Privacy Notice

Shorebreak, LLC, based in Florida, USA, operates PonyXpress. Contact support@ponyxpress.app for privacy, rights requests and security concerns. This notice describes the current pre-release software; it is not a certification of compliance or permission to launch in unapproved countries.

The operator identity and public email were supplied by the owner. A required business contact address, launch markets, provider-region details and operational retention schedules still need confirmation before public launch. No address, residency guarantee or fixed purge deadline is invented here.

Clerk handles your PonyXpress sign-in email, name, session and security settings. Each customer Google mailbox is connected separately using OAuth. Signing in is not mailbox authorization; builder integrations are not customer accounts. We do not receive your Google password.

Encrypted Google access credentials, mailbox identifiers, email/display names, permission scopes and synchronization status enable the features you authorize. Calendar, Contacts and Gmail settings require their additional permissions. Workspace administrators can restrict access.

Setup progress and granular Scout account/action grants are account-owned configuration records, with revisions and timestamps, included in export and deletion. They do not contain provider tokens or message bodies. No optional feature is granted merely by accepting these documents or finishing setup.

• Ordinary synchronization caches recent mail metadata, including headers and identifiers, not message bodies or attachment bytes. Bodies and attachments are fetched for viewing and requested actions; excerpts can appear in saved drafts, scheduled messages or opted-in Scout records.
• Account-owned contacts, signatures, drafts, preferences, Mailbags/Routes, filing receipts, contact-sharing rules, events and source-email links support mail and planning. Some ordinary workspace records are database JSON without application-level encryption.
• Scheduled-send content, Scout content and private reminder text/source references have selected application-level encryption. Due times, status and other operational metadata remain queryable. This is not end-to-end encryption.
• Uploaded draft attachments use private file storage and ownership checks. They are not malware-scanned; treat unexpected files cautiously. Files you send reach recipients and their providers.
• Notification enrollments contain encrypted push endpoints/keys plus device/delivery metadata. Agreement receipts record version, server time, age band and attestations, not date of birth or a specifically collected receipt IP/device fingerprint.

Cloud AI is off until the relevant explicit opt-ins are saved, and is currently available only to eligible adults with configured provider access and the applicable purpose, mailbox and action grants. One-conversation analysis and inbox-wide Ride Ahead are distinct permissions. Optional recent Sent context, memory and contact lookup have their own grants. Source text can include subject, addressing information and body content; context and report coverage are bounded.

Requests go directly to OpenAI. Generated suggestions also pass an automated provider safety check. Ordinary summaries, draft assistance and Ride Ahead do not send attachment file contents; selected Scout Voice PDF review is the exception described below. AI has no authority to send mail. Proposed actions retain their separate reviews.

Saved corrections, preferences, reports and edited examples personalize your own results where enabled. They are account-owned, not a shared training corpus. Private fitted Xpress learning and background drafting require independent user consents and deployment/privacy approval. Those gates remain closed unless separately approved; saved Scout feedback is not that approval or evidence of quality.

For supported requests we use store:false; this does not mean zero retention and is not a setting for every audio endpoint. Under the standard OpenAI API policy, API data is not used for general-model training by default; abuse-monitoring retention can be up to 30 days with legal and safety exceptions. Provider organization settings, contracts and current terms must also be verified. See https://developers.openai.com/api/docs/guides/your-data.

Turning off a permission stops new processing under it and invalidates affected work; it does not recall data already processed by a provider. Pausing learning is different from forgetting learned data or stopping separately authorized drafting. Use the individual controls rather than assuming one switch withdraws every permission.

Scout Voice supports typed conversation and draft assistance inside Ride Ahead. Microphone transcription requires a separate saved opt-in and browser microphone permission. Short clips (up to 30 seconds/4 MB in the interface) go through PonyXpress to OpenAI for transcription; PonyXpress does not persist raw recordings. In manual recording mode, review and submit the editable transcript yourself. Starting conversation mode is a further explicit session action: while that session is active, a local pause detector submits each spoken read-only turn automatically and listens again after Scout answers. Local pause detection does not itself send audio anywhere; submitted clips still go to OpenAI. The microphone indicator shows when capture is active. End conversation, leaving the page, permission withdrawal, silence or the ten-minute session limit stop listening. Nothing listens in the background, a saved permission alone starts no recording, and raw speech never confirms a mail mutation or draft save.

Natural AI read-aloud is a separate saved opt-in. The words read, including ordinary email or agenda content, go to OpenAI to generate an AI voice. Audio is played from memory and not retained by PonyXpress. Alternatively, an available on-device browser voice stays local. If no local voice is available, text remains; a failed natural voice does not silently change providers or voices. Playback starts only after your action, never on reload.

PDF review needs its separate permission plus confirmation of each selected owned PDF. Up to 8 MB and the first six pages are rendered; extracted text and page images go to OpenAI. Original PDF bytes and page images are not retained by this feature. Citations indicate coverage, not verified signatures or guaranteed accuracy.

