Security
closegraph.com · September 4, 2026
What is read
Four headers from each message: from, to, cc, and date. The permission closegraph asks Google for cannot return message text or attachments. It could return subject lines; closegraph does not ask for them. Only conversations where mail went both ways are read at all. The listing of your mailbox that finds those conversations carries message ids and nothing else.
Where it lives
One server, run by us, reachable only through an encrypted tunnel. The token that lets closegraph re-read headers is encrypted at rest with a key that is not stored beside the data. Backups are encrypted with a second key that is kept off the server, so a copied backup is unreadable. The server keeps 14 days of backups; one offline copy keeps 30.
Who can see what
A member searches a first and last name and sees, for each member who corresponds with that person, a closeness score and the organization behind the address. Never the address, never counts, never dates, never anything written. A member only searches the graphs of members they correspond with, members who share an invitation with them, and groups they have joined. Nobody can list anyone’s contacts, and searches are rate limited and logged for 30 days so that misuse can be found.
Who can join
Anyone with a Google account can connect. A new member starts with their own graph and can search the graphs of members they already correspond with, whoever sent them a connect link, and groups they join. Joining does not show them anyone else.
Leaving
On the home page you can delete any one account or everything. closegraph revokes its own access at Google and deletes what it indexed at once. Every open session for the account ends at the same moment.
Google review
Google verified closegraph for the permission it uses on October 11, 2026. The review checked the privacy policy, the scope requested, and a recorded demonstration of how the data is used, and ended with an independent CASA security assessment. Revalidation is annual.
Reporting a problem
Nick Soman, [email protected]. A report about a security weakness is answered within a day.