What Polyxn does with what you send us and with your Gmail

What the form collects

The form asks for your first name, your email and, if you like, what you really hate about bills and planning. We keep your answers, the date you sent them and, if you join the waitlist, when you confirmed your email. Earlier versions of the form also asked for your city, and we keep those answers with the rest.

When you join the waitlist, we keep four things you did not type. If somebody else's link brought you here, we keep whose link it was. If you came through a link we posted somewhere, we keep which one. That is how we know who or what told you about Polyxn. We also make you a link of your own to share, and keep it so we know who you bring. We also keep the country your visit came from, which Vercel, where this site runs, reports with every request. Polyxn opens first in the US, and that is what it tells us. With a contact message, the country is the only one of the four we keep.

Your answers are kept in a database that belongs to this site alone. Nothing here is joined to a Polyxn account.

To join the waitlist, we email you a code that confirms the address is yours. A code, and what was sent with it if it is never confirmed, are cleared out after a day, the next time we send a code.

While you confirm your email, the browser tab you signed up in keeps what you typed, and the link you came through, so reloading the page within ten minutes of your latest code does not lose them. They stay in that tab, and are cleared when you confirm, when you use a different email, when you close the tab, or when the form next loads there after those ten minutes.

The emails this site sends go out through Resend. Resend sees your address and what each email says, and handles them under its own privacy policy at resend.com/legal/privacy-policy.

We also email ourselves your first name, your email, what you really hate about bills and planning, your country and, when you join the waitlist through somebody else's link, whose link it was, so all of it passes through Resend and is kept in our inbox too.

If an email to you cannot be delivered, or is marked as spam, we keep your address on a list so we never send to it again.

A check from Cloudflare, called Turnstile, makes sure a person and not a script is sending the form. To do that, once you start on the form, Cloudflare sees your IP address and signals from your browser, and handles them under its own privacy policy at cloudflare.com/privacypolicy and its Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.

So that nobody can flood the form, we limit how often one IP address can send us your answers or a code. Each time the limit lets a send through, we keep a scrambled version of the IP address it came from, on its own and not with your answers. Each one is cleared once it is over an hour old, the next time the limit lets a send through.

Once your email is confirmed, the form asks a few more questions, all optional: where you bank, which phone you use, how you keep track of your money and why you stopped if you used an app, what has cost you time or money this year, and how you would like to tell us how it's going. We keep only what you choose to answer, and when you saved it.

What we count

We count how the page is read: pages opened, links followed, and whether a form was sent. Those counts carry no name, no email and no message.

Analytics uses a cookie so one visit reads as one visit while you are on this site. It stays on this site and is not sent anywhere else. Where the law asks first, we ask first, and nothing is set until you say yes.

Turning it off changes nothing else on this page. Every section, every link and the form work the same either way.

How long we keep it

We keep what you send until you ask us to remove it, except what is sent with a code that is never confirmed, which is cleared out as above. Ask by email and say which address you sent it from.

When you ask us to remove your details, we do, except that an address on the list of addresses we never send to stays there, so nothing is ever sent to it again.

If you connect Gmail

The Polyxn app is not open yet. This section describes how the app will handle your Gmail once it opens, so you can see exactly what you'd be agreeing to before you join.

Connecting Gmail is your choice, and Polyxn works without it. If you connect it, Polyxn reads the emails in it that are about your money, so it can tell you, for example, when a price is going up, a refund is late or a bill is due, and match an emailed receipt to the charge it belongs to. Everything it finds is shown in the app, on a screen for each kind of email and under What Polyxn read, where you can remove any of it.

Polyxn asks Google for read-only access to your Gmail, and to know which Google account is yours. Google's screen says Polyxn can read your email, because that access covers your whole mailbox: Google offers none narrower that lets Polyxn search your mail and read the emails about money. Polyxn uses it only as this section says. Of your Google account it takes only Google's id for it and the address of the Gmail you connect.

Polyxn looks back 90 days when you connect, then checks for new mail about once an hour. Each check runs searches inside your Gmail, and Google receives every search, the way it receives your own. A search names the words Polyxn looks for in a subject, such as receipt, refund, renewal or price; the senders it looks for, such as known billers and shops, senders whose addresses hold words like billing or receipts, and mail in Gmail's Purchases category; and the senders it leaves out, the ones Polyxn has stopped reading for you among them. A search may also name the web addresses of businesses your bank shows you spent money with, so Google receives those addresses too. Mail the searches do not find never reaches Polyxn.

