Privacy policy.

The short version

• Tern fetches your mail from Google on your device and keeps it on your device. I never receive, store or read your email.
• There’s no Tern account, and there are no analytics, ads or third-party tracking tools in the app or on this website.
• To deliver notifications, a relay I run stores a keyed hash of your email address and your devices’ push tokens. It never sees message content, subjects, senders or your Google sign-in tokens, and it never stores or logs your plain address.
• AI is optional. It runs on your device, or, if you add your own API key, goes straight from your device to the provider you chose. I never see those requests.
• You can remove an account in Tern or revoke its access from your Google Account at any time. Section 12 shows how.

1. Who I am

Tern is a mail app for Gmail and Google Workspace on Mac, iPhone and iPad, published by Zachery Gentry (“I,” “me,” or “my”). This policy covers the Tern apps, the push relay that supports them, and the Tern pages on this website. Questions go to zacherygentry@gmail.com.

The design goal is to hold as little about you as possible. Most of this policy explains where your data lives instead, which is almost always on your own devices.

2. What the app accesses in your Google Account

When you sign in with Google, Tern asks for these permissions and uses them only as described:

Tern doesn’t ask for access to your Gmail settings, contacts, calendar or Drive, and it can’t permanently delete mail without it going through Trash. Blocking a sender is a rule kept on your device, not a change to your Gmail filters.

Your Gmail data (messages, attachments, labels and the metadata that goes with them) is used only to provide the features you see and use in the app: reading, searching, sorting into splits, notifications, scheduled actions, and the AI features you choose to turn on.

3. Where your data is stored

On your device

• Your mail. Messages, labels and a search index are stored in the app’s private container on each device where you use Tern, protected by the operating system’s app sandbox and data protection. This is what lets the inbox open instantly and work offline.
• Sign-in credentials. Google sign-in tokens are kept in the device’s Keychain. They are shared only with Tern’s own notification extension on the same device, so it can fetch new mail for a notification.
• Your preferences. Settings, split rules, VIPs, blocked senders and cached AI results (such as summaries) stay on the device.
• Your AI API key, if you add one, is stored in the Keychain and is never logged.

In your iCloud

• Snoozes, scheduled sends and follow-up reminders sync between your devices through your private iCloud database. The Gmail identifiers in those records (which account, conversation, draft or message they refer to) are end-to-end encrypted by iCloud with keys only your devices hold. The rest of each record is the kind of job, its times and its state. A scheduled message itself waits in your Gmail Drafts until it’s sent.
• If you turn on Sync key with iCloud Keychain, your AI API key syncs through iCloud Keychain, which is end-to-end encrypted.

iCloud is Apple’s service under your Apple Account and Apple’s privacy policy. I can’t see anything in your iCloud.

4. The push relay

Your phone can’t keep a connection to Gmail open in the background, so new-mail notifications need a server to wake it. Tern’s is a small relay hosted on Cloudflare. It’s designed so that it never handles mail: it learns only that “something changed” in a mailbox, wakes your devices through Apple’s push service, and your device then fetches the new message from Google and shows the notification itself. The push that passes through the relay and Apple says only “New mail” (or, for a snooze or reminder, a generic title).

What the relay stores

What passes through without being stored

• When a device registers, it sends a short-lived Google ID token that proves which email address it signed in with. The relay checks Google’s signature, derives the account identifier, and discards the token.
• When your mailbox changes, Google’s Pub/Sub service sends the relay your email address and a history number. The relay derives the account identifier, wakes your devices and discards the address.
• Like any internet service, the relay’s host receives your IP address with each request. The relay itself uses it only in hashed form for rate limiting.

The relay’s logs record outcomes and counts with the first 16 characters of the account identifier. They contain no email addresses, tokens or IP addresses, and the host’s per-request logging, which would record IP addresses, is turned off.

5. AI features

AI is optional, and you choose where it runs in Settings, which shows what is sent where before you turn anything on. You can also turn AI off for a single account, in which case nothing from that account is ever given to a model.

