Skip to content
Keyring

Privacy policy

Effective [DATE]. Covers the Keyring connector at connect.velltechgroup.com and this website, keyring.velltechgroup.com.

The short version

  • Keyring lets Claude search, read, draft and send email in the Gmail and Outlook accounts you connect.
  • It reads your email only when Claude asks for it in your conversation, and doesn't keep a copy.
  • It stores your connected email addresses and encrypted sign-in tokens, and nothing else about you.
  • It doesn't sell your data, show ads, or use your data to train AI models. Nobody reads your email.
  • You can remove one account or delete everything at any time by asking Claude. Accounts unused for 12 months are removed automatically.

Who runs Keyring

Keyring is published by VellTech Group Limited, based in Kenya (“we”, “us”). We are responsible for the personal data described here. Contact us at support@velltechgroup.com.

Keyring is an independent service. It is not made by, or affiliated with, Anthropic, Google or Microsoft.

What we ask Google for

When you connect a Gmail or Google Workspace account, Google asks you to grant these permissions. Keyring needs all four, and uses each one only as described.

gmail.readonly Read your email
To search your mailbox and read email threads when Claude asks during your conversation. When Claude writes a reply, also to read the original message's subject, sender and message ID so the reply lands in the same thread.
gmail.compose Create drafts and send email
To save new emails and replies as drafts in your Drafts folder, to send a draft, and to send an email, only as part of a request from your Claude conversation. We don't use it to change or delete your existing email.
openid Sign you in
To sign you in with Google.
email See your email address
To learn which address you signed in with, so we can label the account and recognise you when you reconnect.

Keyring doesn't ask for, and can't use, any other Google data: not your contacts, calendar, files or profile photo.

What we ask Microsoft for

When you connect an Outlook.com, Hotmail, Live or Microsoft 365 account, Microsoft asks you to grant these Microsoft Graph permissions:

Mail.ReadWrite Read and write your email
To search your mailbox, read email threads, and create drafts and replies. We don't use it to move, change or delete your existing email.
Mail.Send Send email as you
To send a draft or a new email, only as part of a request from your Claude conversation.
User.Read Read your basic profile
To learn your account's email address. We don't store your name or other profile details.
offline_access Keep access
So you don't have to sign in again every hour. It lets us renew access until you disconnect.
openid Sign you in
To sign you in with Microsoft.
email See your email address
Part of the standard Microsoft sign-in.
profile See your basic profile
Part of the standard Microsoft sign-in. We don't store it.

What happens to your email

Your email stays in your Gmail or Outlook mailbox. Keyring fetches it on request and doesn't store it:

  • When you ask Claude something, Claude calls a Keyring tool, such as a search. Keyring fetches what that tool needs from Google or Microsoft, passes it to Claude as the answer to that request, and then discards it. Nothing from your mailbox is written to our storage.
  • Searches return the sender, recipients, subject, date, a short preview and whether the email is unread, for up to 50 emails per account.
  • Reading a thread returns the full text of each message, shortened to 8,000 characters per message. Formatting is removed. Keyring doesn't open attachments.
  • Drafts and sent emails are created in your own mailbox, where you can see and delete them. Keyring doesn't keep a copy.

Email goes from Keyring only to your own Claude conversation, to do what you asked. Once it's there, Anthropic handles it under your agreement with Anthropic and your Claude settings, like anything else in your chats. On Claude Free, Pro and Max plans, Anthropic may use conversations to improve Claude if Help improve Claude is on in your privacy settings; turn it off if you don't want your email used that way. Anthropic doesn't train on Team or Enterprise conversations by default. See Anthropic's privacy policy.

What we store, where, and for how long

The Keyring connector runs on Cloudflare Workers and keeps its data in Cloudflare Workers KV, a storage service that Cloudflare may replicate to data centres in several countries. We store:

Until you remove the account, or 12 months after it was last used

  • Your connected accounts: each email address, whether it's Gmail or Outlook, the date you added it, the date Claude last used it, and whether it needs you to sign in again. These are linked to a random Keyring user ID, which is what ties your accounts together.
  • Sign-in tokens for each account from Google or Microsoft, which let Keyring reach your mailbox, plus when they expire and which permissions you granted. These are encrypted with AES-GCM using a 256-bit key held as a Cloudflare secret, separately from the data.
  • An address-to-user lookup for each connected address, so that signing in with any of your accounts brings back the others.

If Claude hasn't used a connected account for 12 months, Keyring disconnects it automatically: it asks Google to revoke access (for Gmail), and deletes the account's tokens, lookup and usage date. If that leaves you with no accounts, it also deletes the rest of your data and revokes Claude's access to Keyring. This check runs once a day. You can remove anything sooner yourself (see below). Revoking access at Google or Microsoft makes the tokens useless straight away.

For up to 30 days

  • Claude's access to Keyring: when you connect the connector, we record a grant for your Claude client. It holds your Keyring user ID, the email address you first signed in with (as a label), and when it was created. Claude's access tokens last one hour and are stored only as one-way hashes. The grant expires 30 days after you connect, after which Claude asks you to connect again, and is then deleted automatically.
  • Claude's client registration: the name and return address Claude registers with us. It contains nothing about you and is deleted about 90 days after it was last used.