For each email a search finds, Polyxn first reads only its outside: the sender, the subject, when it arrived, its size, the labels Gmail gave it, whether it offers a way to unsubscribe, and Gmail's own check of whether it really came from its sender. Mail that fails that check, mail over 2 MB, and mail from a personal address, such as one at gmail.com, are never opened. When the rules in Polyxn's code cannot tell whether an email is about money, an outside service sorts it from its outside alone. Only an email about money is opened, to pick out its facts, such as the amount, the day, the business and what it was for. Attachments are never opened.

Polyxn runs on Vercel, so what Polyxn reads passes through Vercel's servers. The sorting, and the picking out of facts, are done through Vercel's AI Gateway by two companies: TypeSafe, whose Jev sorts an email from its outside, and Anthropic, whose Claude sorts what Jev is unsure of and picks out the facts from an email's text. They are sent the outside of an email, or its text, and nothing else Polyxn holds about you, though an email's text can itself hold your name or address. Every one of these requests is made under zero data retention: Vercel, TypeSafe and Anthropic keep neither what they are sent nor what they answer, and none of it is used to train them. What Polyxn keeps is stored in its database at Neon, and what it found is encrypted under a key kept for you alone, which Polyxn's servers use and Google Cloud's key service protects. Polyxn's counts of how the app is used, at PostHog, hold nothing an email says. No other company receives anything from your Gmail.

For each email about money, Polyxn keeps what kind it is, its facts, the web domain it came from, the day it came, Gmail's id for it and how it was sorted. For any other email it looked at, and for one you remove, it keeps at most a scrambled fingerprint of Gmail's id, so the email is not looked at twice. For a sender whose mail keeps turning out not to be about money, it keeps a scrambled count, and after five in a row, the sender's address, on your list of senders Polyxn no longer reads. It also keeps any correction you make, how many emails each check looked at and opened, the address of the Gmail you connect, which names it on your screens, and a scrambled form of its Google account's id, so the same Gmail is not connected to two Polyxn accounts. An email's text, its subject, its attachments, links and pictures are never stored. What it found, and what it keeps of each email and each sender, is encrypted or scrambled under a key kept for you alone, which Polyxn's servers use and Google Cloud's key service protects. Four things are not: the address of your Gmail, until it is disconnected or removed; Polyxn's own bookkeeping, such as when each check ran, how far it got, how many emails it looked at and kept, and when it asked you whether to keep what it found; the token Google gave Polyxn to read your Gmail, which is encrypted under a key of Polyxn's that Google Cloud's key service protects; and that scrambled form of the Google account's id, which is made with a key of Polyxn's and stays after you disconnect, so Polyxn can finish ending Google's access. That id and some of the bookkeeping stay until your Polyxn account is deleted, even after you remove everything. Where Google does not confirm at once that Polyxn's access has ended, that id also stays in Polyxn's record of asking Google. It is removed once Google confirms and your account is deleted, or when your account is deleted if Polyxn could not ask Google at all. Our backups hold a copy for up to 7 days after it is removed.

Everything Polyxn kept from your Gmail stays until you remove it. You can remove any line in the app, or use Remove everything on your Gmail's page in Linked accounts, which also clears your list of senders Polyxn no longer reads. Disconnect, on the same page, stops the reading, asks Google to end Polyxn's access, and keeps what was found until you remove it. You can also end Polyxn's access yourself, in your Google account's settings for third-party apps. If the access ends some other way than your Disconnect, for example because you ended it at Google or changed your Google password, Polyxn asks you 90 days later whether to keep what it found, and once more a month after that. With no answer, it is removed 30 days after the second ask. When you ask for your Polyxn account to be deleted, Polyxn disconnects your Gmail at once, and what it found goes with your account 7 days later. After a removal, our backups hold a copy for up to 7 days. For a deleted account, copies in our backups of what we keep unencrypted are gone within 14 days of your request. Within 53 days, no encrypted copy can be opened.

No person at Polyxn reads your email: Polyxn never stores an email's text, so there is none to read. Once the beta opens, if you agree to it, Polyxn's founder may look at your Polyxn data to fix what it got wrong for you, and then sees the address of your Gmail and, from your email, only the facts behind something you told Polyxn about, such as a change you said was wrong. Every look is logged with its reason, and you can see the log in the app. Without that agreement, Polyxn's screens for the people running it show that you connected a Gmail and whether it is working, and not its address or anything it found. Your list of senders Polyxn no longer reads, and its counts, are shown to nobody at Polyxn.

What Polyxn finds in your Gmail is used only for what you see in the app. It is never used for ads, credit decisions or lending, and never sold. It is passed to nobody except as this section says, to give you those features, or where the law requires it. Nothing from your Gmail is used to train or improve a program that reads email, Polyxn's or anyone else's. When you correct a line, your correction changes only how your own mail is sorted.

Polyxn's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Questions about your Gmail, or a request to remove something you cannot remove in the app: privacy@polyxn.com.