Proton — Privacy Policy

Last updated: 21 September 2026

Proton is a personal AI assistant run by an individual (the "operator") on a server he operates, at protonai.duckdns.org. It is not a commercial service and is not open for sign-up: accounts exist only for people the operator has invited. This policy explains what data Proton uses, how it is kept and who can see it.

Accounts and separation

Each account has its own chats, memory, to-do list, mailbox connection and calendar connection. An account's email and calendar are private to that account: no other account, including the operator's, can read them through Proton. The operator decides which features each account may use, but that does not give anyone access to another account's mail or calendar.

Information Proton accesses

• Your mailbox (only if you connect it): Proton signs in to your mailbox over the standard IMAP and SMTP protocols with the address and app password you enter. It reads messages to show and summarise them, and drafts email at your request. It sends an email only when you tap Send on a draft. Proton does not use a Google API for email.
• Google Calendar (only if you connect it): after you sign in with Google, Proton reads your primary calendar's events and free/busy times, and creates, changes or deletes events when you ask it to. An event that invites other people is only created after you approve it.
• Content you provide: chat messages, voice requests, notes, to-dos and things you ask Proton to remember.

How your data is used

Your data is used only to provide Proton's features to you — showing your inbox, drafting replies, managing your calendar, answering questions and remembering what you tell it. It is not sold, rented or shared for advertising, and is never used for profiling.

Where your data is stored and how it is protected

Proton's data is stored in a database on the operator's server. Mailbox app passwords and Google Calendar sign-in tokens are encrypted at rest, and are never shown back to anyone, written to logs or included in the activity log. The activity log records that an email or calendar action happened, but not its subject, addresses or event titles. Connections to mail servers use TLS.

Third-party processing

To deliver certain features, Proton sends the content needed for your request to these providers, acting on your behalf:

• Anthropic (Claude API): the messages, email and calendar content that a request involves are sent to generate the reply, summary or draft you asked for. Under Anthropic's commercial terms this content is not used to train AI models.
• Google: requests to Google Calendar, and Google sign-in, to provide the calendar features.
• Your own mail provider: Proton connects to the mail servers you enter to read and send your email.
• ElevenLabs (only if voice output is enabled): text is sent to synthesise speech.

These providers process the data under their own terms only to return the requested result; Proton does not authorise them to use it for any other purpose.

Google user data — Limited Use

Proton's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used only to provide the calendar features described above to the account that connected it. It is not transferred to others except as needed to provide those features (as described under Third-party processing), is not used for advertising, is not used to train AI models, and is not read by people except with your permission, for security reasons, or to comply with the law.

Your control, retention and deletion

• You can disconnect your mailbox or your Google Calendar at any time from Proton. Disconnecting deletes the stored app password or Google token straight away, and Proton asks Google to revoke the calendar sign-in. You can also revoke access yourself in your Google Account permissions, and change or delete your mailbox's app password with your mail provider.
• Proton does not keep a copy of your mailbox or your calendar: it reads them from your provider when you use it. Drafts stay until you send or discard them; attachments on a draft are deleted when it is sent or discarded.
• When the operator removes an account, its mailbox and calendar connections, drafts, pending invitations, chats, memories, notifications and phone subscriptions are deleted, and its Google sign-in is revoked. To-dos the account created go back to the operator's own to-do list. The activity log, which holds no email or calendar content, is kept.
• To have your data deleted, ask the operator at the address below.

Contact

Questions about this policy or your data: ebo.cece@gmail.com.