Privacy Policy

Last updated: August 12, 2026

Todway (“Todway”, “we”, “us”, or “our”) provides a premium AI desktop productivity application for Windows and macOS. This Privacy Policy explains what information we collect, how we use it, with whom we share, transfer, or disclose Google user data, and the choices you have. It is written for users and for Google OAuth verification.

Information We Collect

Depending on how you use Todway, we may process:

Connected account details — name, email address, and profile information from a Google account you connect in the Todway desktop app (and any display name you set locally in the app).
Subscription & licensing — local plan status, redeem codes, and licensing metadata needed to manage Free / Pro access on your device.
Support messages — content you send to support@todway.com when you contact us.
Local app preferences — settings stored on your device (for example language, theme, and optional API keys you choose to save).

Todway’s desktop application does not include a separate analytics, advertising, or crash-reporting pipeline that uploads Google user data to Todway-operated servers.

Google User Data We Access

Todway’s Google integration uses Google OAuth so you can connect your Google account securely from the Todway desktop application. When you choose to connect, Todway requests only the OAuth permissions needed for the features described below. Depending on the permissions you grant, Todway may access:

Basic Google account identity — your Google account email address, display name, and profile photo (via OpenID / email / profile) so Todway can identify the connected account in the app.
Gmail data — message metadata and content needed to sync and display your mailbox (such as sender, recipients, subject, date, labels, body text, and attachment metadata or content when you open an attachment), and permissions necessary to send mail or change labels when you take those actions in Todway (for example archive, trash, mark read/unread, or send a reply you confirm).
Google Calendar data — calendar event information needed to list, create, update, and delete events you manage in Todway (such as title, description, time, location, and attendees where present).

Todway does not request permanent-delete-level Gmail access (for example the full mail.google.com scope). You can revoke Todway’s access at any time in your Google Account permissions, and you can disconnect Google from within Todway.

How We Use Google User Data

We use Google user data solely to provide and operate user-facing Todway features that you enable, including:

Syncing and displaying Gmail messages in Todway’s inbox and related mail views.
Helping you prioritize and understand mail (for example summaries, triage signals, package and bill detection cues, and Startup Brief context derived from mail you already synced).
Generating suggested reply drafts for you to review before any send.
Performing mail actions you initiate (such as send, archive, trash, or read-state changes) through Google’s APIs.
Syncing and managing Google Calendar events you view or edit in Todway.
Showing which Google account is connected (email, name, avatar) in Todway’s account screens.

Todway’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data Sharing

This section answers Google’s requirement to state with whom Todway shares, transfers, or discloses Google user data.

Todway does not sell Google user data. Todway does not use Google user data for advertising, ad targeting, or marketing analytics. Todway does not use Google user data to train public foundation models.

Gmail and Google Calendar content used by the Todway desktop app is stored and processed primarily on your device (local encrypted credential vault and account-scoped local caches). Todway does not operate a Todway cloud mailbox that receives your Gmail or Calendar content for storage on Todway servers.

Who receives Google user data

Based on how Todway is implemented today, Google user data is shared, transferred, or disclosed only with the parties listed below.

