← Back to Kanyon

Privacy Policy

Last updated: April 2, 2026

Kanyon ("we", "us", "our") operates the Kanyon.email personal CRM application. This policy describes what data we collect, how we use it, and your rights.

1. Information We Collect

Account information: When you sign in, we receive your name, email address, and profile photo from your email provider (Google or Microsoft) via OAuth.

Email data: With your permission, we access recent emails from your connected accounts (up to 500 messages). We fetch metadata (sender, subject, date, preview snippet) and use it to organize your inbox and build your contact list. We do not store full email bodies.

Calendar data: With your permission, we read your Google Calendar or Outlook Calendar events to display them within Kanyon.

IMAP credentials: If you connect via IMAP instead of OAuth, we store your email credentials encrypted with AES-256-GCM.

Usage data: We store your preferences (theme, wallpaper, view settings), chat history with our AI assistant, contact notes, and pipeline board state.

2. How We Use Your Data

• Display and organize your emails, contacts, and calendar in a unified interface
• Power AI features (chat assistant, email drafting, contact summaries) by sending relevant context to our language model provider
• Track email opens when you send emails through Kanyon (via a tracking pixel)
• Manage your contact pipeline and outreach sprints
• Process payments and manage your subscription

3. Third-Party Services

We use the following services to operate Kanyon:

Service	Purpose	Data shared
Supabase	Database & authentication	Account info, email metadata, contacts, notes, preferences
OpenRouter	AI language model	Email context (subjects, previews, sender names) for chat & drafting
LiveKit	Voice agent	Audio streams during voice sessions
Twilio	Phone integration	Phone number, call metadata
Stripe	Payments	Email, subscription & payment info (handled by Stripe)
Algolia	Search	Email & contact metadata for search indexing

We do not sell your personal data to third parties.

4. Google API Disclosure

Kanyon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google user data to provide and improve the features you see in Kanyon
• We do not use Google user data for advertising
• We do not allow humans to read your data unless you give explicit consent, it is necessary for security purposes, or it is required by law
• We do not transfer Google user data to third parties except as necessary to provide the app's features (as listed above) or as required by law

5. Data Storage & Security

• OAuth tokens are encrypted with AES-256-GCM at rest
• All data is transmitted over HTTPS
• Database access is protected by Row-Level Security policies
• API endpoints are rate-limited (300 requests per 15 minutes)
• CSRF protection is enforced on all state-changing requests

6. Cookies & Local Storage

We use a single session cookie (kanyon_session) to keep you signed in for up to 7 days. We also use browser local storage to save your preferences, contact notes, and UI state. We do not use third-party tracking cookies.

7. Data Retention

• Sessions expire after 30 days of inactivity
• Email snapshots are replaced on each sync and are not permanently archived
• You can disconnect an account at any time, which removes stored tokens and cached data
• You can request full deletion of your data by contacting us

8. Your Rights

• Access your data through the Kanyon interface
• Disconnect any email account to revoke access and delete stored tokens
• Delete your data by contacting us at thereasoningcompany@gmail.com
• Revoke Google access anytime at Google Account Permissions
• Revoke Microsoft access anytime at Microsoft Account Permissions

9. Children's Privacy

Kanyon is not intended for users under 13 years of age. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date.

11. Contact Us

If you have questions about this privacy policy or your data, contact us at thereasoningcompany@gmail.com