Your data
deserves care.

Who operates zenvodo

zenvodo is a SaaS product owned, operated and billed by Qubus Labs, LLC. Qubus Labs, LLC is responsible for operating the service and handling customer support, billing and privacy requests. Use our Contact form for help with your account, a refund request or a question about your data.

Contact and support

Our Contact form sends the details you enter directly through the Qubeforms' service to deliver and manage your inquiry or support request. Cloudflare Turnstile provides the form’s spam protection. Do not include passwords, API keys, verification codes, payment card details or private email content. We use your reply address to respond to your request.

Your account and workspace

zenvodo stores your account name, email, timezone, password hash, tasks, workspace preferences, saved filters and personal email rules. Rule names, conditions and actions may contain sender addresses or subject keywords. Task records may include the source subject, sender, thread identifiers, extracted action and deadline. Live task content is kept on the server and is not placed in browser local storage. The public demo uses fictional tasks and may save those demo changes on your device.

Optional email tips and offers

If you choose to sign up through a website invitation, your email address and optional first name go to our mailing list service for zenvodo tips and offers from Qubus Labs, LLC. The consent checkbox starts unchecked. Depending on the list’s confirmation settings, you may need to confirm your address by email. Use the unsubscribe link in those emails whenever you want to stop receiving them.

Automatic invitations stay off until you allow Marketing in Cookie preferences. This website-storage choice is separate from the unchecked mailing-list signup consent. These invitations use a random browsing-session cookie, a page counter, display flags and a returning-visitor flag on your device to avoid repeated popups and show relevant invitations. Your name and email are never saved in browser storage. If this storage is unavailable, automatic invitations stay hidden.

We keep aggregate invitation views and accepted signup counts. Short-lived hashes help prevent duplicate requests and abuse; expired records are cleared during routine website processing. Country targeting, when configured, uses a coarse country code supplied by our hosting provider. We do not send your IP address or browsing history to our mailing list service through this signup form.

This mailing-list choice is separate from customer-account communication settings and paid plans. Account downloads and account deletion do not include or remove this independent prospect-list record. To request access or removal, use the unsubscribe link or contact support.

Account security settings

Account settings lets you change your name, default timezone and password, or sign out every device. Changing your sign-in email requires your current password and separate confirmation codes from both the current and new addresses. Until confirmation, your existing address stays active. We store the pending destination encrypted, codes as hashes, expiry times and limited request/attempt counters. Codes expire after thirty minutes. Successful email or password changes invalidate existing sign-in sessions and reset links. Pending requests can be canceled from Account settings. Mail providers handle confirmation emails under their own retention terms.

Your mindful moments

Optional mindful invitations use your chosen timezone and workdays. We privately store those settings and up to three taken, skipped or snoozed invitations for the latest local day you interacted. A later day’s interaction replaces that small record. These settings are shared across your spaces. We do not collect journals, moods or health scores, or record on-demand activity choices and timer sessions. No mindfulness data is sent to email analysis providers or saved in live browser storage. The public demo keeps fictional choices on your device. Read the guide.

Customer announcements

We use an in-house, private emailing list software and our email delivery provider to contact verified, active customers about maintenance and service issues. You can turn these updates off in your email choices. Discounts, offers and product announcements require your separate opt-in, which starts off. We record your choices and promotional consent time. Changing your sign-in address requires a new promotional choice.

Only your account name, sign-in email and plan are shared for these announcements. Mailbox contents, tasks, connected addresses and credentials are excluded. Our mailing list software handles confirmation, unsubscribe, bounce and complaint states; list changes may take several minutes to sync. Essential account, security and billing emails are handled separately.

After an address change or account deletion, encrypted delivery-address metadata is retained only as needed to retry removal from our customer announcement lists. The cleanup record is erased after confirmed removal. Delivered emails, mailing list campaign history, email-provider suppression records and backups follow those systems’ retention policies.

