Privacy Policy

Oushi (“Oushi,” “we,” “us”) is an AI inbox assistant. This Privacy Policy applies to the Oushi website and product at oushi.app(the “Service”).

By using Oushi, you agree to the practices described here.

To do what we do, we need access to certain information:

Every piece of data we collect is used to provide and improve the Service for you. Specifically:

• Reading your Gmail content lets Oushi rank emails, write briefings, draft replies in your voice, and remember context across threads.
• OAuth tokens let Oushi sync your inbox in the background without you logging in every time.
• Your profile and feedback let Oushi personalize its rankings and drafts to you specifically.
• Calendar access lets Oushi create events you ask it to save.
• Server logs let us debug, prevent abuse, and keep the Service running.

Oushi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This specifically means:

• We will never sell your Gmail data to anyone.
• We will never use it for advertising, whether on Oushi or any third-party platform.
• We will never use your Gmail content to train generalized AI or ML models. Your data is used to personalize your Oushi experience only.
• We will not let humans read your Gmail content except in narrow cases: (a) with your explicit consent, (b) for security investigations (e.g., to detect abuse), (c) for required debugging where automated tools are insufficient, or (d) when legally required.
• Sub-processors (described below) only process your data in service of providing Oushi to you, and they do not get standalone rights to your data.

We use a small set of trusted infrastructure providers to operate Oushi. Each only sees the minimum data needed to do their job, and each has their own SOC2-compliant security posture.

Sub-processors may change as we evolve the product. We will update this policy if so.

• All data in transit is encrypted using TLS.
• All data at rest is encrypted using industry-standard encryption (AES-256).
• OAuth tokens are stored encrypted in the database and are never shown in our logs or analytics.
• Row-level security is enforced in our database: even if there were a bug in our app, users cannot read each other's data.
• We do not store your Google password — only the OAuth tokens Google issues us. Revoke them anytime at your Google Account → Security → Third-party apps.

We keep your data only as long as you use Oushi. If you delete your account, we delete all of your data from our systems within 30 days (with the exception of anonymized server logs, retained up to 90 days for security and debugging).

Synced email metadata is kept while you're an active user so we can show you your past inbox and surface old commitments. Memory entries auto-expire on a schedule (typically 30-365 days) unless you pin them.

You can do all of the following yourself, anytime, from your Settings page:

• Export your data: One-click JSON download of everything Oushi has about you — profile, boards, feedback, synced emails, memories.
• Delete your account: One-click permanent deletion of everything across all our tables, plus your auth record.
• Disconnect Gmail: Revoke Oushi's access via your Google Account at any time. Oushi will stop syncing immediately.
• Edit or delete memories: View, pin, or forget any specific memory Oushi has formed about you.
• Edit your profile: Update bio, interests, priorities, and noise filters at any time.

If you reside in the EU/UK, you also have the right to access, correct, port, or restrict processing of your personal data, and to lodge a complaint with your local data protection authority. To exercise these rights beyond what the in-app controls allow, email hi@oushi.app.

If you reside in California, you have additional rights under the CCPA, including the right to know what we collect, the right to delete, and the right not to be discriminated against for exercising your rights. We do not sell personal information.

Oushi is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Oushi is operated from the United States and our infrastructure providers are primarily based in the US and EU. By using Oushi, you consent to your data being processed in the US.

When we make material changes to this policy, we'll update the “Last updated” date at the top and, where reasonable, notify you via email or in-app. Continued use of Oushi after changes means you accept the new policy.

Questions, requests, or concerns? Email hi@oushi.app. We aim to respond within a few business days.