• Off. No AI processing happens.
• On this device. Apple’s on-device model (Apple Intelligence) processes your mail without it leaving the device.
• Apple Private Cloud Compute, where Tern offers it. Requests go to Apple’s Private Cloud Compute servers, which Apple designed so that your data isn’t stored or made accessible to Apple, under Apple’s privacy policy. I don’t receive them.
• Your own API key. Requests go directly from your device to the provider you picked (Anthropic, OpenAI, Google Gemini, or an OpenAI-compatible server you specify, such as Ollama, LM Studio or OpenRouter), using your key and your account with them. I never receive the requests, the responses or your key. That provider’s terms and privacy policy govern what it does with the data, including how long it keeps it and whether it may train on it, so check them before you choose one. In particular, Google’s terms let it use what’s sent with a free-tier Gemini API key (a project without billing) to improve its products, including human review, and some hosted OpenAI-compatible services, free models on routers among them, keep or train on prompts. Tern says so when you choose them; use a paid key or a provider that doesn’t retain or train on API data if you don’t want your mail used that way.

What’s sent to a model

Only what each feature needs: the text of the conversation you’re working with, with quoted history and signatures removed and formatting reduced to plain text; your instruction or question; and, for drafting, a few of your past emails to the same person so the draft sounds like you. Ask Your Inbox sends your question and the most relevant messages its search finds. Attachments and images are never sent.

Three features also work on mail you haven’t opened, in the background, and send it to the AI you chose when that AI isn’t on your device: Summaries summarizes new conversations in your Important split ahead of time, so the summary is ready when you open them; Smart sorting sends inbox conversations the built-in rules can’t place (and with Apple’s models it can fall back from your device to Private Cloud Compute when the on-device model isn’t available); and AI previews in the list, off unless you turn it on, sends each conversation the list shows. Tern names these in the disclosure you accept before AI is first used, and asks again before you turn one on that would send mail somewhere new. Keep sorting on this device keeps sorting and list previews on your device even when writing help uses your key. Each feature can be turned off in Settings, and AI can be turned off per account.

Neither I nor Tern use your Gmail data to train, develop or improve AI or machine-learning models.

6. Images, links and unsubscribing

Emails often load images from the sender’s servers, which can tell the sender when and where you opened a message. Tern blocks remote images by default. If you allow them for a sender or domain, your device contacts that sender’s servers directly, and they see your IP address as with any web request. Known tracking pixels and tracking parameters stay blocked even then.

Links open in your browser. When you use one-tap unsubscribe, your device sends the unsubscribe request the sender published in the email, directly to the sender.

7. Purchases

The trial and the purchase are handled by Apple through the App Store. The app checks your purchase on your device with Apple. I don’t receive your payment details or your Apple Account identity; Apple gives developers sales reports without them.

8. What I don’t do

• I don’t collect analytics or usage data, and the app contains no third-party analytics, advertising or tracking SDKs.
• I don’t sell, rent or share your data, and I don’t use it for advertising of any kind.
• I don’t read your email. I have no copy of it to read.
• Crash and performance reports reach me only through Apple, only if you’ve chosen to share analytics with app developers in your device settings, and Apple strips them of personal identifiers.

9. Google API Services: Limited Use

Tern’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Tern also follows the Google Workspace API User Data and Developer Policy.

In particular:

• Gmail data is used only to provide the user-facing features of Tern described in this policy, which you can see and control in the app.
• It’s transferred to a third party only when you turn on an AI provider that runs off your device, only to perform the feature you asked for, directly from your device to that provider; or when necessary for security or to comply with the law.
• It’s never used for advertising, sold, or transferred to data brokers or information resellers.
• It’s never used to determine creditworthiness or for lending, and never used to develop, improve or train generalized AI or machine-learning models.
• No person reads it. Your Gmail data stays on your devices and I don’t hold a copy. The only exception is content you choose to send me yourself, for example by forwarding a message to support, which I read only to help you.