Email access is a choice

New Gmail and Google Workspace connections are temporarily unavailable. Existing connections use Google’s authorization. We currently request read-only mail access. Google does not share your password with zenvodo, and we do not request permission to send, archive, modify or delete Gmail. iCloud connects over certificate-verified TLS using a dedicated Apple app-specific password, encrypted in the database. Never supply your main Apple Account password. Apple app-specific passwords are not scoped to read-only access; zenvodo enforces read-only IMAP commands and does not send, move, delete or mark messages read. Revoke the app-specific password in Apple settings to remove access.

Microsoft 365 and personal Outlook.com mail use a separate Microsoft OAuth authorization with read-only mail permission. Microsoft does not share your password with zenvodo. Renewable tokens and per-folder checkpoints are encrypted on the server. zenvodo reads Inbox and Sent without sending, moving, deleting or marking messages read, and without downloading attachments. Initial checks may inspect older message IDs and dates to establish complete checkpoints; message bodies outside your selected lookback are not requested. Analysis still requires your separate consent. Local disconnect deletes the stored credentials; revoke the app’s grant separately in your Microsoft account or organization settings.

Microsoft Calendar has its own OAuth grant and tokens, independent of mail. Its permission allows broader calendar read/write access than zenvodo uses: zenvodo creates a dedicated calendar and changes only its own events after your review. Tokens and pending operations are encrypted. Task titles and reviewed times are shared by default, with task context only if selected. No attendees or invitations are added. Local disconnection or account deletion leaves Microsoft calendar events intact. Revoke Microsoft Calendar’s app grant separately when no longer needed.

Generic IMAP connects to your chosen public mail server over verified TLS on port 993. Its hostname, username and password are encrypted together. We check public DNS addresses for each connection and connect to an approved numeric address while verifying the original hostname. Internal addresses and unverified certificates are refused. Adding or replacing credentials requires your current zenvodo password. Passwords are never redisplayed or sent to the analysis processor. Your provider credential may grant broader access than zenvodo uses; prefer a separately revocable app-specific password. Revoke or change it with your mail host after disconnecting. A short-lived security counter records only your account ID, attempt count and time window; inactive counters are pruned after thirty days and removed with account deletion.

Connecting alone does not import messages. Email syncing requires separate opt-in after you review the analysis processor and its data policy. You choose an initial 1, 7 or 30 day mail window; future incoming and sent mail is then checked in the background. iCloud currently checks Inbox and the designated Sent folder only; archived mail and custom folders are not imported. Primary @icloud.com, @me.com and @mac.com mailbox addresses are supported; custom-domain aliases are not onboarding addresses. Spam, trash, drafts and attachment contents are excluded from analysis. Unsupported or oversized messages are skipped. You can pause syncing from Account.

For Gmail connections using push notifications, Google Cloud Pub/Sub sends zenvodo your connected mailbox address and a history identifier to signal changes. These notifications contain no email contents. zenvodo uses them to schedule the same consented background checks, with periodic checks for missed notifications. A single encrypted history identifier and operational timestamps are retained per connection and removed when you disconnect or delete your account. Pausing stops local work; an existing Google watch can continue sending metadata until it expires, normally within seven days.

Analysis and service providers

Before you enable email analysis, zenvodo names the processor, links to its data policy and asks for your separate consent. Sender, recipients, subject, supported message text and relevant existing task context are sent to that processor. A change to the processor, OpenAI model, disclosed endpoint or data policy requires fresh consent. Review the named processor’s retention and data-use terms before opting in. You can pause analysis from Account. Pausing stops new requests and prevents in-flight results from changing tasks; a request already sent to the processor cannot be recalled.

When OpenAI is selected, zenvodo disables API response storage and supplies no tools or mailbox credentials. This is not a zero-retention guarantee: OpenAI’s abuse-monitoring, prompt-caching and other applicable retention terms still apply. OpenAI API data is not used for training. zenvodo requires a review of project data-sharing and retention settings before processing is enabled; this safeguard does not independently verify remote provider settings. Zero Data Retention requires separate approval from OpenAI and is not implied by using zenvodo. Requests use in-memory prompt caching rather than extended caching. You do not need an OpenAI subscription or API key.