For 10 minutes or less

  • Sign-in state: while you're signing in, we keep a random state value, which account type you picked, a one-time security code (PKCE) and your Keyring user ID. It's deleted when sign-in finishes, or after 10 minutes. A cookie in your browser ties the sign-in to that browser for the same 10 minutes. The connector uses no other cookies, and no analytics or tracking.

Cloudflare, as the connector's hosting provider, processes standard request information such as IP addresses to deliver and protect the service. Keyring itself doesn't record your IP address. If something goes wrong during sign-in, the error message may be written to Cloudflare's logs for troubleshooting; it never includes email content.

This website

This website, keyring.velltechgroup.com, is a set of static pages. It has no sign-in and no forms, sets no cookies, and uses no analytics or tracking. It is hosted by Vercel, which processes standard request information such as IP addresses to deliver and protect the site. We don't use that information to identify you.

Who we share data with

We share data only as needed to run Keyring, with:

  • Anthropic, through your own Claude session: the results of the requests Claude makes go back to your conversation.
  • Google and Microsoft, to sign you in and to read, draft and send email in your accounts.
  • Cloudflare, which hosts the connector and stores the data described above.
  • Vercel, which hosts this website.

We don't sell or rent your data, share it with advertisers or data brokers, or use it for advertising. We'd only disclose the data we hold if the law required it, and we don't hold your email.

Google API Services User Data Policy

Keyring's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, for data from Gmail (and we hold Outlook data to the same standard):

  • We use it only to provide the features you see: searching, reading, drafting and sending email in Claude.
  • We transfer it only to provide those features (to your Claude session), to comply with the law, or as part of a merger or sale of Keyring, and then only with your consent.
  • Nobody at Keyring reads your email. We don't store it, so there is nothing for us to read.
  • We don't use it for advertising, including personalised or retargeted ads.
  • We don't sell it, and we don't use it to decide creditworthiness or for lending.
  • We never use it, or transfer it, to create, train or improve any AI or machine-learning model. It goes only to your own Claude conversation, to do what you asked (see What happens to your email).

How we protect your data

  • All connections use HTTPS.
  • Google and Microsoft sign-in tokens are encrypted at rest with AES-GCM. The key is a Cloudflare secret that isn't stored with the data.
  • Claude's tokens for Keyring are stored only as hashes, and only work for the connector's address, https://connect.velltechgroup.com/mcp.
  • Sign-ins use PKCE and are tied to the browser that started them, so a stolen sign-in link can't be finished somewhere else.
  • Links for adding an account are signed and expire after 30 minutes.
  • Each person's accounts are kept separate: one Keyring user can't reach another's accounts.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you and the relevant authorities as the law requires.

Removing an account or deleting your data

Remove one account

Tell Claude “Remove my [address] account”. Keyring deletes that account's sign-in tokens and lookup, and removes it from your list. For Gmail, it also asks Google to revoke Keyring's access.

Delete everything

Tell Claude “Delete all my Keyring data”. Keyring asks Claude to check with you first. Then Keyring:

  • asks Google to revoke Keyring's access to every connected Gmail account,
  • deletes your account list, every saved sign-in token, your address lookups, usage dates and any unfinished sign-in,
  • revokes Claude's access to Keyring, so Claude is signed out of the connector.

This happens straight away and can't be undone. Your mailboxes, including drafts and sent email, are not touched. Removing the connector in Claude's settings alone doesn't delete this data, so ask Claude first.

Revoke access from Google or Microsoft

You can also cut off Keyring from your account's side at any time:

Microsoft doesn't offer apps a way to revoke a single sign-in, so for Outlook accounts Keyring deletes the tokens on its side; use the links above to remove the app from your Microsoft account as well.

If you can't use Claude, email support@velltechgroup.com from the address you want removed, and we'll delete your data within 30 days.

Your rights

We handle personal data lawfully, for the purpose you connected Keyring for, and keep no more than we need. We process it to provide the service you asked for and with the consent you give on Google's and Microsoft's sign-in screens, which you can withdraw at any time.

Wherever you live, you can ask us to:

  • tell you what data we hold about you and give you a copy,
  • correct it, or delete it,
  • restrict or object to how we use it,
  • give you your data in a portable format.

If you're in the European Union or European Economic Area, the GDPR gives you these rights, and you can complain to your local data protection authority. If you're in Kenya, the Data Protection Act, 2019 gives you these rights, and you can complain to the Office of the Data Protection Commissioner.

Because our storage may be replicated outside your country, your data may be processed in other countries. Cloudflare, Vercel, Google and Microsoft protect such transfers with their own safeguards, such as standard contractual clauses.

To use any of these rights, email support@velltechgroup.com. We'll reply within 30 days.

Children

Keyring is not for anyone under 18. We don't knowingly collect data from children. If you think a child has connected an account, email support@velltechgroup.com and we'll delete it.

Changes to this policy

If we change this policy, we'll post the new version here and update the effective date at the top. If a change affects how we use data from your Google or Microsoft account, we'll ask for your consent before it applies to you.

Contact

VellTech Group Limited, Kenya. Email support@velltechgroup.com.