Privacy policy.

Pathlight lets you connect a supported email or calendar account — Gmail, Google Calendar, Outlook Mail, Outlook Calendar, or iCloud Mail — so you can ask Pathlight to perform tasks such as:

• Reading, searching, and summarizing email
• Drafting, replying to, forwarding, starring, archiving, or moving email
• Reviewing, creating, changing, or deleting calendar events (Gmail/Google Calendar and Outlook)
• Looking up the people you ask about, to resolve recipients (Gmail and Outlook)
• Creating reminders or follow-ups
• Answering general questions and providing weather or location-aware answers
• Using voice commands to complete supported digital tasks

Signing in to Pathlight (including with Apple, Google, or Outlook) is separate from connecting a mailbox: signing in creates your account, and you separately authorize each mailbox or calendar you want Pathlight to access. Pathlight does not access your connected accounts unless you authorize that access.

We collect information in the following categories.

A. Account Information

When you create or use a Pathlight account through our authentication provider, we may collect:

• Name
• Email address
• Authentication identifiers
• Device or app identifiers
• Basic profile information you provide

B. Connected Account Data

When you connect a mailbox or calendar, Pathlight accesses and processes data from that service, depending on the permissions you grant, only to perform the tasks you ask for. The connected services and the data involved are described below. We only request access that is reasonably necessary to provide the features you use, and we access this data on demand rather than bulk-importing it (see section 9).

B1. Google (Gmail, Google Calendar, Google Contacts)

If you connect Google, Pathlight may access:

• Email metadata, including sender, recipient, subject, timestamps, thread IDs, labels, read/unread status, and starred status
• Email content, including message bodies and snippets, when needed to read, summarize, search, draft, reply, or forward at your request
• Calendar data, including event titles, times, attendees, locations, descriptions, and reminders
• Contact data from Google Contacts (read-only), including names and email addresses, used to look up the people you ask about

Section 4 sets out our Google-specific Limited Use commitments.

B2. Microsoft (Outlook Mail, Outlook Calendar, Microsoft People)

If you connect an Outlook or Microsoft 365 account, Pathlight uses Microsoft Graph (OAuth) and may access:

• Outlook email metadata and content (sender, recipient, subject, timestamps, folders/labels, message and conversation IDs, and message bodies) to read, summarize, search, draft, reply, forward, send, and organize mail at your request
• Outlook calendar data (event titles, times, attendees, locations, descriptions) to review, create, change, or delete events
• Microsoft People data (read-only) to resolve the recipients you name (for example, "send to John")
• For work or school accounts only, your mailbox time-zone setting, used to schedule correctly

Pathlight requests read-only access to Microsoft People for recipient resolution; it does not request write access to your Microsoft contacts.

B3. Apple iCloud Mail

If you connect iCloud Mail, Pathlight connects to iCloud Mail (email only) over IMAP/SMTP. Pathlight may access iCloud email metadata and content (sender, recipient, subject, timestamps, folders, and message bodies) to read, summarize, search, draft, reply to, and send mail at your request. iCloud Calendar and Apple Contacts are not connected.

iCloud Mail uses an Apple app-specific password, not your normal Apple Account password. You create an app-specific password in your Apple Account and enter it in Pathlight together with your iCloud email address. We classify this app-specific password as an authentication credential: it is sent to the Pathlight backend over an encrypted connection, validated against Apple's mail servers, and stored encrypted at rest. It is never shown back to you, never written to our logs, never included in analytics, and never sent to AI providers — it is used only to sign in to your iCloud Mail to perform the tasks you request. See sections 11 and 15 for storage, disconnection, and revocation.

C. Voice, Speech, and Command Data

Because Pathlight is a voice assistant, we may process:

• Voice audio you speak to Pathlight
• Speech-to-text transcripts
• Text commands
• Corrections, interruptions, cancellations, and follow-up instructions
• The text Pathlight speaks back to you

D. Location Data

Pathlight can use your approximate or precise device location to provide weather and location-aware answers (for example, “what's the weather near me”). Location is used at the time of your request and is not stored in a long-term Pathlight profile of your movements. You can grant or decline location access, and change it later, in iOS Settings.

E. Preferences and Task Data

To provide the service, Pathlight may store a limited set of operational data, including:

• Your preferences (such as voice and assistant settings)
• Internal references linking your Pathlight account to your connected provider
• Short-lived task and conversation context used to complete a request, which expires automatically

F. Usage, Analytics, and Performance Data

We collect product analytics to understand whether Pathlight is working correctly. These are event-level signals only — they do not include your email, calendar, contact, voice, or transcript content. They may include:

• Task start, completion, error, and cancellation events
• Whether you connected a provider and how many permissions were granted
• Latency and integration success or failure
• App version, device type, and operating system

G. Support and Feedback Data

If you contact us, submit feedback, or participate in testing, we may collect:

• Your messages to us
• Feedback, including a rating and any comment you choose to write
• Bug reports and information needed to resolve your issue