Optional learning and calendar scheduling

Learning from corrections is off by default for each email workspace. When enabled, explicit priority/category corrections can establish local preferences for new tasks from the same sender and obligation type. The retained sender/value pairs are encrypted, scoped to your workspace and not sent as learning records to an AI provider or shared between customers. This is not model training. At most 500 signals are retained; evidence older than 180 days is ignored and pruned hourly in bounded batches. Turning learning off or forgetting preferences removes the memory without changing saved tasks. JSON exports include retained learning data.

iCloud Calendar or another compatible CalDAV service is separately authorized. Calendar login credentials, the server URL and remote resource paths are encrypted at rest. Custom CalDAV setup also requires your current zenvodo password; that password is never sent to the provider. Mail credentials are not reused automatically. Provider credentials may have broader permissions; zenvodo restricts its adapter to a dedicated zenvodo calendar and its own event resources. Calendar scheduling is optional and available for manual tasks too.

Each event write, update or removal requires your review and confirmation. Your chosen calendar provider receives the saved task title, reviewed date/time and, only if selected, saved context. Email bodies, sender/recipient fields, attachments and credentials are not included in the event. No invitations or attendees are added. zenvodo reads only discovery metadata and its exact event resources to confirm writes and prevent conflicts; it does not list your other calendars or events.

Encrypted local calendar records retain the reviewed form and concurrency metadata. Pending operations also retain the encrypted prepared event until confirmation or local removal. Calendar metadata is included in private JSON exports; credentials, provider URLs and prepared network payloads are excluded. Task edits do not automatically update events, and edits in your calendar app do not update tasks. Calendar disconnection and local task/account deletion leave remote events intact. Remove events explicitly before disconnecting, or manage them in your calendar app. Revoke the separate credential with your calendar provider.

Service-email exclusions

Recognized zenvodo service emails, including briefings, briefing confirmations and password resets, are excluded before analysis and do not use analysis credits. New briefings carry a signed identification header. Older messages use narrowly matched sender and subject details. This does not exclude ordinary correspondence simply because it mentions zenvodo. These checks are local; service markers and message bodies are not stored in processing receipts.

Your email rules

Personal rules can skip matching email before analysis, assign a task category or priority, or require your review. Conditions are evaluated by zenvodo and are not added to analysis instructions. Normal task context may later include a rule-assigned category. The mail adapter may already have fetched a message to apply an exclusion; a processor request already sent cannot be recalled. Removing a rule does not replay previously excluded messages or rewrite existing tasks.

Follow-up insights

Follow-up signals use saved task deadlines, statuses and recorded task-email or task-update dates. They do not confirm whether a reply is missing or work is unfinished. Opening or filtering this private page does not fetch email, call an analysis service, send reminders or use analysis credits. No additional insight history or email content is stored.

Your daily briefing

The private briefing brings together your workspace tasks. Daily email is optional and requires your opt-in and a confirmation code sent to your account address. Counts-only messages are the default; including task titles requires your explicit choice. No raw message bodies or attachments are included. Even counts can be personal information, and email copies are handled by mail providers outside the application. Turn delivery off from your briefing page. A message already being sent cannot be recalled.

We store delivery preferences, hashed address-confirmation records and operational delivery history. Confirmation codes expire after thirty minutes. Delivery history is pruned after ninety days through scheduled maintenance. Email delivery providers process confirmation and briefing messages under their own retention terms.

Cookies and browser requests

Sign-in offers an optional Remember me choice, unchecked by default, for up to seven days on a trusted device. Signing out ends that device’s remembered session. Password changes, password resets and Sign out every device revoke remembered access. Sensitive account changes still require your password.

