Privacy policy

The data controller is Ing. Lubomír Jiřišta, a self-employed sole trader (OSVČ) in the Czech Republic, business ID (IČO) 88628647, registered address Peřimov 3, 512 04 Peřimov. I build and run Letos alone, with no employees.

For anything privacy-related, write to [email protected]. I have not appointed a data protection officer.

This policy covers the Letos app (macOS, Windows, Linux, iOS), the sync server (the “relay”) and the letos.app website.

Letos connects directly to your mail and calendar, over IMAP/SMTP or through Google (Gmail, Google Calendar, contacts). Downloaded mail, calendar, tasks, goals and the output of the local AI are stored in a database on your device.

Mail passwords and Google access tokens are kept in your device's system keychain. They never reach our server in readable form: if you use sync, they travel to your other devices only encrypted on your device, so the server cannot read them. The exception is the web version (not publicly available yet), where, after explicit consent, you can choose to store a mail password or API key on our server.

During the invite-only (beta) phase we do not guarantee that data on your device or on the server will not be lost. We recommend backups. The originals of your e-mails remain with your mail provider until you delete or move them in the app.

The app has no telemetry: it sends us no usage statistics, device fingerprints or crash reports. Errors are written to a local log only. If you choose to send us a log, for example by e-mail to support, we use it only to fix your problem.

Deleting the app (and its data in the application folder) deletes everything that exists only on your side.

Some connections go from your device straight to other companies. We cannot see them, and those companies see only what each connection needs, mainly your IP address (with external AI, also the content you choose to send):

• Your mail and calendar provider (e.g. Google, Seznam.cz): all your mail and calendar data, under that provider's own policy.
• Server settings when you add an account: the app first asks your provider (with your address), then the Mozilla Thunderbird database (only the domain is sent, e.g. “seznam.cz”).
• The local AI model is downloaded from Hugging Face, only when you ask for it.
• Spell-check dictionaries are downloaded from jsDelivr.
• External AI (only if you turn it on): Anthropic, OpenAI or your own endpoint, or the Claude CLI / Codex CLI you have installed. Only content you confirm in the consent dialog is sent (e.g. the text of e-mails you have processed, tasks, goals, notes), and the API key stays in your device's keychain. The provider's terms apply.

If you connect a Google account, the app gets access only with your consent, through Google's standard OAuth. Your device downloads and shows your mail, calendar and contacts from Google directly, and optionally processes them with the AI running locally on your device; we do not upload the content of your Google mail or calendar to our server.

If you use sync between devices, your tasks (including those created from an e-mail or event), thread state, rules, settings and the sign-in credentials of your Google account, including the refresh token, travel through our sync server. All of it is encrypted on your device before it leaves, so the server has no way to read it.

We do not pass Google data to anyone else and we do not sell it. The one exception you switch on yourself: if you choose an external AI service in the AI settings (Anthropic, OpenAI, a custom endpoint, Claude CLI or Codex CLI) or connect an agent, and confirm the first send in the dialog, the selected content (e.g. message or event text) goes from your device directly to that provider, not through our server (see External AI). This never happens without your consent, and you can withdraw it any time by turning external AI off. Processing there is governed by the provider's own terms. We do not use Google data for advertising or to train models.

Letos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access by disconnecting the account in the app or in your Google account settings.

Letos can work with AI in three ways. By default it uses a model on your device and sends nothing. On top of that you can choose an external provider yourself: Claude (Anthropic) or OpenAI with your own API key, a custom OpenAI-compatible endpoint (for example Ollama at your home), or the Claude CLI or Codex CLI tools installed and signed in on your computer. Letos has no AI provider of its own and does not pay for AI on your behalf; the key or subscription is yours, with the provider.

Consent. No content is sent to an external provider until you explicitly agree to the sending the first time you use it. Consent is per provider; for a custom endpoint it covers only the address you approved, and we ask again if the address changes. This is enforced in the core of the app, not just on screen, so without consent nothing is sent. You can withdraw consent at any time in Settings → Privacy. If what is sent grows, we ask again. Your AI decisions (except the CLI tools, which are tied to one device) sync across your devices.

