01The short version
Winnow runs entirely on your computer. RedClyph operates no server for it, receives no copy of your mail, and has no ability to read your mailbox.
There is no RedClyph account to create, no sign-in, and no telemetry. Everything below is detail on that one fact.
Winnow reads a Gmail mailbox you authorise, sorts each message under a label, and emails you a summary. It is installed and run by you, on hardware you control. The software talks to Google directly from your machine using credentials that never leave it.
02What Winnow asks Google for, and why
When you authorise Winnow, Google asks you to approve two permissions. These are the only two it requests.
| Scope | What it permits | Why Winnow needs it |
|---|---|---|
gmail.modify |
Read messages, and add or remove labels | To read a message in order to classify it, then apply a label and remove it from the Inbox |
gmail.send |
Send mail as you | To send you the twice-daily digest |
Neither scope permits deletion. Winnow is structurally incapable of deleting your mail, emptying the trash, or permanently removing anything — not as a promise, but because the permission was never requested. Mail it judges to be rubbish is moved to a label you can review and clear yourself.
Winnow does not request access to your Google contacts, calendar, Drive, profile, or any other Google service.
03Where processing happens
On your computer. Winnow is a set of scripts you run under Windows PowerShell, either by hand or on a schedule. When it runs, it connects from your machine to Google's API over HTTPS, fetches messages, decides what to do with them, and applies labels.
Most of that deciding is done by rules you write and by a classifier trained on your own past filing decisions. Both run locally and involve no network call to anyone.
04What is stored, where, and for how long
Everything Winnow stores is a file on your computer. Nothing is stored by RedClyph.
| File | Contains | Kept until |
|---|---|---|
secrets.json |
Your Google refresh token, OAuth client secret, and AI provider key. Encrypted with the Windows Data Protection API, readable only by your Windows account on that machine. | You delete it, or revoke access |
state/model.json |
The trained classifier: word frequencies and sender addresses derived from mail you had already filed. | You delete or retrain it |
state/processed.json |
Identifiers of messages already triaged, so work is not repeated. No message content. | 120 days by default, configurable |
logs/ |
Run logs: subjects, sender addresses, and the reason for each decision. | You delete them |
out/ |
A copy of each digest, including extracted amounts, dates and body previews. | You delete them |
These files describe your correspondence. Treat them as you would the mailbox itself: keep them on an encrypted disk, and keep them out of any backup or source-control system you would not put your mail into.
05The one third party, and exactly what reaches it
Winnow has an optional feature that uses a large language model to summarise messages the local classifier could not confidently settle. It is provided by Anthropic PBC and reached over its API.
This feature is off unless you turn it on
Winnow has three modes. In off, no network request is ever made to any AI provider and no message content leaves your machine. In fallback, only messages the local rules and classifier decline are sent. In all, every selected message is sent. You choose, per installation, in a configuration file.
When the feature is enabled, what is transmitted for an affected message is: the sender name and address, the recipient line, the subject, the date received, attachment filenames, and an excerpt of the message body. Before transmission the body has every web address replaced by its domain name only, and is truncated to a configurable limit (2,000 characters by default). Attachments themselves are never sent. Nothing is sent for messages your rules or the classifier decided locally.
Anthropic processes that text to return a classification and a summary. Its handling of it is governed by its own terms and privacy policy. RedClyph does not receive, see, or retain any of it — the request goes from your machine to Anthropic using an API key that you obtain and that is stored only on your machine.
06Google API Services User Data Policy
Winnow's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, and because gmail.modify is a restricted scope:
- Google user data is used only to provide the mail triage and digest features you installed Winnow for, and to improve those features.
- It is not transferred to anyone except as described in section 05, where you have enabled that feature.
- It is never used for advertising, ad targeting, ad personalisation, or any advertising purpose.
- It is never sold, licensed, or shared with data brokers, credit bureaux, or any similar party.
- No human at RedClyph reads it, because no copy of it ever reaches RedClyph.
07What Winnow never does
- It sends no analytics, usage statistics, crash reports, or telemetry of any kind to RedClyph or anyone else.
- It does not phone home to check licences, versions, or entitlements.
- It does not delete mail. The permission to do so was never requested.
- It does not read mailboxes other than the one you authorise, and refuses to run if the authorised mailbox is not the one named in its configuration.
- It does not send mail to anyone other than the digest address you configure.
- It creates no RedClyph account and asks for no personal information.
08Withdrawing access and deleting data
Because everything lives on your machine and in your Google account, you can end it entirely without contacting us.
Revoke Winnow's access to your mailbox
Go to myaccount.google.com/permissions, find the app, and remove access. It takes effect immediately and Winnow can no longer read anything.
Delete the local data
Delete secrets.json to destroy the stored credentials, and delete the state, logs and out folders to remove the classifier, the run history and the saved digests. Deleting the installation folder removes everything Winnow has ever stored.
Undo the filing
Winnow only ever moves messages between labels, so anything it filed is still in your mailbox and can be moved back. Nothing needs recovering.
09POPIA and GDPR
Under the Protection of Personal Information Act 4 of 2013, you are the responsible party for the personal information in your own mailbox. Because Winnow processes it only within your own environment, RedClyph does not act as an operator in respect of that information: we neither receive it nor process it on your behalf. No operator agreement under section 20 is required between us for the software's ordinary use, and no cross-border transfer under section 72 arises from Winnow itself.
If you enable the optional AI feature described in section 05, you are choosing to transfer message content to Anthropic PBC in the United States. That transfer is yours, made from your systems under your control, and you should satisfy yourself that it is lawful for your circumstances — particularly if the mailbox contains client, patient, or other confidential information. The same reasoning applies under the UK and EU GDPR where those apply to you.
The provisions above describe the software as distributed. If RedClyph ever offers Winnow as a hosted service, that would be a different arrangement with different obligations, and it would be covered by a separate agreement and a revision of this page.
10Security
- Credentials are encrypted at rest using the Windows Data Protection API, scoped to a single Windows account on a single machine. Copying the file elsewhere yields nothing usable.
- All communication with Google and with Anthropic uses HTTPS with TLS 1.2 or better.
- Winnow requests the narrowest scopes that let it work, which is why it cannot delete mail.
- Web addresses are stripped from message bodies before any excerpt is transmitted. This removes the per-recipient tracking and authentication tokens that many senders embed in links.
- Because the software runs on your equipment, its security also depends on yours: disk encryption, account passwords, and who can use the machine.
11Children
Winnow is a tool for managing a business or personal mailbox and is not directed at children. We do not knowingly collect information from anyone, of any age, because we do not collect information at all.
12Changes to this policy
If this page changes materially, the effective date and version at the top will change with it. Because Winnow does not contact RedClyph, we have no way to notify you automatically: check this page after updating the software.
13Contact and complaints
Questions about this policy, or about how Winnow handles data, go to info@redclyph.co.za or +27 82 417 0098.
If you are in South Africa and believe your personal information has been handled unlawfully, you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or at inforegulator.org.za.