Encrypted Voice sessions keep bounded source context, the latest 30 transcript entries, pending proposals and retry records for up to seven days. Visit receipts expire after seven days; the last-visit timestamp remains until mailbox/account removal. Saved drafts use the ordinary draft lifecycle. Revoking Voice permissions clears affected sessions; account export/deletion and mailbox disconnect include them. OpenAI processing remains subject to its independent API retention.

Microphone support varies by browser/device; the packaged desktop companion blocks microphone access and offers typed input instead. Neither speech nor PDF permission enables private Xpress learning, unattended scans or access to encrypted-message content.

We process information to provide features you request, maintain your account, carry out your authorized automation, prevent abuse and secure and troubleshoot the service. We do not sell personal information, use mailbox content for advertising, or use it to train general AI models.

Use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only to provide or improve appropriate user-facing features, not general-model training, credit decisions or advertising. Transfers must be necessary for those features, security, applicable law or an authorized business transfer consistent with these restrictions.

Human access to Google user data is limited by those requirements, such as specific consent for particular messages, necessary security investigations, applicable law, or aggregated and anonymized internal operations where permitted. This notice is not blanket permission for support staff to read your mailbox. Share only what is needed for a support request.

Policy: https://developers.google.com/terms/api-services-user-data-policy. Optional user consent does not waive provider restrictions, replace required verification or establish a legal basis in every jurisdiction. The operator must determine and disclose any market-specific legal bases and notices before launch there.

Ordinary Gmail is not end-to-end encrypted: Google, PonyXpress and selected processors can handle ordinary plaintext content for requested features. Remote images are blocked by default; choosing to load them can contact a sender’s server and reveal access information.

HTTPS transport, encrypted Google credentials, private file access and encryption of selected server records protect different parts of the path. They do not mean that every stored field is application-encrypted, that operators cannot access data, or that every infrastructure setting has been independently audited.

Offline saved copies use separate device encryption described below. They are not encrypted-message delivery and do not make the original email end-to-end encrypted.

Real client-side encrypted messaging is not implemented or approved. The isolated fictional preview has no encryption, authentication, key service, recovery or delivery. Its sample sender/date covers, lock screens, key-change warnings and export controls are simulated, not enforceable protection. State is plaintext in browser memory, lost on reload; use fictional content only.

Before real secure mode is released, verified client-side content must be separated from ordinary mail, Scout/AI, server search, logs and plaintext exports, with accurate disclosures of visible metadata and device/key/recovery limits. No such live exclusions, recipient verification, historical-key recovery or ability to erase another recipient’s copies are promised by this build.

While signed in online, select loaded conversations to save on this browser profile. Only plain text and bounded display fields are copied, not attachments, HTML, remote images, tokens or cookies. A separate passphrase wraps a random encryption key. The passphrase and unlocked key are not saved or sent to PonyXpress; forgotten passphrases cannot be recovered.

Choose 1, 7 or 30 days, within 50 conversations, 200 messages and 8 MiB. Copies lock on hiding, after five minutes idle and on reconnect. Offline access needs successful authenticated validation at least every seven days. The separate /offline/ reader must be prepared online; it is not offline startup of the full app and has no sending, editing or write replay.

Sign-out, disconnect and account deletion remove this device’s reading vault. Other offline devices cannot be erased instantly: they check expiry and revalidate on opening online or reconnecting. Expired ciphertext is removed when storage next opens. Browser eviction, clearing site data or device loss can erase copies. Clock/storage tampering, an unlocked device or compromised browser can defeat local controls; copies are not a backup.

Calendar/reminder pushes use your browser or operating-system push service with encrypted payloads. Previews are off by default; enabling them can show event details on a lock screen. Generic alerts are an alternative. Enrollment, browser permission, quiet hours, hosting and device support affect delivery. New-mail alerts operate while the app is open.

Device enrollments expire after 30 days without signed-in renewal. Ordinary delivery receipts expire after seven days; a minimal pending-reminder receipt can remain while pending to avoid duplicate alarms. Remove devices in Settings or from agreement withdrawal controls, and withdraw browser/OS permission as needed.

Gmail’s native vacation responder is separate: after a reviewed change it can send automatic replies even with PonyXpress closed or disconnected. Manage or disable it in Gmail if you no longer want it. Disconnect is not a promise to change independent Google settings.

Clerk and the service use session/security cookies or equivalent identity storage for sign-in. Session storage holds the pre-sign-in age band and navigation state. Local storage holds device preferences and the fictional demo; IndexedDB supports opted-in draft recovery and separately encrypted offline reading. Draft recovery is a different local protection boundary, not the independent-passphrase saved-mail vault.

Only the public prepared reader shell/assets are cached for offline reading; private API responses, authentication and attachments are not service-worker shell cache entries. The separate root worker supports push. Private-browsing modes, storage denial or clearing site data may prevent features or remove local copies.

The application does not add advertising trackers. Third-party identity, fonts and infrastructure requests still expose network information to their recipients. HTTP requests can reveal IP address, user agent, route and timing to hosting or identity providers. Our HTTP logger strips query strings and does not intentionally log mail bodies or raw provider errors. This is not a claim of no cookies, no infrastructure logs or no possible accidental disclosure.