We use your information to provide, maintain, secure, and improve Pathlight. Specifically, we may use information to:

• Authenticate your account
• Connect authorized third-party services
• Read, summarize, search, draft, reply to, forward, move, archive, star, or otherwise manage email at your direction
• Manage calendar events at your direction
• Look up contacts you ask Pathlight to use
• Provide weather and location-aware answers when you ask for them
• Generate responses, summaries, drafts, and confirmations
• Store and apply your preferences
• Improve task accuracy, reduce latency, and detect and recover from errors
• Ask clarifying questions when your intent is ambiguous
• Provide accessibility-focused experiences and monitor system performance
• Prevent unauthorized or unsafe actions and comply with legal obligations

We do not use your emails, calendar data, contacts, or connected account content for advertising.

We do not sell your personal information.

If you connect a Google account, Pathlight's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Google permissions Pathlight requests cover Gmail (read and modify), basic Gmail settings (used only to list the verified “from” / send-as addresses on your account so Pathlight can send a message from the correct address), Google Calendar, and read-only access to Google Contacts. This means:

• We use Google user data only to provide or improve user-facing Pathlight features that you authorize.
• We do not sell Google user data.
• We do not use Google user data for advertising.
• We do not transfer Google user data except as necessary to provide or improve Pathlight, comply with law, protect security, or as otherwise permitted by Google's policies.
• We do not allow humans to read Google user data unless necessary for security, support, legal compliance, or with your explicit consent.
• We do not use Google Workspace or Gmail data to train general-purpose AI models.

Pathlight uses AI models to understand commands, classify intent, summarize information, draft content, search, and generate responses. Pathlight also uses speech services to turn your voice into text and to speak responses back to you.

To provide these features, your voice audio, transcripts, and the relevant portions of your email, calendar, contact, or location data may be sent to third-party speech and AI providers that help process your request. These providers currently include OpenAI, ElevenLabs, and xAI (Grok). We require these third parties to protect your information and to use it only to provide services to Pathlight. This processing does not happen solely on your device.

We use these providers only to provide Pathlight's functionality, operate and improve the service, and complete the tasks you request. We do not permit these providers to use your connected account content for advertising. We direct providers not to use your connected account content to train general-purpose AI models. Whether a provider further limits its own retention or training is governed by our agreements and that provider's settings; see section 6.

Where possible, Pathlight minimizes the data sent to providers by using transcripts, retrieved snippets, and task-specific context rather than sending unnecessary full account histories.

We work with the service providers below to operate Pathlight. They are authorized to process information only as needed to provide services to Pathlight and are not permitted to use it for their own advertising.

We may add, remove, or change service providers as the product evolves, and we may use additional AI providers for processing. We will update this policy when changes materially affect how we handle personal information.

Pathlight is designed so that our team does not normally need to view your personal emails, calendar events, or contacts. Human access may occur only in limited circumstances, such as:

• You explicitly ask us for support that requires reviewing specific data
• You provide data to us voluntarily for debugging or feedback
• We need to investigate security abuse, fraud, or system misuse
• We are required to comply with law
• We need to protect the rights, safety, or security of users, Pathlight, or others

When human access is needed, we aim to limit access to the minimum information necessary.

Pathlight asks for confirmation before taking actions that modify your accounts or communicate with others. These generally include:

• Sending a new email
• Replying, replying all, or forwarding
• Moving or deleting emails
• Marking an email as spam
• Creating, changing, or deleting calendar events
• Taking actions that may affect third parties or your account state

If Pathlight is unsure what you mean, or multiple contacts or emails match, Pathlight should ask a clarifying question rather than guessing.

For every connected service — Gmail, Google Calendar, Outlook Mail, Outlook Calendar, and iCloud Mail — Pathlight accesses your email, calendar, and (for Gmail/Outlook) the people you ask about on demand to complete the task you ask for. Pathlight does not bulk-import or maintain a long-term copy of your mailbox. Email searches are intentionally limited in scope and return a small number of relevant results for the request at hand.

To complete a request, Pathlight temporarily processes the content it retrieves. It may keep short-lived task context that expires automatically, generally within about a day, and may record limited operational details in system logs, such as recipient addresses and short snippets of your request, to operate and troubleshoot the service. Pathlight does not create a permanent searchable archive of your historical email, and does not use your email for advertising or profiling. If you choose to paste email text into a feedback message, that text is stored with your feedback as described in section 2G.

We retain information for as long as reasonably necessary to provide the service, secure it, comply with legal obligations, resolve disputes, and enforce agreements. In practice:

• Account information is retained while your account remains active.
• Connected-account tokens are retained while the integration remains connected.
• Preferences are retained while your account remains active.
• Short-lived task and conversation context expires automatically.
• Usage analytics are retained for product improvement and reliability monitoring.
• Support and feedback communications are retained as needed for support, audit, and legal purposes.