What is sent. Only the content for the AI feature you run: the text of an e-mail (body, subject, sender and date), the text of tasks, goals and notes, a draft you are writing, and optionally a writing-style profile (when rebuilt manually it is based on up to 20 of your sent e-mails). With your own API key, the key itself is also sent to the provider, because that is how you authenticate.

Where it goes. From your device straight to the provider, not through our server. The API key is kept only in your device's system keychain and is not synced. The exception is the web version of the app: it runs on our server, so the key is stored there only after you agree, and the AI request passes through the server on its way to the provider. The server does not write the content of requests or keys to application logs. The reverse proxy on our server writes no access logs at all for app.letos.app and sync.letos.app, so neither request content nor request headers are stored there. Traffic also passes through Cloudflare, which processes request metadata (see "Who else processes data").

What the provider does with it. Once sent, the content is governed by the terms and policies of the provider you chose, which acts as an independent controller or processor under its own terms. We have no influence over how long it keeps the content or whether it uses it to improve its models, and we promise nothing on its behalf. Read its terms before you agree. If you send other people's mail, you are responsible for being allowed to.

Likewise, an agent you connect yourself through MCP receives the data it asks for, and its provider may process it under its own terms.

On desktop the app works without registration. You only need an account for sync between devices and for paid plans. The relay then stores:

Mail, calendar, task and goal content is encrypted on your device before it leaves. The server cannot read it, so it cannot show it to anyone, even if it wanted to. This includes the state of e-mail threads: the relay only knows that an encrypted block arrived.

You can sign in with a password, a passkey or with Apple. With Apple we receive only an account identifier and the e-mail Apple passes to us (which may be relayed by Apple); we use them nowhere else and pass them nowhere. When you delete your account we delete this link too, so your Apple ID is no longer connected to our account.

The consequence: if you lose both your password and your recovery code, we cannot restore the data on the server. The data on your devices stays.

When you sign in to your account in a browser, the relay sets one technical cookie for 10 minutes to protect the form (CSRF). It remembers nothing else.

When you join the waitlist we store your e-mail, the platform you want and your language, plus when you signed up, when you confirmed, and the confirmation link (on the server only in a form from which the link cannot be recovered, and readable only until you confirm, so we can resend the same link). If the link you came from carried a short campaign or channel code (for example `?c=blog`), we store it with the entry and delete it together with the entry; it holds no personal data and we use no cookies for it. We do not store your IP address or browser.

Sign-up is double opt-in: we send one confirmation mail with a link valid for 7 days. Without confirmation we send nothing else. After you confirm you get one e-mail when your invite is ready. No newsletter.

The legal basis is your consent, which you can withdraw at any time. Every waitlist e-mail has a link that removes you with one click, no login. You can also write to [email protected].

The waitlist form is protected by ALTCHA: your browser solves a short computation (usually a few seconds) before the sign-up is sent. It uses no cookies, collects nothing about you and involves no third party. The script is part of our website and the puzzle is issued by our server.

For each solved puzzle the server briefly remembers its signature so it cannot be used twice. A puzzle is valid for 5 minutes and the signature is deleted by the next daily clean-up after it expires.

The website uses no analytics and no cookies, and loads no scripts, fonts or images from third parties. If we ever decide to measure visits, we will describe it here first.

We do not use advertising pixels yet. If we ever add them, we will first describe them here and ask for your consent before they load.

The website and the relay sit behind Cloudflare, which protects them from attacks and delivers the pages. In doing so Cloudflare processes technical connection data, mainly your IP address. It also adds a small script to the pages that hides e-mail addresses from bots.

System e-mails (address verification, waitlist, invite) are sent from [email protected] through Seznam.cz Email Profi. The support mailbox [email protected] runs there too, so your messages to support are stored there.

Outgoing e-mails wait in a queue on our server (address, subject, text). The text is deleted right after sending, sent rows (address and subject) after 7 days, and mails that never went out after 30 days.

