Privacy Policy

Effective date: June 5, 2026 | Last updated: June 5, 2026

AwayZen ("we," "us," or "our") provides an out-of-office reply solution across email and messaging platforms. This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and what rights you have.

This policy applies to all users of the AwayZen application (IOS and Android, webapp), website, and related services (collectively, the "Service").

1. Data Controller

AwayZen is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and applicable U.S. privacy laws.

Contact: admin@awayzen.app

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

  • Email address - used for authentication, password recovery, and service notifications.

  • Password - stored only as a cryptographic hash; we never store or see your plaintext password.

  • Timezone and language preference - to schedule replies correctly and display the interface in your language.

  • Display settings - such as font size preference.

2.2 Connected Account Data

When you connect an email or messaging account (Gmail, Outlook, Slack, Telegram, Discord, Microsoft Teams, or a custom IMAP/SMTP provider), we collect:

  • OAuth tokens (access token, refresh token) or IMAP/SMTP credentials you provide. These are stored encrypted using Supabase Vault and are used solely to read new messages (just the fact a new message has been received is collected not their content) and send your auto-replies on your behalf.

  • Account metadata: your name, email address, and profile identifier as returned by the provider during the OAuth flow.

  • Platform-specific identifiers: Slack team ID and user ID, Telegram chat ID, or similar identifiers needed to route replies correctly.

2.3 User-Authored Content

  • Reply templates - the auto-reply text you write.

  • Schedule metadata - dates, times, and recurrence rules you configure.

  • Signature settings - optional footer text you add to outgoing replies.

  • Quick Away presets - saved shortcut configurations for rapid activation.

2.4 Operational Data

To prevent duplicate replies, enforce rate limits, and maintain an audit trail, we collect:

  • Reply log entries: sender identifier (email or user ID), thread or conversation ID, channel ID, timestamp, and account reference for each reply sent. We store only the identifiers, not the message content.

  • Activity log: records of actions you take within the Service (sign-in, account connection, schedule creation, security changes) with timestamps.

  • Scheduler run logs: timing and status of automated reply checks, used for diagnostics.

  • Notification email records: metadata about service emails sent to you (template name, status, timestamp), never the full body.

2.5 Security Data

  • Multi-factor authentication (MFA) enrollment data: encrypted TOTP secret, recovery code hashes, trusted device tokens.

  • Biometric credential identifiers: a device-specific credential ID used for WebAuthn or native biometric authentication. No biometric data (fingerprint, face scan) is transmitted to or stored on our servers.

  • Step-up authentication tokens: short-lived tokens issued after a security challenge, automatically expired.

  • Rate-limiting records: step-up attempt timestamps and MFA recovery attempt timestamps, used solely to enforce rate limits.

2.6 Data We Never Collect or Store

This is a core product principle. AwayZen never stores the content of messages you receive. Inbound message text, subjects, bodies, and attachments are read transiently in memory solely to determine whether an auto-reply should be sent, and are then immediately discarded. No inbound message content is persisted in our database, logs, analytics, or any third-party system.

3. How We Use Your Data

We use personal data exclusively to provide, maintain, and improve the Service.

Purpose (P) - Legal basis (GDPR) structure (L) is used for all items below:

  • P: Authenticate you and manage your account → L: Performance of contract

  • P: Connect to your email or messaging accounts and send auto-replies on your behalf → L: Performance of contract

  • P: Prevent duplicate and looping replies → L: Legitimate interest (service integrity)

  • P: Send you security alerts and service notifications by email → L: Legitimate interest (account security)

  • P: Maintain audit logs for your security review → L: Legitimate interest (security)

  • P: Diagnose and fix technical issues → L: Legitimate interest (service reliability)

  • P: Comply with legal obligations → L: Legal obligation

We do not use your data for advertising, profiling, automated decision-making, or sale to third parties.

4. Third-Party Services

We share data with third parties only as necessary to operate the Service.

Service (S) - Data shared (D) - Purpose (P) structure is used for all items below:

  • S: Supabase - D: Account data, encrypted credentials, logs - P: Infrastructure hosting and authentication

  • S: Google APIs (Gmail) - D: OAuth tokens, your outgoing reply text - P: Reading new messages and sending replies

  • S: Microsoft Graph (Outlook) - D: OAuth tokens, your outgoing reply text - P: Reading new messages and sending replies

  • S: Slack API - D: OAuth tokens, your outgoing reply text - P: Reading new messages and sending replies

  • S: Telegram Bot API - D: Bot token, your outgoing reply text - P: Sending replies

  • S: Discord API - D: Bot credentials, your outgoing reply text - P: Receiving events and sending replies

  • S: Microsoft Teams API - D: OAuth tokens, your outgoing reply text - P: Receiving events and sending replies

  • S: Resend (or alternative similar supplier) - D: Your email address, notification subject and body - P: Sending security alerts and service notifications

We do not share personal data with analytics providers, advertising networks, or data brokers.