Google LLC
What: OAuth tokens and Google API requests/responses for account identity, Gmail, and Google Calendar.
Why: Required to authenticate you and to read or update Gmail/Calendar data for features you use.
When: Whenever you connect Google or use Gmail/Calendar features that call Google’s APIs.
Storage by that party: Governed by Google’s own terms and policies for API access.
Local Ollama runtime on your computer (not a cloud transfer)
What: Relevant Gmail or Calendar text needed for on-device analysis (for example subject/body snippets for triage, reply suggestions, or event analysis).
Why: To provide mail/calendar intelligence features inside Todway.
When: Only when those features run and a local Ollama service is available on localhost on your device. If Ollama is unavailable, Todway falls back to on-device heuristics and does not upload that Gmail/Calendar content to a Todway-operated cloud AI service.
Storage by that party: Processing occurs on your device; Todway does not send that content to Ollama’s public cloud as part of the built-in Gmail/Calendar analysis path.
OpenAI (optional; only if you add your own API key)
What: Content you submit through optional assistant features that you enable. In the current desktop app, that can include Google Calendar event titles already synced to the device when optional OpenAI-powered suggestions are generated, and the text of commands you type when optional OpenAI command routing is enabled. Todway’s built-in Gmail sync, Gmail triage, Gmail reply-draft, and Calendar AI analysis pipelines do not send Gmail message bodies or full Calendar event payloads to OpenAI.
Why: Only to provide the optional OpenAI-powered suggestion or command-routing feature you configured.
When: Only if you voluntarily save an OpenAI API key in Todway settings and use those optional features. This is not required for Gmail sync or Calendar sync.
Storage by that party: Governed by OpenAI’s terms under your own API credentials.
Todway support (email)
What: Only Google-related information you voluntarily include when you email support@todway.com.
Why: To respond to your support or privacy request.
When: Only if you contact us and choose to include that information.
Legal authorities
What / why / when: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and security of Todway, our users, or the public.

Parties that do not receive Google user data from Todway

Weather providers (for example ipapi.co and Open-Meteo used for optional weather context) do not receive Gmail content, Calendar content, Google OAuth tokens, or Google account identity from Todway.
Voice model download hosts (for example GitHub or Hugging Face, used only to download optional voice binaries/models you install) do not receive Google user data.
Website hosting / CDN providers that serve the Todway marketing site (for example Cloudflare-powered hosting for todway.ai) do not receive your Gmail or Google Calendar mailbox data from the Todway desktop application as part of normal app operation.
Todway does not share Google user data with advertising networks or data brokers.

AI Processing

Todway uses AI and heuristic analysis to help triage email, summarize threads, suggest replies, analyze calendar events, and detect packages and bills. For Google-connected mail and calendar features, that processing is designed to occur on your device (local heuristics and, when available, a local Ollama runtime). Optional OpenAI features are separate, require your own API key, and are described in the Google User Data Sharing section above. We do not use your Gmail or Calendar content to train public foundation models. You remain responsible for reviewing AI suggestions before sending mail or taking action.

Data Storage, Retention, and Deletion

Wherever practical, Todway keeps Google-connected working data on your device, including:

OAuth access and refresh credentials in a local encrypted vault on your device (using platform secure storage when available).
Account-scoped local caches used for mail, calendar, AI analysis results, and related feature data so the app can function while you use it.

Todway retains that on-device Google user data while your Google account remains connected and as needed to provide the features you use. When you disconnect or sign out of Google in Todway, Todway removes the locally stored OAuth credentials for that connection and clears associated authenticated session state and account-scoped caches on the device so the app returns to an unauthenticated state. You can also revoke Todway’s access in your Google Account permissions, which prevents further API access with those credentials.

Uninstalling Todway or deleting the application’s local data on your device removes local caches and vault files stored there. If you contact us at support@todway.com about deletion of support correspondence or other information you sent to us, we will handle the request in line with applicable law and our operational needs.

Transmission between the Todway desktop app and Google uses encryption in transit (HTTPS / TLS).

Cookies

The Todway marketing website may use essential cookies or local storage for theme preference, locale, and basic site functionality. We do not use advertising cookies on the marketing site. The desktop application stores preferences locally on your device.

User Rights

Depending on your location, you may have rights to:

Access the personal data we hold about you
Correct inaccurate information
Request deletion of your account data
Export a copy of your data where applicable
Object to or restrict certain processing
Withdraw consent (including Google OAuth) at any time

To exercise these rights, email support@todway.com.

Security

We apply industry-standard safeguards including encrypted transport and careful handling of OAuth tokens on your device. No method of transmission or storage is 100% secure; if we learn of a breach affecting personal data you sent to us (for example support email), we will notify you and regulators as required by law.

Contact

Privacy questions and data requests: support@todway.com

Website: todway.ai