Chiefy reads your email so it can draft, summarize, and organize it for you. That means it has to handle genuinely sensitive data, and we treat it that way. This page explains, in plain terms, how that data is protected — what’s encrypted, how Chiefy connects to your inbox, and the limits we put on what we keep.

Encryption at rest

The sensitive parts of your data are encrypted before they’re written to our database, not just protected by the database’s perimeter. We use MongoDB Client-Side Field Level Encryption (CSFLE): specific fields are encrypted by the application using strong, industry-standard encryption (AES-256) before they ever reach storage. Even someone with direct access to the raw database sees ciphertext, not your email.

The encryption keys are managed by Google Cloud Key Management Service (KMS). The master key that protects everything lives in Google Cloud KMS and never leaves it; the per-field data key is itself stored encrypted. This is the same class of key-management infrastructure used to protect production data at major cloud providers.

What’s encrypted at the field level includes:

• Your email message contents — the bodies and metadata of the conversations Chiefy syncs.
• The credentials that connect to your mailbox — the access and refresh tokens for your Gmail and Outlook accounts (more on these below).
• Selected draft details — fields tied to the replies Chiefy prepares for you.

Encryption at rest protects stored data. Data is also encrypted in transit over standard HTTPS/TLS whenever it moves between your browser, Chiefy, and the email providers.

How Chiefy connects to your inbox

Chiefy connects to Gmail and Outlook using OAuth 2.0 — the standard “Sign in with Google” / “Sign in with Microsoft” flow. This matters for a simple reason: Chiefy never sees or stores your email password. Instead, your provider issues Chiefy a scoped token that grants access to your mailbox, and you can withdraw that token whenever you like.

Those mailbox tokens are exactly the credentials described above — they’re stored using the same field-level encryption as your email contents, never in plain text. If they were ever read out of the database directly, they’d be unreadable ciphertext.

Because access works through a revocable token rather than a password, you stay in control. You can disconnect a mailbox from Chiefy, or revoke access entirely from your Google or Microsoft account settings — see Delete your data or revoke access.

Chiefy · Privacy & data

Privacy & data

Control what Chiefy adds to your mail, the language it speaks, and access to your inbox.

Sent with Chiefy

Adds a small line at the end of drafts Chiefy writes for you.

Language

Controls Chiefy product text. Email drafts still follow the conversation language.

Use browser language

Bookings Connected

bookings@bayviewcottages.com

Disconnect

Disconnecting pauses sync and stops Chiefy reading this mailbox. You can reconnect anytime.

Sign out

End your session on this device.

Logout

Protecting your Chiefy sign-in

Separately from your mailbox connection, Chiefy protects your own sign-in to the product. Sessions use short-lived access tokens paired with longer-lived refresh tokens, and those refresh tokens are guarded against reuse.

If a refresh token is ever presented twice — a signal that it may have been stolen and replayed — Chiefy treats that as a security event and revokes the entire chain of related tokens at once, rather than honoring the request. That family-based revocation means a leaked token can’t be quietly reused to stay signed in. Per-device sign-ins are also tracked as groups, so you can be signed out of one device without disturbing the others.

Data minimization

The strongest protection for sensitive data is not collecting it in the first place. Chiefy is built to keep what it needs to do its job for you and avoid spreading sensitive details further than necessary:

• Scoped access. Chiefy requests the access it needs to read and draft mail on your behalf — not blanket access to your whole account.
• Tight credential handling. Mailbox tokens and your email contents are encrypted at the field level, so sensitive values aren’t sitting in plain text anywhere in our systems.
• Care with third parties. Where Chiefy works with outside services, it’s deliberate about what leaves our systems, and avoids passing along sensitive identifiers that aren’t needed for the task.

For the full picture of what Chiefy reads and what it deliberately leaves alone, see What Chiefy can and cannot access.

You stay in control

Encryption and careful handling are only half of trust — the other half is being able to walk away. You can disconnect any mailbox, sign out of a single device, or delete your data and revoke Chiefy’s access to your accounts entirely. When you revoke access at your email provider, the token Chiefy holds stops working. See Delete your data or revoke access for the steps.