The short version
tylloo reads your emails, figures out which ones need a reply, and drafts one for you. Nothing is ever sent without your approval. You can disconnect at any time and all your data is deleted.
What happens when you connect your inbox
You sign in with your Google account (Gmail or Google Workspace) or Microsoft account (Outlook or Microsoft 365) using OAuth. This gives tylloo read access to your inbox and permission to create and send drafts. Emails are only ever sent when you explicitly press the Send button. We store the connection token so tylloo can check for new mail. You can revoke access at any time from your Google account settings or Microsoft account settings.
How emails are processed
When a new email arrives, tylloo sends its content to Anthropic's Claude models via AWS Bedrock for classification. Claude decides whether the email needs a reply and, if so, generates a draft. All AI processing happens within the European Union via AWS Bedrock — your email content never leaves the EU.
The AI models are hosted by AWS under their EU data processing agreements. Anthropic does not receive your data directly and does not use API inputs to train their models. You can read more about how data is handled:
What we store
- Your email address and connection token
- Your preferences (working hours, tone, reply rules)
- For each processed email: a message ID, its category, classification, and the original message content so you can review it in the app
- For drafted emails: the generated reply alongside the original message
What we don't do
- We never send emails without your action — every draft requires you to press the Send button
- We don't use analytics, advertising, or tracking cookies
- We don't sell or share your data with anyone beyond what's described here
- We don't train AI models on your emails
How we protect your data
- End-to-end encryption: All email content stored in tylloo is end-to-end encrypted with a passphrase that only you know. The encryption and decryption happens entirely in your browser — your passphrase never leaves your device, and we have no way to read your stored content. Even if our servers were compromised, your email data would remain unreadable. During setup, you receive a one-time recovery key that lets you regain access if you ever forget your passphrase. Read more about our security model.
- Encryption in transit: All communication between your browser and our servers, and between our servers and third-party APIs (Google, Microsoft, Anthropic), uses TLS 1.2 or higher.
- Encryption at rest: All stored data, including OAuth tokens, email content, and user preferences, is encrypted at rest using AES-256 in our database.
- Access control: OAuth tokens are scoped to the minimum permissions required and are stored securely. Only authenticated users can access their own data. There is no cross-user data access.
- Token security: OAuth refresh tokens are stored encrypted and are only decrypted at the moment of use. Tokens can be revoked at any time from your Google or Microsoft account settings, or by deleting your tylloo account.
- Data minimisation: We only store the data necessary to provide the service.
- Infrastructure: Our servers are hosted in the European Union with providers that maintain SOC 2 and ISO 27001 certifications.
Deleting your data
You can delete your account at any time from the Settings page. When you do, everything is deleted: drafts, processing history, preferences, tokens, and any pending jobs. Nothing is retained. You can also revoke tylloo's access independently from your Google or Microsoft account settings.
Questions?
tylloo is built by Mercury Media Technology GmbH & Co. KG in Hamburg, Germany. If you have questions about how we handle your data, reach out at hello@mercurymediatechnology.com.