10. Who else is involved

These companies take part in running Tern. Each handles data under its own terms and privacy policy:

• Google hosts your mail. Its Pub/Sub service tells the relay when your mailbox changes. Gmail also handles support email.
• Apple delivers push notifications, stores your iCloud data, runs on-device and Private Cloud Compute models, and sells the app.
• Cloudflare hosts the push relay and its database, and this website.
• The AI provider you choose, if you add your own key. That relationship is between you and the provider.

Cloudflare, Apple and Google operate worldwide, so the relay’s small amount of data may be processed in the United States and other countries.

11. How long data is kept

• On your devices: until you remove the account in Tern or delete the app.
• In your iCloud: a scheduled job is removed once it’s done or cancelled. You can delete everything Tern stores in iCloud from your iCloud settings.
• On the relay: as listed in section 4. Nothing there outlives your last registered device by more than an hour, except a pending timer, which is removed when it fires.
• Support email: as long as needed to help you, and deleted on request.

12. Deleting your data and revoking access

Remove an account from a device

In Tern, open Settings, then Accounts, choose the account and select Remove from This Device. Tern deletes that account’s mail, downloaded attachments, unsent offline drafts and scheduled jobs from the device, unregisters the device from the relay, stops Gmail notifications for it, and signs out of Google. Do this on each device to remove the relay’s records for the account entirely.

Delete everything on a device

Delete the app. Its mail cache and settings go with it. On iPhone and iPad, the system can keep Keychain items after an app is deleted, so remove your accounts first if you want the sign-in tokens gone too.

Revoke Tern’s access to your Google Account

Go to your Google Account’s third-party connections, choose Tern, and remove its access. Tern can no longer reach your mail on any device. Gmail stops sending change pings for the account within seven days, the most a mailbox watch can last.

Delete the relay’s records on request

Email zacherygentry@gmail.com from the address in question. Because the relay stores only a keyed hash, I compute that hash from your address and delete every record that matches, usually within a few days and at most 30.

iCloud and AI providers

To delete Tern’s data from iCloud, open iCloud storage in your device’s settings, choose Tern, and delete its data. To remove your AI key, delete it in Settings, then AI, and revoke it in your provider’s console. Data you sent to an AI provider is governed by that provider.

13. Security

• Connections to Google, the relay and AI providers use TLS. The one exception you can choose is an OpenAI-compatible server you enter with a plain http:// address, such as Ollama on another computer at home: Tern warns that this connection isn’t encrypted and never sends an API key over it.
• Credentials and API keys live in the system Keychain and are never written to logs.
• Emails are displayed with scripts, forms and embedded frames removed, under a strict content security policy, in a web view that keeps no cookies or storage.
• The relay accepts only callers that prove who they are with a token signed by Google (your devices, and Google’s Pub/Sub service), holds no content, and limits request rates.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete or export personal data held about you, to object to or restrict its processing, and to complain to a data-protection authority. Because your mail and settings are on your own devices, you already control almost all of it directly. For the relay’s records, write to zacherygentry@gmail.com; I may ask you to confirm the address so I can find the matching hash. I’ll answer within 30 days.

Where the GDPR applies, I process the relay’s data to provide the service you asked for (notifications and scheduled actions) and, for rate limiting, in my legitimate interest in keeping it secure. I don’t sell or share personal information as the California Consumer Privacy Act defines those terms.

15. Children, this website, and changes

Tern isn’t directed at children under 13, and I don’t knowingly collect personal information from them. If you believe a child’s data reached me, contact me and I’ll delete it.

This website is static. It sets no cookies and runs no analytics or third-party scripts. Cloudflare processes your IP address and basic request details to deliver pages and protect against abuse.

When this policy changes, I’ll update it here and change the effective date. If a change affects what happens to your data, I’ll also say so in the app’s release notes before it takes effect, and I’ll never use data already collected in a new way without your consent.

16. Contact

Privacy questions and requests: zacherygentry@gmail.com. Anything else: Tern support.