Privacy Policy

Lil’ reads your Gmail and Google Calendar metadata to identify which people in your network may need attention today and which three people to bring back into view each week. Today, Ask Lil’, relationship briefs, weekly email, on-demand picks, and occasional follow-up reminders use the same evidence and the same metadata boundary.

From Gmail: We request the gmail.metadata scope: message headers only. We read the From, To, Cc, and Date headers to identify the people you correspond with and store a minimal record per message (sender address, recipient addresses, thread ID, and message date) to power the weekly re-computation of your contact graph. We also read the Subjectheader when you connect Gmail, going back up to six months and continuing from then on. Subject lines help Lil’ spot conversations that may connect to a goal you set. You can turn this off in Settings without disconnecting Gmail. We do not read or store snippets, message bodies, or attachments.

From Google Calendar: We request calendar.events.readonly. Our request to Google uses a fields mask that returns only attendee addresses, the display names Google attaches to them, and event start dates and times. We do not read event titles, descriptions, locations, attachments, or conferencing details.

From LinkedIn (optional): If you upload a LinkedIn ZIP archive or Connections.csv file, Lil’ processes it in request memory and does not store the raw upload. Lil’ matches by exact profile URL, exact email, or a unique name-and-company combination. For matched relationships, it keeps company, title, profile URL, and connection date. Rows without a conservative match never become standalone contacts. Lil’ never scrapes LinkedIn directly.

From you: Your sign-in email, optional relationship preferences, an active 30-day goal and optional offer, and the pick actions and results you choose to record. Relationship notes are saved only when you add or edit them.

From your first visit: The site that sent you to Lil’ and the page you landed on, along with any campaign tag in the link you clicked. Saved when you create an account, deleted when your account is deleted.

From the Lil’ iPhone app: Lil’ generates a random installation identifier and sends it when creating or refreshing your Lil’ mobile session. Lil’ stores a one-way hash of that identifier with your account’s mobile session records to keep sessions from different app installations separate. The identifier remains in iOS Keychain after sign-out. It is used only for app functionality and session security, never for analytics, advertising, or tracking. Server-side mobile session records are deleted with your Lil’ account.

Email bodies, calendar descriptions, browsing activity on other sites, or a saved copy of your LinkedIn archive.

Primary use: generate zero to three Today cards when a useful timing signal exists, answer five bounded relationship questions, build relationship briefs, and generate your weekly digest with three relationship picks. When you have an active goal and enough trusted context, up to three of those picks may connect to the goal you chose.

Other uses, all in service of running the product: sending the magic-link sign-in email, the welcome email after you connect Google, the deletion-confirmation email, and the per-pick feedback and unsubscribe links inside each digest.

We do not sell data, use it for advertising, or share contact lists with other users. Lil’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Lil’ relies on third-party service providers to operate, covering hosting and database, email delivery, payment processing, error monitoring, and analytics. Each receives only the minimum data it needs to do its job. To write the short note that explains each pick, a third-party AI provider receives the contact’s name, company, title, and your ICP text, never your email or calendar content. Subject lines and subject-derived goal clues are not sent to that provider. None of these providers receive your message bodies, because Lil’ never reads them.

Database records, including your account, contacts, goals, matched professional context, relationship notes, daily refresh state and cards, digests, picks, results, and events, are kept while your account is active and deleted within 7 days of a deletion request through an automated daily purge job. Old Today cards leave the active view when their local day ends but remain part of the account record until deletion.

Message header records (sender/recipient addresses, thread ID, and message date) are automatically pruned after 400 days. Subject lines follow the same ceiling and are cleared sooner when you turn the setting off.

Raw LinkedIn ZIP and CSV uploads are processed in request memory and are not stored. Matched professional context follows the account retention period above. Invalid, unmatched, ambiguous, and duplicate rows are discarded during processing.

When you delete your account, that same purge unsubscribes you from our email list. A few records are kept only as long as the law or basic safety requires: payment records (if you were a paying customer) for tax and accounting, suppression records for any address that bounced or reported spam so we never email it again, and a short log noting that the deletion happened. None of these contain your contacts, your picks, or anything Lil’ read from your inbox.

Subject-line setting, block list, goal context, digest controls, and account deletion are in Settings. Turning subject lines off does not disconnect Gmail or Calendar. Email security@lil-app.com for privacy questions.

All data is transmitted over TLS. Google OAuth access and refresh tokens are encrypted at the application layer using AES-256-GCM before they are written to our database, so plaintext tokens are never persisted; our managed database additionally provides storage-level encryption at rest. Database access is restricted by row-level security; only your account can read your data. No one at KRT LLC reads your Gmail or Calendar data; access is automated, and we would only access your data manually to investigate abuse or to comply with the law. Server-side secrets (database credentials, OAuth client secrets, third-party API keys, and signing secrets) live only in server environment variables and are never bundled into client code. Two keys that are intentionally public (an analytics key and a database access key) appear in the client bundle by design; both are scoped so they cannot read or write your data.

security@lil-app.com | KRT LLC