Effective July 27, 2026

Privacy Policy

This policy describes how Scroller, Inc. ("Scroller," "we," "us," or "our") accesses, uses, stores, shares, and deletes information when you use Scroller. Scroller is not intended for children under 13.

Information we collect

• Account information, such as your email address, connected Gmail or Outlook accounts, app settings, and authentication session information.
• Google Gmail data that you authorize Scroller to access through Google APIs, including message metadata, sender and recipient details, subject lines, message bodies, labels, read state, thread data, images, and attachments needed to provide Scroller features.
• Microsoft Outlook or Microsoft 365 data that you authorize Scroller to access through Microsoft Graph, including equivalent message, mailbox, folder, thread, image, and attachment data needed to provide Scroller features.
• Derived app data, such as rewritten subjects, summaries, semantic search embeddings, grounded Ask answers and source references, sender domains, sender logos or favicons, verification code detection, subscription detection, spam classification, ignored sender rules, and summary preferences.
• Technical data, such as app version, server logs, device and request metadata, error diagnostics, and security events.

How we use information

• To sync messages from Gmail or Outlook accounts that you choose to connect.
• To summarize emails and replies, rewrite subjects, extract relevant images and attachments, group message threads, semantically search mail, answer user-submitted questions from cited source emails, and display your feed and mailbox.
• To perform mail actions you request, such as marking messages read or unread, archiving, deleting, reporting spam, unsubscribing, composing, replying, and forwarding.
• To maintain security, prevent abuse, debug problems, improve reliability, and provide support.
• To comply with legal obligations.

Google user data and Limited Use

Scroller's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Gmail data only to provide or improve user-facing Scroller features that are visible in the app.
• We do not sell Gmail data.
• We do not use Gmail data for advertising, retargeting, personalized ads, or determining creditworthiness.
• We do not transfer Gmail data to third parties except as needed to provide Scroller features, maintain security, comply with law, or complete a merger, acquisition, or sale of assets with required user consent.
• Humans do not read your Gmail content unless you explicitly ask us to review specific content for support, it is necessary for security or abuse investigation, it is required by law, or the data is aggregated and does not identify you.

Microsoft user data

• We access Microsoft mailbox data only after you grant permission through Microsoft's consent flow.
• We use Microsoft mailbox data only to provide and secure the Scroller features you request.
• We do not sell Microsoft mailbox data or use it for advertising, retargeting, determining creditworthiness, or creating data-broker products.
• Humans do not read your Microsoft mailbox content unless you explicitly ask us to review specific content for support, it is necessary for security or abuse investigation, or it is required by law.

Raw, derived, and operational email data

• Raw email data includes message and thread metadata, sender and recipient details, subjects, message bodies, labels or folders, read state, images, and attachments that you authorize Scroller to access from a connected provider.
• Derived email data includes summaries, rewritten subjects, classifications, semantic search embeddings, grounded answers and source references, sender and subscription information, extracted image and attachment references, verification-code detection, and user-created rules associated with your mail.
• Scroller does not use raw or derived connected email data to create cross-user advertising profiles, data-broker products, or AI training datasets.
• Scroller may use service-level statistics, such as request counts, processing times, error rates, and queue health, to secure and improve the service. These operational statistics are not used to reconstruct email content, identify correspondents, advertise to users, or train AI models.

AI processing

Scroller sends the minimum sender information, subject, message text, user summary rules, questions, and derived context needed to OpenAI to generate user-facing summaries, rewritten subjects, classifications, grounded answers, and related features. Scroller does not use raw, derived, aggregated, or anonymized connected email data to train, develop, or improve generalized or personalized AI or machine-learning models.

Scroller does not opt in to sharing OpenAI API inputs or outputs for model training. Under OpenAI's standard API data controls, API inputs and outputs may be retained for up to 30 days for abuse monitoring unless shorter retention controls apply. OpenAI processes this data as a service provider only to provide the requested Scroller functionality.

How we share information

We transfer connected email data only as needed to provide or improve visible Scroller features, maintain security, comply with law, or complete a merger, acquisition, or sale of assets subject to applicable notice and consent requirements. DigitalOcean hosts Scroller's application, database, and operational infrastructure. OpenAI receives the limited email content and context described above for user-facing AI processing. Google and Microsoft provide their respective OAuth authorization and mail APIs. We do not share connected email data with advertisers, data brokers, information resellers, or lending providers. Current providers are listed on the Subprocessors page.

Security and retention

We use security measures such as HTTPS, access controls, encryption of sensitive OAuth tokens, sensitive log filtering, private database and queue services, and restricted production access.

• Connected-account records, synchronized email records, summaries, settings, extracted media references, and attachment previews are retained while the email account remains connected so Scroller can provide its email-client features.
• A separately prefetched rich HTML representation used to accelerate full-email expansion is cleared after it is at least 24 hours old and its thread is no longer eligible for the Feed. The underlying synchronized message record remains available until the connected account or its synchronized data is deleted.
• Operational logs are filtered to avoid email bodies, OAuth credentials, authorization headers, and raw provider responses where possible. Logs are rotated by size and retained only for security, troubleshooting, and reliability operations.
• Backups, when maintained, are access-restricted and follow Scroller's operational backup rotation. Deleted information may remain in a backup until that backup is overwritten. Backups are not used for routine processing, and deletion obligations are reapplied after a restoration where practical.
• OpenAI API retention is described in the AI processing section above.

Disconnecting a connected email account deletes that account's synchronized Scroller data and stored provider tokens. Deleting synchronized data removes all connected-account data while preserving the Scroller login record. Deleting the Scroller account removes the Scroller profile and associated connected-account data. These actions do not delete messages from the original mailbox. Limited records may be retained when required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcement.

Your choices

• You can disconnect Google or Microsoft access in Scroller settings or revoke Scroller from the connected provider's account or organization permissions.
• You can delete your Scroller account and stored app data by following the data deletion instructions.
• You can manage ignored senders, summary rules, connected accounts, and subscription preferences in Scroller settings.

Contact

For privacy questions, contact Scroller, Inc. at privacy@scroller.ai.