# CLAWD Mail Privacy Policy Effective date: October 11, 2026. How CLAWD Mail handles accounts, mail, AI processing, wallets, live media, and privacy requests. ## Operator and scope CLAWD operates CLAWD Mail at https://clawdmail.app. This policy covers that service and its supported web and mobile interfaces. Contact clawdbot@mail.grokbot.com for support, privacy requests, or an account access concern. If you use an independently operated installation, its administrator is responsible for that installation and should identify its own practices and contact details. Email recipients, connected wallets, hosting platforms, model providers, and external websites also have their own policies. Links: [Support and privacy requests](mailto:clawdbot@mail.grokbot.com). ## Information we handle The information processed depends on the account and features you use. The CLAWD Mail landing page, documentation, and policy pages are public; mail, agent, and live room features require sign-in and first-login onboarding. - Account information: name, login email, account identifier, password authentication records, session information, membership role and access status, invitations, optional welcome-email status, last sign-in time, and first-login onboarding records. Onboarding records include the account-specific public welcome code, submitted X post URL and identifier, and verification completion time. The login email is separate from an inbox address. Normal registration does not verify ownership of the login email address. - Mail and files: inbox ownership and address, sender and recipient addresses, subjects, message bodies and labels, original email data, attachments, drafts, private uploaded files and their names/types/sizes, and sending or delivery receipts. - AI and automation: instructions, selected drafts or conversation context, inbox agent settings, supported source images, generated responses, tool names, and job or error state. The context differs between requested writing help and an enabled automatic email responder. - Wallet and chain information: public wallet addresses you connect, research, or display; public blockchain observations; and optional launch-wallet identifiers, preparation requests, approvals, signatures, and transaction receipts. A connected external wallet and the Privy launch wallet are separate features. - Live rooms: title, visibility, owner and participant identifiers, display names, chosen wallet association, room state, uploaded avatars or backgrounds, and the chat or media you choose to share. A host-enabled AI companion receives the selected microphone and camera or shared screen. - Technical information: request and network information processed by hosting and service providers, security/session events, operational errors, and rate-limit information. Device/browser permissions are requested for supported media capture, rather than permission to collect contacts or precise location. ## How we use information We use this information to establish and protect accounts, verify first-login welcome posts, enforce access status and ownership, receive and send mail, keep drafts and files, provide requested assistance and configured automation, operate live rooms, show research and transaction states, and address service or abuse reports. When configured, signup can trigger a one-time service welcome email. When an approved inbox’s CLAWD agent is enabled, eligible incoming mail can trigger automatic processing and a reply to the original author. New approved inboxes use the configured responder default, which is enabled in the supplied application. Review or pause it in Account & files before using an inbox for information you do not want processed automatically. The application does not implement an advertising data marketplace or a sale of inbox content. This describes the application’s functions, rather than a guarantee about every independent provider’s business practices. ## Providers and recipients CLAWD Mail uses server-side services to deliver its features. Only the providers configured for the selected deployment and feature receive the relevant requests. First-login onboarding opens X’s composer for a public welcome post with your account-specific code. You choose to publish it on X and submit its public link for verification. The service reads that public post through X’s publishing service; it does not store X credentials or publish a post automatically. The post associates your X profile with joining CLAWD Mail and may be visible or copied outside the app. Private mail and files are not included. AI and other providers process supplied content under their own current contracts and data controls. OpenAI [API data controls](https://developers.openai.com/api/docs/guides/your-data) disable model training by default but allow ordinary abuse-monitoring retention. This deployment does not claim Zero Data Retention. This policy does not promise provider-wide deletion, zero retention, or exclusion from training across all providers. Review the relevant provider terms before submitting sensitive or third-party confidential content. - Cloudflare handles receiving email and private R2 object storage. Resend handles outgoing email when configured, including account codes, message contents, attachments, recipients, and delivery events; Cloudflare can handle outgoing email in other installations. Original received email, parsed mail, attachments, drafts, and stored AI outputs can be retained in private R2. Neon/PostgreSQL holds account, ownership, approval, job, transaction, delivery, and recipient suppression metadata. The hosting provider operates the website and backend. - Ask Claude sends your instructions and selected owned draft or conversation text through OpenRouter to the configured model provider. It returns writing assistance for review and does not itself send the message. Incoming attachments are not included by this writing workflow. - Interactive /agents runs send task text, role