Trust

Privacy and security

What Ayoh does with your mail, what it blocks, and what happens when you remove things.

On this page · 6 sections

Your mail is yours

Your workspace's mail lives in one database that only your workspace can open. Each request and the live connection are addressed by your workspace's own id, so one workspace's mail is never reachable from another's.
The shared database that holds workspaces, domains and the list of addresses stores no message content.
Original messages and attachments are kept as files in a private bucket, under your workspace's own prefix.

HTML is cleaned before it is stored: scripts, styles, forms, frames, embedded objects and event handlers are removed, only a fixed list of tags and attributes survives, links may only be http, https, mailto or tel, and every link opens in a new tab without telling the site where you came from. The browser cleans it a second time and shows it in an isolated container, so a message's styles cannot touch the app and the app's cannot touch the message.
Remote images are replaced by a blank placeholder until you press Load images. Obvious tracking pixels are deleted, and images loaded through styles are blocked.
Attachments download as files. An HTML or SVG attachment is never displayed inside the app.
Messages larger than 25 MiB are refused at delivery, and mail to an address that does not exist is refused with a bounce rather than stored.

Sign-in codes are six digits, work once, expire in ten minutes and die after five wrong guesses. What is stored is a keyed hash of the code, never the code, and it can only be entered by the browser that asked for it. Asking for one tells nobody whether an account exists.
Passwords, on the accounts old enough to have one, are stored as salted PBKDF2 hashes (100,000 rounds), never in clear text. New accounts have none.
A passkey stores only its public half. Every sign-in is checked against the origin it was made for, so a passkey made here cannot be used on a look-alike site, and each attempt answers a fresh single-use challenge, so a captured one cannot be replayed. Unlocking the device is required, not optional.
A sign-in lasts 30 days on that browser; Sign out ends it immediately.
The Cloudflare API token is stored encrypted and only its label is ever shown. Remove in Settings deletes it.
Requests that change something are refused unless they come from the app itself, and the app is served with a strict content security policy.

The summarizer and the drafter see the last eight messages of one conversation, trimmed of quoted text and long bodies. The reply box's writer sees the open conversation and what its tools return from your mailbox.
Nothing is sent on your behalf. Drafts wait for you.
Ayoh Agent is the one exception, and only when you let it: with May send email for you on, it sends what you ask it to from one of your addresses, marked as written by an AI agent. It sees the conversation in Chat, the files you give it, whatever its tools return from your mailboxes and connected apps, and your instructions.
The web is reached through TinyFish on Ayoh's own account. Connected apps go through your workspace's own Composio key, which is stored encrypted and never shown again, not even to you. When the agent uses a connected app the request goes through Composio, which holds that app's sign-in; a search or a page read sends only what the agent is looking for, never your mail.

The app's own code, so it opens without waiting for the network.
Who is signed in, and to what: your name, the workspace's addresses and its settings, which the app already shows you. It lets the next opening start at once, and it is removed when you sign out and whenever the server says nobody is signed in.
Your display settings. They are also kept with your account, so every device you sign in on matches; the reading pane, sounds, haptics and column widths stay with the device.
With Keep your work on this device for instant opening on (Settings → Display; off by default, per device): Mail's folder list and the first page of each folder's list, Chat's list, your boards, and Notes' list and folders. Anyone who can open that browser can read them, which is why it is off until you choose it. Searches, conversations and a note's text are never kept. Each account's are kept apart, and all of it is removed when the setting goes off and when you sign out.

Delete a conversation for good: What is removed: The conversation, its messages, drafts, attachments, copilot history and the stored original files.; What stays: Nothing.
Remove a mailbox: What is removed: The address; mail to it bounces from then on.; What stays: Its stored mail and files, which become unreachable.
Disconnect a domain: What is removed: The domain from Ayoh. Every address on it, aliases included, must be removed first.; What stays: Everything in Cloudflare: Email Routing, the catch-all rule and the DNS records. Undo them in the Cloudflare dashboard if you want them gone.
Remove the Cloudflare token: What is removed: The stored token.; What stays: Mail keeps flowing; connecting domains and re-running setup need a new token.
Disconnect an app: What is removed: The app from the agent's reach, and its sign-in at Composio.; What stays: Nothing at the app itself; revoke Ayoh's access there if you want to.
Replace the MCP URL (New URL): What is removed: The old URL; other MCP clients using it stop reaching your apps.; What stays: The apps themselves, which the agent still uses.

Action	What is removed	What stays
Delete a conversation for good	The conversation, its messages, drafts, attachments, copilot history and the stored original files.	Nothing.
Remove a mailbox	The address; mail to it bounces from then on.	Its stored mail and files, which become unreachable.
Disconnect a domain	The domain from Ayoh. Every address on it, aliases included, must be removed first.	Everything in Cloudflare: Email Routing, the catch-all rule and the DNS records. Undo them in the Cloudflare dashboard if you want them gone.
Remove the Cloudflare token	The stored token.	Mail keeps flowing; connecting domains and re-running setup need a new token.
Disconnect an app	The app from the agent's reach, and its sign-in at Composio.	Nothing at the app itself; revoke Ayoh's access there if you want to.
Replace the MCP URL (New URL)	The old URL; other MCP clients using it stop reaching your apps.	The apps themselves, which the agent still uses.