Privacy policy

What Karen reads

When you connect Gmail, Karen searches the last 12 months of your mailbox for money emails: receipts, invoices, bills, subscriptions, renewals, free trials, bank and card fee notices, orders and deliveries, and flight bookings and disruptions. She reads those messages to pull out the facts that matter. Google's consent screen asks for full Gmail access because that is the only way Google lets an app read message content; Karen uses it only as described here.

What Karen keeps

This is the complete list of what Karen stores about you:

• For each money email: the merchant, amounts and currency, dates (charged, renewing, due, promised), the billing cycle, a few labels she works out (for example “monthly subscription”, “late fee”), and the Gmail message and thread IDs that link back to it. For flights: the airline's region, the countries, the distance, the date, the delay in minutes, whether it was cancelled and how much notice you had, and the kind of cause (airline or not).
• Emails already checked: the Gmail IDs of the messages a scan looked at and whether each one was about money, so Karen never reads the same email twice.
• While a scan runs: for each email its searches find, the Gmail ID, the date and a keyed fingerprint of the sender's domain, so Karen can choose which ones to read (every one from the last 90 days, and before that the newest two from each sender). They're deleted when the scan ends.
• Fingerprints, not text: to match an order to a later price drop, or a flight to its booking, Karen keeps keyed one-way fingerprints of order and booking numbers and product names, made with a secret key only our server holds. They can't be turned back into the original.
• What she found: each finding (merchant, amount, why it's worth doing, in Karen's words) and what you did with it.
• When you open a finding: how Karen will handle it (email, the company's own page, or a call) and the company's contact address and help link she'll use, from her checked company list or from that company's own email to you.
• Requests: Karen's draft stays in your browser until you save it or send it. A saved draft you never send is deleted after 7 days. A request you send is kept: its text, the address it went to, when it went, the Gmail IDs of the sent message, and how it ended (the outcome of the company's reply and any amount it states, never the reply's text), plus the amount you confirm came back.
• A send log with no text: the merchant, the kind of request, the company's domain and the result.
• Your account: your Gmail address (so you're recognized when you come back) and the IDs of the Gmail connections Composio holds for you, so every one of them can be revoked.
• Sharing and invites: your invite code, who invited you (if a friend did), and the extra claims your shares and friends unlocked. Your Karen Audit is drawn when you open it, from your results only (Karen's totals, counts, and the names and amounts of the companies she found; amounts only if you leave them on), and isn't stored. Nothing from your emails' text is on it. Karen can't see whether you posted it, and never posts anything for you.
• If you text Karen: the number (or Apple ID email) you text from, the time zone its area code suggests, when you last texted, whether you said STOP, and what Karen is waiting for you to answer (for example “reply YES to send”). The texts themselves, both ways, are kept 30 days, then only their time and kind remain. To tie your number to your account Karen sends a one-time link or code (good for 30 minutes, stored only as a keyed fingerprint) and asks you to confirm the number's last 4 digits. If you ask her to cancel a subscription by text: the company, the subscription's name, how the cancel went and how long it took. A screenshot of a company's cancel page is sent to you as a picture and erased from our database within a day.
• Usage: funnel events (pages visited, buttons pressed, where you came from, such as an ad campaign name), a random visitor ID cookie, and what each scan cost. They never contain email content. To stop abuse, a keyed fingerprint of your IP address (a new one each day) is kept for up to two days.

Karen does not store your emails' text, subject lines or attachments. To write a request she re-reads that item's emails (at most three) in memory, and the draft is stored only if you save or send it.

What Karen sends

Nothing without your OK. Karen drafts each request; you read it, edit it, and press send. It goes out once, from your own Gmail. After that she checks your inbox for the company's reply to that request and records only the outcome (for example “they say they refunded $14.95”); it counts as money back only once you confirm it arrived. She never deletes anything from your mailbox.

If you text Karen, she answers your texts, texts you what a scan found, and tells you when a company answers. Texts carry only a company's name, amounts, dates and links to letkaren.com, never your emails' text. She sends at most 3 texts a day you didn't ask for, and none between 9pm and 9am your time. Replying to a text never sends anything by itself: a request goes to a company, or a subscription is cancelled, only after you reply YES to that exact request. Reply STOP any time and she stops texting you; HELP for help.

Who processes your data for us

• Composio (our Gmail connection partner, verified by Google) holds the Gmail connection, fetches the messages Karen reads and sends the requests you approve. Composio keeps logs of each of these requests, including Gmail's response (so the text of the emails Karen read), for up to a year, then deletes them. See composio.dev/privacy.
• Google (the Gemini API, as a paid service) provides the AI model that reads each email to extract the facts, re-reads an item's emails to write a request, and reads a company's reply to tell how it ended. Under Google's terms for paid services this data is not used to improve Google's products or to train its models, other than the ones Google uses to detect abuse. Google keeps it for 55 days to detect and prevent abuse.
• Microsoft Azure OpenAI (in the US) provides the AI model that judges the findings (the merchant, amounts, dates and rule behind each one), reads an email or a reply whenever Gemini can't, and answers texts to Karen that aren't a simple reply (it sees your text and your own findings' companies, amounts and dates, never your emails). Under Microsoft's terms this data is not used to train its models; Microsoft may keep it for up to 30 days to monitor abuse.
• Anthropic provides the AI model that judges the findings whenever Azure can't, and reads an email or a reply whenever Gemini and Azure can't. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
• Photon (Something Great Inc.) carries the iMessages between you and Karen's number, so it handles the number or Apple ID you text from and what the texts say. See photon.codes/privacy-policy.
• Vercel hosts the website (its request logs hold IP addresses and the pages requested, never email content) and Neon hosts the database.

We don't sell your data, we don't use it for advertising, and we don't share it with anyone else unless the law requires it.

Google API Services: Limited Use

Karen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• Gmail data is used only to find money you're owed or wasting and to help you get it back, features you can see and control.
• It is never used for advertising, never sold, and never used to train general-purpose AI models.
• It is transferred only to the processors above, to provide the service, and as required by law.
• No person reads your email, unless you ask us to (for example in a support request), for security investigations, or where the law requires.

Your controls

• Disconnect Gmail any time from Your data.
• “Delete my data” on the same page deletes your account and everything above, and revokes every Gmail connection, immediately. If Google doesn't confirm a revoke right away, Karen keeps only that connection's ID and retries daily until it does, and tells you so.
• Texts: reply STOP to Karen's number, or use “Stop texts” or “Forget this phone” on Your data.
• You can also remove access at myaccount.google.com/permissions.
• Questions or requests: hello@letkaren.com.

Retention and security

We keep your data until you delete it, except: saved drafts you never send (7 days), IP fingerprints (up to 2 days), the text of texts (30 days), cancel screenshots (a day), one-time text codes (30 minutes), and texts from a number never tied to an account (30 days after its last text; a number that said STOP is remembered, until you delete your data, so Karen doesn't text it again). After deletion only anonymous counts with no personal data remain (and, until Google confirms a revoke, that connection's ID). Connections are encrypted in transit, sessions use signed cookies that stop working when you sign out or disconnect, our logs record error codes, never email content or addresses, and access to production data is limited to the people who run the service.

Children and changes

Karen is for adults 18 and over. If we change this policy we'll update the date above and, for material changes, tell you by email before they apply.