Security/safety records use content-free references and event types rather than original mail or withheld generated text. Operational log/backup retention and provider settings remain to be confirmed. Any nonessential tracking added later needs a separate assessment; these acknowledgements do not authorize it.

• Google: connected mail, calendar, contacts and settings, including actions you authorize.
• Clerk: identity, sign-in and account security.
• Replit: application hosting, PostgreSQL database and private file storage.
• OpenAI: optional cloud analysis, automated output safety checks, speech and selected-PDF processing.
• Browser/operating-system push services: optional notification delivery; browser on-device speech is a distinct local alternative.
• Intended email/calendar recipients and sender unsubscribe endpoints: information necessary for actions you confirm. A message or request may disclose your address and selected content.

Provider contracts, subprocessors, processing regions and international-transfer arrangements have not all been confirmed for launch. No specific data-residency or transfer-safeguard certification is claimed. Information may be processed outside your country; market-specific obligations must be resolved before offering the service there.

We may disclose information when required by applicable law or necessary to address security and abuse, subject to provider restrictions and applicable safeguards. This does not authorize unrestricted human access or a new undisclosed purpose.

Ordinary metadata synchronization uses a recent window of approximately 30 days, not a guaranteed universal deletion deadline. Preferences, contacts, signatures, drafts, schedules, reports and optional learning records persist as needed for their features until removed or their feature-specific cleanup runs. Voice, notification and saved-copy periods are described above; uploaded attachment cleanup follows draft/job and account lifecycle.

Disconnect removes the mailbox’s app resources, pending jobs and stored tokens. It does not delete Google originals, your overall identity or agreement receipt, and does not automatically revoke Google permission. Remove PonyXpress separately at https://myaccount.google.com/permissions.

A minimal deletion-recovery marker holds only the internal identity ID, cleanup stage and request time, not mailbox content or agreement receipts, to block stale work and permit retries. Its retention, hosting backups, operational logs, support correspondence and independent provider records have not received final retention approval. There is no promised immediate erasure everywhere or invented legal-recordkeeping exemption.

Withdrawing optional consent stops new work under that permission but cannot undo an already sent message or provider request. Removing a device stops its future pushes; a remote server cannot instantly remove downloaded exports or copies on offline devices or recipients’ systems.

Signed-in Account controls export stored PonyXpress records and uploaded attachment contents, not a full Gmail archive or Clerk security profile. Credentials, push delivery secrets and private keys are excluded. The download needs authentication, not a public link. Protect the downloaded copy; we cannot erase it later.

Review and confirm permanent deletion in Account. Cleanup cancels queued work, restores pending snoozes to Inbox and removes active app data, agreement receipts, uploaded files and sign-in identity. Running/interrupted actions can block cleanup until reconciled; failed cleanup keeps normal use blocked and can be retried.

Google originals, contacts, calendar events and Google-synced drafts are not deleted. Review uncertain sends/events with Google and revoke the grant separately. Export, review/delete, disconnect, sign-out and notification withdrawal remain available without accepting updated Terms.

Use Settings to disconnect, review grants, stop optional analysis, forget learning and remove notification devices; use Account for export and deletion. For access, correction, objection, restriction, portability, retention questions, an appeal or a failed request, contact support@ponyxpress.app. We verify ownership proportionately; do not email passwords, identity documents or other people’s mail.

Depending on applicable law, you may have additional rights, including withdrawing consent for future optional processing and complaining to your local privacy authority. We will assess requests under the law that applies, explain any lawful refusal or limitation and identify available next steps. Nothing here limits mandatory rights. No response deadline is invented; applicable statutory deadlines still apply.

Under-13 accounts are unsupported. Ages 13–17 need guardian permission and stricter local eligibility where applicable; self-attestation is not verified parental consent. Contact support if you believe an ineligible child has supplied data, so removal can be addressed.

Teen cloud AI, Sent-history use and preference learning remain restricted pending review of launch countries, digital-consent ages, age assurance, provider conditions and youth-safety operations. Reaccepting as an adult does not automatically clear a prior teen restriction. These documents do not satisfy those independent approvals.

Reporting unsafe Scout output opens an email for you to review/send, without automatically attaching a mailbox. Share only the feature, any reference shown and what is necessary. Reports are not emergency-monitored and a trained-response service is not claimed.

The ordinary demo uses fictional data kept in your browser; it does not read your mailbox or call AI. Page, asset, font and identity-provider network requests can still occur. The secure design preview is a separate memory-only simulation, not private communication.

Help search uses published answers without sending your question or mailbox to an AI provider. If you contact support by email, your email provider and the support mailbox process what you choose to send. Support-mail retention and staffing must be confirmed; do not send sensitive mail content unnecessarily.

Material changes get a synchronized new version and require fresh Terms acceptance and Privacy Notice acknowledgement. We record server time, version, age band and attestations. Acknowledgement means you have read the notice, not that you consent to every processing activity.

Optional Scout, Voice, selected PDFs, learning, notification and offline choices remain separate and are not expanded by reacceptance. Public information, sign-out, export/deletion and withdrawal controls remain available. No audit, security approval, legal compliance everywhere or production launch is certified by accepting this notice.