Security: OAuth, what alfred_ stores, how it is protected

alfred_ (get-alfred.ai) connects to Gmail and Outlook with OAuth. It does not store your email password. Data is encrypted in transit and at rest, and stored in SOC 2 compliant data centers.

What alfred_ can access

After you connect an account: email subjects, bodies, and metadata; calendar titles, times, and attendees; contacts for autocomplete; and cloud files in Google Drive or OneDrive when you use file features. OAuth tokens are stored, not passwords. Tasks, notes, and preferences are stored in your account.

What is sent to AI providers

Email content is sent to third-party AI services so drafts and analysis can run. That is inference only. alfred_ does not use your data to train models.

What is not collected as credentials

No mailbox password. You can revoke Google or Microsoft access at any time. You can disconnect a mailbox in Settings, which deletes its credentials immediately and stops all access to it. You can delete your account from Settings: after a 14-day grace period, during which you can cancel, your data is permanently deleted. Export is in Settings, or email connor@get-alfred.ai.

Security snapshot

• OAuth only, no mailbox password
• TLS in transit, encryption at rest (Supabase), hosted in SOC 2 compliant data centers
• Row-level security so you only see your own data
• PostHog for product analytics (page views, feature use), not inbox contents for ads

If you are asking whether it is safe to let an AI read your email: any assistant that drafts from real threads has to read them. The controls are OAuth, drafts that only go out when you approve them, no training on your mail, and the ability to disconnect and delete. The only email alfred_ sends from your account on its own comes from automations you created yourself, such as a forwarding rule or a scheduled send, and you can pause or delete those anytime.

$29.99/month or $299.99/year. 7-day trial.

See also: Connect Outlook · Security · Privacy Policy.