Essential cookies provide sign-in, session security, protection against forged requests and remembering your cookie choices. Optional Preferences, Analytics and Marketing start off. Use the Cookie preferences control on signed-out public pages to accept, reject or change them. Choices are stored in a cookie on this device for up to 180 days, and may be requested again when the purposes or settings change. Browser restrictions may clear them sooner. Without JavaScript or when choices cannot be saved, managed optional features stay off.

If you allow Analytics, the analytics service receives measurements of public-page visits. The integration removes query strings, fragments and the referrer URL from its pageview data. It does not receive task or mailbox content. Managed analytics and marketing do not run on signed-in or private application pages. Marketing controls optional website invitations; the browser’s Global Privacy Control keeps Marketing off.

Withdrawing an active category saves your choice and reloads the page to stop its scripts. Known matching cookies and the invitation’s local visit flags are cleared where accessible. This cannot recall requests already sent, erase provider records or remove third-party or HttpOnly cookies. Essential sign-in and security cookies remain. Customer responses are private and no-store, and workspace access is checked against the signed-in account.

Retention, disconnection and deletion

Workspace data remains until removed. Disconnecting a mailbox permanently deletes its local tasks, feedback, saved views, email rules, encrypted sync checkpoints and connection credentials and local learning data. This leaves your original mail untouched. For Gmail, use Revoke Google access before disconnecting to remove local tokens, pause analysis and request Google revocation while keeping tasks. Google confirmation is reported separately; if it fails, remove zenvodo in Google Account connections. Revocation affects the grant for the entire Google Cloud project. For iCloud, revoke the app-specific password directly in your Apple Account. Local disconnection alone does not revoke a provider grant remotely.

Temporary connection and confirmation data is routinely cleared after expiry. Operational maintenance removes older processing diagnostics; it does not automatically delete your saved tasks.

You can download each workspace as JSON or CSV, or use Download all account data for a private JSON copy of your profile, all spaces, settings and retained customer history. Downloads exclude passwords, credentials, email bodies, attachments, verification secrets and internal security records. Files contain private task and email metadata; keep them secure. Temporary export data is removed when the response ends.

Account deletion is available for dedicated zenvodo customer accounts, with your current password, typed confirmation and explicit data/billing acknowledgements. We confirm closure of any mapped subscription and checkout before removing local identity, tasks, credentials, settings and history. All browsers lose access.

A minimal marker containing a hash of the opaque account identifier and deletion time prevents delayed work from recreating data. Restricted security audit records, revoked session files until normal maintenance, Stripe billing records, provider copies, infrastructure logs and backups follow their own retention policies. Deletion does not erase these immediately or revoke provider grants remotely. Contact support with questions about retained records or data you cannot access through your account tools.

Subscriptions and payments

Free includes your personal task workspace without a mailbox connection. Personal and Pro are recurring subscriptions billed by Qubus Labs, LLC through Stripe Checkout after account creation. Prices are in USD; Stripe shows the recurring amount and any applicable tax before payment. The Stripe customer portal provides payment management, supported subscription changes, cancellation and invoice PDFs. Your card details are handled by Stripe and are not stored by zenvodo.

zenvodo stores Stripe customer and subscription identifiers, plan and payment-status metadata, refund amounts, currencies, states and references, approved refund request records, monthly analysis usage and webhook receipt identifiers. It does not store card numbers, invoice PDFs or full payment-event payloads. Stripe processes billing contact and payment information under its own terms. Email content and mailbox credentials are not sent to Stripe. Monthly allowances reset on the first day of each UTC calendar month, including for annual subscriptions. No rollover or automatic overage charges apply. Reaching the allowance pauses new email analysis while saved tasks and manual tools remain available.

Cancel through Billing. Scheduled cancellation retains paid access through the paid period; after it ends, mailbox analysis stops and saved tasks remain. Downgrades retain usage and stop analysis for connections outside the new provider or connection allowance without deleting their workspaces. Account deletion explicitly ends remaining paid access immediately and does not automatically issue a refund. Contact support about refunds or retained billing records.