How Sam handles your mail, in plain terms.
Your assistant has his own address. He only ever sees mail you forward or CC to it. Sam never asks for your email password and never requests an OAuth grant to read your mailbox.
He writes drafts. A reply leaves only when you press Send, either in the app or on a signed confirmation page from his email. Every send is recorded in your account log.
Everything inside an email is treated as content written by a third party. A message cannot tell your assistant what to do, even if it claims to come from you, from HiFriendbot, or from a system. Messages that look like fraud are flagged and never answered.
A message only counts as written by you if it passes SPF or DKIM authentication. A spoofed copy of your address is treated as a stranger.
Action links in his emails are signed with a server secret and expire after seven days. Opening a link changes nothing; only the button on the confirmation page acts.
Messages, loops, drafts, and briefs are stored in Sam's own database on HiFriendbot infrastructure. Message bodies are removed after the retention period (30 days on Free, 90 on Pro); the summaries and loops taken from them remain. Memories live in your private CogmemAi space and are never shared across accounts.
To triage mail, write drafts, and compose the brief, the relevant text is sent to a model provider (Anthropic) under HiFriendbot's API agreement. It is not used to train models.
If you connect it, Sam stores an encrypted refresh token, reads today's events for the brief, read-only. It never creates, changes, or deletes events. Disconnect at any time from Settings.
The admin panel shows counts and account status only. It never displays message contents, drafts, or briefs.
Settings has a Delete my assistant button. It removes the address, every message, loop, draft, brief, and memory immediately.
Email [email protected]. Please include the account address and what you saw.
Related: Privacy policy · Terms of service · The Sam guide