details, bounded conversation history, selected owned-inbox context, and supported images to xAI, or through OpenRouter to the configured fallback model when xAI is unavailable. The application retains task text, role inputs, results, citations, and run status privately in R2. Its available tools read the selected owned inbox; this workspace does not enable web search or fetch supplied document URLs. - Private /agents sessions send the microphone, role/task details, and selected owned-inbox context through the private Vision-Agents runtime to xAI for realtime voice, or through OpenRouter for bounded speech-turn fallback. Camera or screen scene analysis uses xAI with the configured OpenRouter model as a fallback. Supported research tools send only the requested public Solana identifiers to configured research services. Raw live media is not saved in task history. Active transcripts and observations are bounded in memory; a stopped-session transcript remains available to its account for up to five minutes. You can export it or explicitly use it in a saved task. - Optional browser dictation may send speech to the browser’s speech service. Its availability and processing depend on the browser. You can paste a transcript instead of using dictation. - An enabled automatic CLAWD responder sends relevant mail context and supported source images to xAI, or through OpenRouter to the configured fallback model when xAI is unavailable. Requested image generation uses xAI, with the configured OpenRouter image model as a fallback. Bounded research tools can send the requested query or public identifiers to their configured providers. Generated reply text and images may then be delivered by email under the inbox’s responder settings. - Stream text agents use xAI for explicit approved-user questions, with the configured OpenRouter model as a fallback when xAI is unavailable. Host-enabled voice sends the selected microphone through the private inference runtime to xAI, or through OpenRouter for bounded speech-turn fallback. Camera or screen scene analysis uses xAI with the configured OpenRouter model as a fallback. Cloudflare RealtimeKit carries shared room communications. - Supermemory handles dated public Hookedpad knowledge snapshots and knowledge search queries in a separate public-knowledge namespace. Private inboxes and private account files are not automatically indexed into that namespace. - Configured Solana RPC and research services receive public addresses, mint identifiers, or transaction identifiers needed for research. Optional token launches can publish submitted artwork/descriptions or metadata to Pump.fun/IPFS. Privy and chain providers process the separately reviewed launch and creator-fee wallet workflows. - Recipients and their email providers receive sent messages. Room participants receive shared chat and media. In a legacy installation without the individual-account policy, the optional AgentMail adapter is available through the authenticated /connect page after a valid CLAWD mailbox session is established. AgentMail handles its own connection and mailbox data under its own terms; its key alone does not authorize CLAWD product pages. ## Shared content, media, and wallets Authenticated live viewers can see discoverable rooms; unlisted rooms can be reached by signed-in viewers with the link. Visibility is not a promise that viewers will keep a broadcast confidential. Shared avatars and backgrounds are media-sharing assets delivered through separate storage and participant URLs; they are not private account files. Your browser or device controls microphone, camera, and screen permission. Choose what to publish and whether to start the AI companion. Stop the companion, disable media, leave or end the room, or revoke device permissions to stop future sharing. The bridge does not persist raw audio or image frames; active sessions hold bounded temporary transcripts and observations. Other participants and processors may retain or copy communications. Published token metadata, blockchain transactions, and copies already received by recipients, viewers, or providers may remain available after you disconnect, remove an asset, or stop using the service. ## Mobile wallet connection and Seeker relay Seeker Connect and Mobile Wallet Adapter let you authorize a wallet to share a public Solana account. The connection panel requests connection and disconnection, not transaction signing or a transfer. It does not ask for a recovery phrase or private wallet key. Wallet authorization is held in memory for the current page session. Seeker Connect carries encrypted wallet-session traffic through Solana Mobile’s Nostr relay. Before it starts, the connection checkbox asks you to accept the relay terms and Solana Mobile Website Terms of Use and acknowledge its Website Privacy Policy. This choice is held in memory rather than saved as permanent consent. The relay can process connection metadata, including IP address. Use Installed Wallet uses the local Mobile Wallet Adapter path without this Seeker relay. CLAWD Mail is independent of Solana Mobile. Device, wallet, relay, and dApp Store services have their own operators and policies. Connecting through Seeker does not authenticate the CLAWD Mail account, approve the Privy launch-wallet workflow, or make Solana Mobile responsible for private mail. The current application does not send private inboxes, account files, or device-earnings reports to Solana Mobile. Disconnect to stop the current connection and manage site permissions in your wallet. Disconnecting cannot erase public-chain activity or information already received by a service. Declining the optional relay permits use of service features that do not require it. Links: [Solana Mobile device and dApp Store privacy policy](https://solanamobile.com/privacy-policy-web), [Solana Mobile Website Privacy Policy](https://solanamobile.com/privacy-policy-homepage-web), [Solana Mobile Website Terms of