Paid plans are sold by our payment partner Paddle.com Market Limited as the merchant of record: it is the seller, takes the payment, issues the receipt and handles tax. You enter your card details and billing address directly with them and we never see them. For that data the partner is a separate controller under its own policy.

From the partner we receive only what we need to turn your plan on: that it is paid, which plan and until when, and the e-mail we use to match it to your account.

We do not sell the data on our server or pass it on for marketing. These processors help us:

External AI (Anthropic, OpenAI, a custom endpoint) is not our processor: it is a connection from your device that you turn on yourself.

News and tips by e-mail go out through listmonk, website traffic is measured by Umami, and the timing of the e-mails is driven by Activepieces. All of it runs on our own server, on our own PostgreSQL database. They are our own tools, not other companies, so they add no new recipient and need no data processing agreement. We send no campaign until tracking is off in listmonk, and we start the website measurement only after a lawyer approves this text.

The SMTP provider (Amazon SES) is a processor: it sends the e-mail itself, so it sees the recipient and the text. It needs a data processing agreement for that. We have it configured for the eu-north-1 region (Stockholm), inside the EU; for any transfer outside the EU we rely on the EU standard contractual clauses and the EU–US framework.

The payment partner (Paddle.com Market Limited) is a separate controller, not our processor (see Payments).

Transfers to the USA via Cloudflare rely on the EU–US Data Privacy Framework or, where needed, the EU standard contractual clauses.

We disclose data to authorities only when the law requires it. We cannot disclose the content of your data because we cannot read it.

• Contract (Art. 6(1)(b) GDPR): account, sync, plan, support.
• Consent (Art. 6(1)(a)): the waitlist and e-mail news and offers. The news consent is OFF by default; you turn it on yourself with the switch in Settings → Account and can withdraw it at any time with the same switch or the link in an e-mail. It also covers one message about Letos Plus when you reach a free plan limit (at most once every 30 days).
• Legitimate interest (Art. 6(1)(f)): protecting the server and accounts (failed sign-in records, ALTCHA, Cloudflare, rate limiting).
• Legal obligation (Art. 6(1)(c)): accounting and tax records, where we keep any rather than the payment partner.

Closing your account: write to [email protected] from your account address. We delete the account and all its data on the server within 30 days and confirm it to you. We delete the account and its data (devices, encrypted blocks, attachments including files, keys, sign-in tokens, invites, queued e-mails and the waitlist row) with a single command, not by hand in the database. You can also delete the account yourself in the app (Settings → Account → Delete account) after entering your password and, if enabled, an authenticator code; deletion is immediate. Data that lives only on your device (mail, calendar, tasks) stays on the device. Deleted data can remain in encrypted server backups for up to about 6 months until the backup is overwritten.

During the beta, data on the server may be damaged or lost because of a bug or a service change. The server is not a backup of your data.

When a paid plan ends, your mail, calendar and tasks are not deleted: devices and mailboxes over the free plan's limit are simply switched off. The one exception: synchronized attachments over 100 MiB (the free plan's limit) are marked for deletion, oldest first, when the paid plan ends and are deleted after 14 days (30 days for an account that only had Plus through the beta).

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent (the waitlist) at any time.

Write to [email protected]. We reply within one month. To avoid handing data to a stranger, we may ask you to confirm from your account address.

Most of your data is with you in the app, so you can export or delete it yourself at any time.

You can lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7) or with the supervisory authority where you live.

Sync content is encrypted by your device and the server has no key. Passwords are never sent to the server in readable form. Device access tokens and invite codes are stored only as hashes that cannot be reversed. The server is protected by rate limiting, two-factor authentication and encrypted connections.

If a breach ever happens that could put you at risk, we will tell you without undue delay.

Letos is not meant for children under 15 and we do not knowingly collect their data.

The web version of the app (app.letos.app) is not publicly available yet. It will work differently from the app on your device: data is processed on our server, not on your side. Before we open it, we will describe exactly how in this policy.

When what the app or the server does with data changes, this text changes too. We announce significant changes in advance by e-mail (if you have an account) and here on the website. The version with the effective date at the top applies.