Email, calendar, and contact data is accessed on demand to complete your requests and is not stored by Pathlight as a durable archive (see section 9).

You may request deletion of your Pathlight account or connected data, or delete your account in the app. See our account deletion page. After a verified deletion request, we will delete or de-identify applicable data unless we are required or permitted to retain it for security, legal, fraud-prevention, backup, or compliance purposes.

For Google and Microsoft (Outlook), Pathlight uses OAuth, so you authorize Pathlight without giving us your account password. We store the access and refresh tokens needed to keep your integration working. For iCloud Mail, Pathlight stores the Apple app-specific password you provide (not your normal Apple Account password) so it can sign in to your iCloud Mail. All of these credentials are encrypted at rest and may also be kept in a secured token database we operate. The iCloud app-specific password is never logged, never included in analytics, and never sent to AI providers.

You can disconnect any integration in Pathlight's settings. Disconnecting removes the access (or credential) Pathlight stores for your account. In addition:

• Google: when you disconnect or delete your account, Pathlight revokes the Google grant on Google’s side; you can also remove Pathlight from your Google Account’s third-party access settings.
• Microsoft / Outlook: Pathlight deletes the stored tokens locally; Microsoft does not offer a programmatic delegated-token revoke, so you should also remove Pathlight from your Microsoft Account’s app permissions to revoke access on Microsoft’s side.
• Apple iCloud Mail: Pathlight deletes the stored app-specific password; you can also revoke that app-specific password at any time in your Apple Account settings.

This section covers the Pathlight website (the app is covered above).

• Contact form: if you submit the website contact form, we collect your name, email, reason, and message, and deliver it to us using our email provider (Resend) so we can reply.
• Server logs: our hosting and infrastructure providers may process standard technical data such as IP address, browser type, and request information to operate and secure the site.
• Demo scheduling: the demo page embeds a Cal.com scheduler. If you book a demo, Cal.com processes the booking details you enter under its own privacy practices.
• The Pathlight website does not use advertising trackers and does not sell personal information.

Pathlight does not sell your personal information.

Pathlight does not sell your email content, calendar content, contact data, voice, or transcripts.

Pathlight does not use your connected account content for targeted advertising and does not share it with advertisers.

We may share information only in limited circumstances.

A. Service Providers

We share information with the providers listed in section 6, only as needed to operate Pathlight.

B. Connected Services

When you ask Pathlight to take an action through a connected service — Google (Gmail/Google Calendar), Microsoft (Outlook Mail/Calendar), or Apple iCloud Mail — we send the necessary information to that provider to complete the task. For example, if you ask Pathlight to send an email, we send the recipient, subject, body, and related message or thread information to your email provider.

C. Legal, Safety, and Security

We may disclose information to comply with law or legal process, protect user safety, investigate fraud or abuse, enforce our terms, or protect the rights, property, or security of Pathlight, users, or others.

D. Business Transfers

If Pathlight is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, user information may be transferred as part of that transaction, and we will take reasonable steps to require the recipient to handle it consistently with this Privacy Policy.

You may:

• Connect or disconnect Gmail/Google Calendar, Outlook, or iCloud Mail in Pathlight
• Revoke Pathlight’s access at the provider: your Google Account third-party access settings, your Microsoft Account app permissions, or by revoking the iCloud app-specific password in your Apple Account settings
• Grant or decline microphone and location access in iOS Settings
• Change your preferences
• Delete your Pathlight account in the app or by contacting us
• Request access to, correction of, or deletion of certain personal information

To make a request, contact us at pathlightproj@gmail.com. We may need to verify your identity before fulfilling certain requests.

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information we hold about you, and to ask us about how we handle your information. You can exercise these rights by contacting us at pathlightproj@gmail.com. We will not discriminate against you for exercising these rights.

Pathlight does not sell personal information and does not use connected account content for targeted advertising. We may need to verify your identity before responding to a request.

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect user information. These may include:

• Access controls and least-privilege practices
• Secure credential handling
• Encryption in transit
• Encryption of stored credentials
• Logging and monitoring
• Internal restrictions on human access

No system is perfectly secure. We cannot guarantee absolute security, but we work to protect user data and improve our safeguards over time.

Pathlight is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete it.

Pathlight may work with blind and low-vision testers, advisors, and users to improve accessibility and reliability.

If you participate in testing, we may collect feedback, task results, transcripts, bug reports, or other information you choose to provide, and we will use it to improve Pathlight. We will not publicly identify testers or users without consent.

Pathlight is currently intended primarily for users in the United States. If you use Pathlight from outside that region, your information may be processed in countries that may have different data protection laws than your country of residence.

Where required, we will take appropriate steps to protect personal information in accordance with applicable law.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the website, app, email, or another reasonable method.

The “Last updated” date at the top of this policy indicates when it was last revised.

For privacy questions, requests, or concerns, contact us at:

The Pathlight Project, Inc.
Email: pathlightproj@gmail.com