (iCloud or Gmail), and the app-specific password you give us. The password is encrypted with a key held in Amazon Web Services’ key management service (AWS KMS). Only the part of our system that holds the mail connection can decrypt it, and every use of the key is logged. It is never written to our logs or shown back to you.

Your mail, on our servers. To keep your phone in sync we store, for each message: encrypted headers (subject, sender, recipients), encrypted folder names, and in the clear: dates, read/flagged/answered state, which folder it’s in, and which conversation it belongs to. Message identifiers and sender addresses are stored only as keyed hashes. Message bodies are not stored. When you open a message, it’s fetched from your provider, passed to your phone, and dropped.

What the AI produces. A summary, a category and suggested action for each conversation, and draft replies. Summaries and drafts are encrypted with your account’s key. Categories and suggested actions are stored in the clear. They’re deleted when the conversation leaves your inbox, and after 30 days in any case.

Learning from how you handle mail (on by default, can be turned off and cleared in Settings). We keep counts, not text: how often you reply to a sender, how much you change drafts. Senders are identified only by a keyed hash.

Messages you send. What you write is kept encrypted only for the 10-second undo window, or until the scheduled time if you choose “send later”. It’s cleared once the send finishes.

Your calendar (iCloud only). Read live to show the Calendar tab and to help drafts avoid clashes. Events are not stored on our servers. Answering an invite sends a standard reply to the organiser and, if you accept, adds the event to your iCloud calendar.

Notifications. Your phone’s push token, to deliver notifications through Apple. A notification shows the sender and the subject or the AI’s one-line summary. That text passes through Apple’s push service and appears on your lock screen according to your iPhone’s settings.

Usage records. For each AI request: which kind it was, the model, and token counts, kept 13 months to enforce a monthly allowance. Actions and commands you run (state only, not content) are kept for up to 7 days.

No usage analytics. Merritt doesn’t collect analytics about how you use the app. If we add usage counts later, they’ll be off unless you turn them on, and this policy will say exactly what they count.

On your phone. Merritt keeps a copy of message headers (not bodies) on your iPhone so it works offline, protected by iOS file encryption. Your sign-in token is in the iPhone Keychain, never backed up or synced. Signing out deletes both.

This website sets no cookies and runs no analytics or tracking scripts. Like any web server, ours sees your IP address to send you the page; it isn’t stored beyond our host’s short-lived logs.

AI processing

Merritt asks for your agreement before anything is sent. To sort a new message and draft replies, Merritt sends Anthropic:

• the new message’s headers and up to 20,000 characters of its text;
• up to 6 earlier messages in the same conversation (about 24,000 characters in all, with quoted history removed);
• for drafts, if learning is on: up to 2 of your earlier replies to that sender (1,500 characters each) and a short note on your history with them;
• if calendar use is on: your next 14 days of events (titles and times).

Anthropic processes this under its Commercial Terms and Data Processing Addendum. It doesn’t use this data to train its models, and deletes it within 30 days, unless it must keep it longer to enforce its usage policy or comply with the law. Nothing is sent for mail you don’t receive in your inbox, and no passwords or keys are ever sent.

Email is untrusted content: a message can try to influence its own summary or draft. Drafts are never sent without you.

Who else handles your data

How long we keep things

• Account and connected mailboxes: until you remove them or delete your account.
• Sign-in details held by Firebase (email address, password hash, Google account email): until you delete your account.
• AI summaries and drafts: until the conversation leaves your inbox, at most 30 days.
• Outgoing message text: until it’s sent (seconds), then cleared.
• AI usage counts: 13 months.
• Sign-in sessions: 90 days from sign-in.
• Server logs: kept 7 days by our host (Fly.io), then deleted. Logs never contain subjects, bodies or passwords; addresses are hashed.
• Key-use audit log (AWS): one year. It records that a key was used and for which Merritt account id, never what was encrypted.
• Backups: encrypted database backups keep deleted data for up to 10 days, then it’s gone.

Your choices and rights

• Delete your account: Settings → Delete account. Everything we hold for you is deleted at once (except backups, above), including your sign-in details at Firebase. Your mail stays with your provider. More on the delete your account page.
• Remove one mailbox: Settings → the account → Remove.
• Withdraw your agreement to AI processing: Settings → Privacy. Merritt stops sending anything to Anthropic at once and pauses your mailboxes until you agree again; nothing is deleted. Merritt can’t work without the AI, so you can also delete your account instead.
• Turn off learning or calendar use, and clear what was learned: Settings → AI.
• Sign out: ends your session on our servers and stops notifications.
• Ask us at support@trymerritt.com to see a copy of what we hold about you, correct it, delete it, or move it elsewhere. We answer within 30 days, and it’s free.

If you’re in the EU or UK

We use your data because you asked us to provide Merritt (the contract between us), and we send mail to the AI only with your explicit agreement, which you can withdraw at any time. You can ask to access, correct, delete or export your data, restrict how we use it, or object to it, by emailing us. You can also complain to your local data protection authority.

Our servers and processors are in the United States. Each processor above protects transfers of personal data out of the EU and UK with the standard contractual clauses in its data processing terms.

If you’re in California

You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be treated differently for using these rights. We don’t sell or share your personal information as California law defines those terms.

Security

Credentials and stored mail data are encrypted per account; connections to providers always use verified TLS; rate limits and audit trails guard the servers. More on the security page. No system is perfect: if a breach affects you, we’ll tell you without undue delay, and within 72 hours of confirming it.

Children

Merritt is not for anyone under 16, and we don’t knowingly collect data from them. If you believe a child under 16 is using Merritt, tell us and we’ll delete the account.

Changes

We’ll post changes here and tell you in the app if they matter.