This page describes what Signal actually does with your data, technically and accurately. It is not a substitute for legal advice — if you operate this for customers beyond personal use, have it reviewed by a lawyer for compliance with GDPR or other applicable law in your jurisdiction.
1. Who we are
Signal by Expandeum (“Signal”, “we”, “us”) is an AI-assisted email management platform operated by Expandeum. Contact: adam@expandeum.com.
2. What data we collect
- Account data: your name, email address, and a securely hashed password (we never store your password in plain text).
- Connected mailbox credentials: if you connect a Gmail, Microsoft, or IMAP/SMTP account, we store an encrypted OAuth token or encrypted mailbox password to keep your connection alive. These are encrypted at rest and only decrypted in memory to communicate with your mail provider.
- Email content and metadata: messages, senders, subjects, and attachments from mailboxes you connect, so Signal can display and organize them for you.
- AI-derived data: summaries, priority scores, extracted tasks, invoices, contacts, and calendar events that our AI analysis generates from your email content.
3. How we use your data
We use your data only to operate Signal for you: syncing your connected mailboxes, displaying your inbox, and generating the AI summaries, tasks, and signals that make Signal useful. We do not sell your data, and we do not use your email content for advertising.
4. Third parties we share data with
- AI analysis provider (Anthropic): when Signal analyzes an email (to generate a summary, priority score, or extract a task/invoice/event), the relevant email content is sent to Anthropic's Claude API for processing. See Anthropic's privacy policy.
- Gmail / Microsoft: if you connect a Gmail or Microsoft account, Signal communicates with Google's or Microsoft's APIs using the access you grant during their OAuth consent screen, strictly to read/send mail on your behalf.
- Your own mail server: if you connect via IMAP/SMTP, Signal connects directly to the mail server you specify.
We do not share your data with any other third party, and we do not sell data to anyone.
5. Data retention and deletion
You can disconnect any connected mailbox at any time from Settings → Accounts, which deletes its synced messages from Signal. To delete your entire account and all associated data, email adam@expandeum.com and we will process your request promptly.
6. Security
All traffic to Signal is encrypted in transit (HTTPS/TLS). Mailbox credentials and OAuth tokens are encrypted at rest. Your account password is hashed and never stored or transmitted in plain text.
7. Cookies
Signal uses only strictly necessary cookies for authentication (session and CSRF protection). We do not use advertising or third-party tracking cookies.
8. Your rights
Depending on your location, you may have rights to access, correct, export, or delete your personal data. Contact adam@expandeum.com to exercise these rights.
9. Changes to this policy
We may update this policy as Signal evolves. Material changes will be reflected by updating the “Last updated” date above.