All third-party services are selected for their compliance with applicable data protection regulations. Where data is transferred outside the European Economic Area (EEA), appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions where required.

5. Data Retention

The following retention periods are enforced automatically by a daily cleanup process.

Data type (D) - Retention period (R) structure is used for all items below:

  • D: Account data - R: Retained while your account is active; deleted upon account deletion

  • D: Connected account credentials - R: Retained while the connection is active; securely purged when you disconnect or delete your account

  • D: Reply log entries - R: 365 days from the reply date, then automatically purged

  • D: Scheduler run logs - R: 90 days, then automatically purged

  • D: Activity log - R: Retained for your ongoing security review and deleted when you delete your account

  • D: Notification email records - R: 180 days, then automatically purged

  • D: OAuth outcome logs - R: 180 days, then automatically purged

  • D: Step-up attempt and MFA recovery attempt records - R: 90 days, then automatically purged

  • D: Email OTP codes - R: 7 days, then automatically purged

  • D: Step-up tokens - R: 7 days, then automatically purged

  • D: MFA email recovery challenges - R: 30 days, then automatically purged

  • D: Soft-deleted items - R: Retained in your Trash until manually removed or until account deletion

  • D: Soft-deleted schedule-account links - R: 365 days, then automatically purged

  • D: MFA recovery codes - R: Retained until used or until you regenerate a new set

When you delete your account, we permanently remove all your personal data, including connected account credentials, templates, schedules, reply logs, and activity history (For safety reasons to avoid unwanted deletion AwayZen admins can restore data for 30 days after which a hard delete is realized). Data stored in provider systems, such as replies already delivered to recipients, is outside our control.

6. Data Security

We implement the following technical and organisational measures:

  • Encryption at rest: all database fields containing credentials are stored using Supabase Vault or equivalent encrypted secret storage.

  • Encryption in transit: all connections between your browser or app, our servers, and third-party APIs use TLS 1.2 or higher.

  • Row-Level Security (RLS): database access controls ensure you can only access your own data.

  • Multi-factor authentication: optional TOTP-based MFA with recovery codes, step-up authentication for sensitive actions, and biometric authentication via WebAuthn where supported.

  • Token rotation: OAuth tokens are periodically refreshed and rotated via scheduled backend processes.

  • Rate limiting: built-in loop protection and rate limiting prevent runaway auto-replies. Step-up authentication and MFA recovery are also rate-limited.

  • No plaintext credential storage: plaintext credential storage is not permitted.

  • Minimal logging: diagnostic logs contain only identifiers and decision outcomes, never message content or credentials.

  • Security notifications: email alerts are sent when MFA settings change, recovery codes are used, or connected accounts require re-authentication.

7. Your Rights

7.1 Under the GDPR (EU and EEA residents)

You have the right to access, rectify, erase, restrict, object to processing, request portability of, and withdraw consent regarding your personal data where applicable. You also have the right to lodge a complaint with your local data protection authority.

7.2 Under U.S. State Privacy Laws

If you are a resident of California, Virginia, Colorado, Connecticut, or another U.S. state with applicable privacy legislation, you may have rights to know, access, delete, and correct your personal information, and to opt out of the sale or sharing of personal information. We do not sell personal information and do not use sensitive personal information for advertising or profiling.

Categories of personal information collected may include identifiers (such as email address and account name), internet or network activity information (such as reply logs and activity logs), and professional information related to connected work accounts.

7.3 Exercising Your Rights

You can exercise many rights directly within the app, including reviewing data in settings, deleting templates and schedules, disconnecting accounts, updating preferences, or deleting your entire account.

For requests that cannot be fulfilled through the app, contact us at admin@awayzen.app. We will respond within the timeframes required by applicable law.

8. Cookies and Tracking

AwayZen app uses no advertising cookies, no tracking pixels, and no third-party analytics. Browser storage is limited to authentication session tokens, biometric credential identifiers where supported, and essential user preferences required for the Service to function.

9. Children's Privacy

AwayZen is not directed at children under the age of 16, or the applicable age of consent in your jurisdiction. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it promptly.

10. International Data Transfers

Our infrastructure is cloud-hosted. If you are located in the EEA and data is processed outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses, adequacy decisions, and additional technical safeguards such as encryption in transit and at rest.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The Last Updated date at the top of this policy will always reflect the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at admin@awayzen.app. We aim to respond to privacy-related inquiries within the timeframes required by applicable law