Repository navigation
Privacy and Data
This page says what Preen sends, who gets it, and what stays on your computer. The full policy is in PRIVACY.md. If the two ever differ, trust PRIVACY.md. You can also read the policy inside Preen, under Settings, Provider & cost, Privacy policy.
- Preen sends your mail data to the provider you pick, OpenRouter or TypeSafe, with your own API key.
- Preen sends no mail until you agree in the settings.
- Preen sends nothing to its developer. It has no usage statistics, no crash reports and no server of its own.
- Debug mode only keeps a log on your computer. You can save it as a file or clear it.
- Preen has no ads.
Preen sends data to one place, the provider you choose. It sends nothing to its developer. The add-on can connect to only these two addresses:
Your API key goes only to that provider, to sign each request.
flowchart LR
A["1. Message"] --> B["2. Local checks"]
B --> C["3. Ask Jev<br/>SENT to your provider"]
C --> D["4. Decide"]
D --> E["5. Apply or preview"]
subgraph PC["Stays on your computer"]
A
B
D
E
end
classDef sent fill:#fde8c8,stroke:#c77700,color:#1a1a1a
class C sent
Only step 3 leaves your computer. Local checks look at headers, your address book and your sender rules. What they find goes with the request, as facts. A sender rule only removes the real-person question. Every message Preen sorts is still sent, including mail from your contacts and from senders you have a rule for.
You choose a depth for each account. See Settings.
flowchart TD
M["Your message"] --> S{"Which depth?"}
S -->|"Surface"| SU["SENT:<br/>sender, subject, date,<br/>number of recipients,<br/>attachment names,<br/>header hints"]
S -->|"Deep"| DE["SENT: all of the Surface items<br/>PLUS about 2,000 characters of the text<br/>(quoted replies and signatures trimmed)"]
SU --> X["Message text is NEVER sent"]
DE --> Y["Text is sent"]
With both depths, Preen also sends:
- the kind of mailbox and your note about it, if you set them
- your categories
- your personal context, if you wrote one
- the languages you read, if you wrote any
- facts from the local checks: header hints, whether the sender is in your address book, and whether a DMARC check failed (DMARC is a check that the sender's address is not forged)
Your account name and address are never sent.
Preen never decrypts mail. It skips encrypted messages, messages that are too large, and messages over your daily limit. With Deep depth it also skips messages that have no readable text.
Preen looks for card, bank and ID numbers. It does this on your computer. It looks for:
- payment card numbers
- bank account numbers (IBAN)
- US Social Security numbers
- passport numbers
- driver's licence numbers
- dates of birth
When it finds one, it puts <PII_Block> in its place, in the subject and the text. It does this before it sends. This is on at the start. You can turn it off in Junk & sensitive info.
Preen finds a number by its shape. It cannot find facts with no number, like an illness.
The first time, Preen asks you to agree. It first shows a short summary of what is sent. Everything that is sent, and why opens the full list, with a short reason for each item. You also choose Surface or Deep there. Your OK is for one provider. If you change provider, Preen asks again. You can take your OK back at any time. Use Withdraw consent. Then Preen sends nothing. While it waits, the activity page says "Waiting for your OK to send mail to" and the provider's name.
All of this is in your Thunderbird profile only:
| What | Where it lives | How long |
|---|---|---|
| Settings, including your API key | the add-on's local storage | until you remove them or uninstall Preen |
| Activity log (sender, subject, tags, scores, token counts, never the message text) | the add-on's local database | the number of days you set (90 by default) |
| Tag corrections | the add-on's local database | 2 years. Clear history does not remove them |
| A list of messages you corrected (an id for each, no text), so Preen leaves them alone | the add-on's local storage | the newest 20,000 are kept |
| Monthly totals shown in Settings, Statistics (counts of messages, tokens, cost, tags and errors, with no sender, subject or message text) | the add-on's local storage | until you remove them or uninstall Preen |
| Debug log (only if you turn it on; holds full message text) | the add-on's local database | until you clear it |
Your API key is kept without encryption. It is sent only to your provider. When you save your settings to a file, the key is left out. If you tick Include my API key, the file holds the key in plain text.
You can clear the activity log, the corrections and the debug log in Preen's settings and on the activity page.
Debug mode is off unless you turn it on. When it is on, Preen keeps each request and each answer on your computer, word for word, including the message text. You can save the log as a file or clear it in Settings, Debug. Nothing from it is sent anywhere. A banner shows while debug mode is on.
Your provider's own terms decide that. If your provider offers zero data retention (ZDR), where it deletes your requests after answering, we recommend turning it on. You set it up with your provider. Preen cannot check whether it is on.
- Make a key just for Preen.
- Give it a credit limit at your provider. If it leaks, it can only spend that much.
- Do not share exported settings files that hold the key.
- Read your messages and their tags, and set them.
- Read your accounts and address books, to recognise your contacts.
- Store its settings.
- Add a right-click menu.
- Run on a schedule.
- Send mail to an outside service. Thunderbird Add-ons asks add-ons that do this to say so.
Moving mail to Junk needs one more permission. Preen asks for it only when you turn that on. Preen can reach just two web addresses, one for OpenRouter and one for TypeSafe.
When you remove Preen, Thunderbird drops its settings, your API key, the activity log and your corrections. Data you already sent to your provider follows that provider's rules.