Use](https://solanamobile.com/tos-homepage-web). ## Storage, cookies, and security Mail and private account files use server-controlled private object storage and authenticated ownership checks. Individual accounts require sign-in, current terms acceptance, completed first-login onboarding, and active access for private features. New registrations are approved automatically; explicitly blocked accounts remain restricted. This service is not end-to-end encrypted: the service and selected processors need to process content to deliver mail and enabled features. Account sessions use HttpOnly, SameSite=Lax cookies with an eight-hour lifetime that may refresh during use and secure cookies on the hosted production service. Signing out revokes the account session; changing a password revokes other account sessions. Session expiry or revocation does not delete stored mail or files. The browser can retain the selected mail provider and inbox, account-scoped sound preferences, and a bounded recent-message identifier list used to avoid duplicate notifications. These local preferences and notification identifiers are separate from mail content. External wallet and optional mobile relay state have their own connection controls. Access checks, restricted provider credentials, bounded requests, and transport protection reduce unauthorized access. They cannot guarantee complete security. Secure your device and wallet, use a unique password, and do not place private keys or recovery phrases in mail, chat, or support requests. Hosting and processors may handle information in countries other than your own. ## Retention and deletion Account records, mail, raw received email, attachments, drafts, private files, AI results, room metadata, and operational receipts can remain stored while needed to provide the service or meet security, dispute, or applicable legal obligations. The application has no fixed automatic expiry schedule covering all of these records. Moving a message to Trash changes its labels; it does not permanently erase the message, original email, or attachments. Deleting a draft removes that stored draft. Deleting a private account file removes its object and metadata through the file controls. Uploaded streaming images have a separate owner deletion control. Ending a room stops the broadcast workflow rather than deleting its historical room metadata. Signed-in users can request account and associated-data deletion in Account & files, including while approval is pending or access is blocked. A request is queued for operator review; submitting it does not immediately erase data. The operator cleanup workflow inventories account-owned data, stops automation and live sessions, revokes access, and removes the account identity and service-controlled mail, attachments, drafts, files, AI artifacts, and streaming assets. Cleanup that encounters active work or provider shutdown uncertainty remains incomplete and can be retried. The installation owner must arrange a verified ownership handoff before deleting the owner account. A minimal hashed inbox-deletion marker is retained to prevent reassignment and late incoming-mail writes. Comprehensive access, correction, or export requests require operator review. Deletion can require separate handling of provider records, backups, pending jobs, financial receipts, and information subject to lawful retention. We cannot recall email delivered to another person or erase public-chain/IPFS records and independently made copies. We store your current terms acceptance, adult affirmation, private content reports, review decisions, and sender or host blocks with account records. Reports may include the content identifiers, sender or host, your category and explanation, and moderation actions, and are visible to the installation owner for review. Reporting does not post the report publicly. Blocks control future access and automatic processing without recalling mail already delivered or copies made elsewhere. ## Your choices and requests Use Account & files to manage files and your password, review or pause inbox agents, and inspect available account controls. Review a draft before sending, choose the media you share, and use the dedicated review before a wallet action. Account sign-in and onboarding, wallet connection, and approval of a transaction are separate decisions. For support or a privacy request, email clawdbot@mail.grokbot.com. Identify the service and the account or inbox concerned, describe the requested action, and provide only the information needed to identify the request. We may verify account control before disclosing or changing private data. A bot reply or community conversation does not itself confirm that a privacy request has been completed. Where applicable law provides access, correction, deletion, portability, restriction, objection, or complaint rights, you may exercise those rights through this contact. Available rights, response deadlines, and lawful exceptions depend on the jurisdiction and processing involved. Nothing in this policy limits a right protected by mandatory law. Links: [Support and privacy requests](mailto:clawdbot@mail.grokbot.com). ## Children and policy changes The CLAWD Mail Android dApp and its wallet and live features are intended for adults aged 18 or older. Do not use those features or submit information through them if you are under 18. The service is not offered as a child-directed service. Contact us if you believe a child’s information was submitted without the permissions or safeguards required by applicable law. We will identify material changes to this policy through the service and update its effective date. A revised notice does not itself authorize a new payment, wallet transaction, media capture, or connected-tool action. Read the Service page and Terms of Service for the associated features and responsibilities. Related pages: [Documentation](https://clawdmail.app/docs), [Terms](https://clawdmail.app/terms), [Service](https://clawdmail.app/service).