Integrations and Privacy
Understand how Sunsama integrates with your tools, what permissions we request, and what we do with the data.
We use broad language in our privacy policy regarding how we utilize third party services.
For primary integrations (e.g. calendar, email, task management integrations), we take special care with how we handle that data.
All of our integrations follow roughly the same principles, with any exceptions detailed below:
Only request data that's needed to provide user-facing features: We limit the usage of our data to specifically what you see and use in the app. We request the minimum authorization scopes needed to retrieve this data.
Limit data that's stored on our servers to the bare minimum: We don't store any information about the contents of your 3rd party data on our servers or databases or share this data with any of the analytics tools that we use. We store only the tokens needed to request data that's initiated by your in-app actions. The data that's shown in the app is only being stored in the client's browser cache, and isn't accessible outside of your session.
Do not share 3rd party data with people who don't already have access to it: If you use Sunsama as part of a shared workspace with other users, your 3rd party data will not be visible to other people in your workspace unless they already have access via the 3rd party service. For example, your calendar events won't be visible to other people in your workspace unless you've already shared your calendar with them via Google Calendar. The only exception is that if you create tasks in Sunsama via importing from a 3rd party integration, the title of those tasks will be visible to other users in your workspace.
Google Calendar integration
Authentication and scopes
We use Google Calendar's OAuth 2.0 flow for authenticating and authorizing all calendar requests.
We request the minimum scopes required to:
- View and edit calendar events across all of the calendars you have access to
calendar.events
calendar.readonly
Data storage
We store the following calendar related data:
- Authorization tokens needed to make API requests
- The list of calendars you have access to, and basic details about each calendar, so that you can choose which calendars you want to view within Sunsama
We do not store copies of your calendar events in our database. All of the calendar event data is fetched by the client, and stored only in the client cache. Calendar event data is not stored in a Sunsama database. The only exception is if you import calendar events (in that case we copy the title, location, invitees, and description) or add data to calendar events that can't be stored in Google Calendar (for example, meeting notes). In this case, we'll store a copy of the event details in our database to preserve the custom Sunsama content linked to it.
Gmail integration
Authentication and scopes
We use Gmail's OAuth 2.0 flow for authenticating and authorizing all email requests.
We request the minimum scopes required to:
- Browse your emails
- Modify an email's status (archive/mark as read/delete/star/label):
gmail.modify
Data storage
We store the following email related data:
- Authorization tokens needed to make API requests
We do not store copies of your emails in our database. All of the email event data is fetched by the client, and stored only in the client cache. Email data is not stored in a Sunsama database.
Third Party Security Assessment
In order to provide an integration with Gmail, we remain in compliance with Google's OAuth Verification Standard. Our app and infrastructure have been reviewed by an independent security assessor. This assessment helps keep Google users’ data safe by verifying that Sunsama demonstrates a minimum level of capability in handling data securely and deleting user data upon user request. If you'd like a copy of our third party security assessment, you can reach out to us at [email protected].
Outlook Calendar integration
We use Microsoft's OAuth 2.0 flow for authenticating and authorizing all calendar requests.
We request the minimum scopes required to:
- View and edit calendar events across all of the calendars you have access to
Calendars.ReadWrite
Data storage
We store the following calendar related data:
- Authorization tokens needed to make API requests
- The list of calendars you have access to, and basic details about each calendar, so that you can choose which calendars you want to view within Sunsama
We do not store copies of your calendar events in our database. All of the calendar event data is fetched by the client, and stored only in the client cache. Calendar event data is not stored in a Sunsama database. The only exception is if you import calendar events (in that case we copy the title, location, invitees, and description) or add data to calendar events that can't be stored in Outlook Calendar (for example, meeting notes). In this case, we'll store a copy of the event details in our database to preserve the custom Sunsama content linked to it.
Outlook Email integration
Authentication and scopes
We use Microsoft's OAuth 2.0 flow for authenticating and authorizing all email requests.
We request the minimum scopes required to:
- Get basic user information (profile pictures/name/etc)
- Browse your emails
- Move an email (archive/delete/etc)
- Modify an email's status (mark as read/flag/label/etc)
User.Read
Mail.ReadWrite
Data storage
We store the following email related data:
- Authorization tokens needed to make API requests
- Unique email identifiers (
id
,internetMessageId
,conversationId
) to allow fetching specific emails
We do not store copies of your emails in our database. All of the email data is fetched by the client, and stored only in the client cache. Email data is not stored in a Sunsama database. The only exception to this rule is that the email subject line is copied to our task title when creating an email task.
GitHub integration
Authentication and scopes
We use GitHub's OAuth flow for authenticating and authorizing all GitHub requests.
We request the minimum scopes* required to:
- Browse your issues and PRs across all your repos/projects
- Modify an issue/PR's status (close/open/merge)
repo
read:org
GitHub Scopes
Unfortunately, in order to simply view all of your Github Issues, the only scope that Github provides is the
repo
scope. Regrettably, this scope is quite broad and also grants an application access to a variety of other data (that we don't actually use).We're hopeful that one day Github will release more granular scopes that will allow us to access to what we need without also gaining access to sensitive items, like those that you mentioned.
Data storage
We store the following GitHub related data:
- Authorization tokens needed to make API requests
We do not store any of your issues/PRs in our database. All of the issue/PR data is fetched by the client, and stored only in the client cache. Issue/PR data is not stored in a Sunsama database.
Jira integration
Authentication and scopes
We use Jira's OAuth flow for authenticating and authorizing all Jira requests.
We request the minimum scopes required to:
- Browse your issues across all your projects/boards
- Modify an issue's status
read:jira-work
read:jira-user
write:jira-work
offline_access
Data storage
We store the following Jira related data:
- Authorization tokens needed to make API requests
We do not store copies of your issues or projects in our database. All of the Jira data is fetched by the client, and stored only in the client cache. Issue/project data is not stored in a Sunsama database.
Linear integration
Authentication and scopes
We use Linear's OAuth flow for authenticating and authorizing all Linear requests.
We request the minimum scopes required to:
- Browse your issues
- Modify an issue's status
read
write
Data storage
We store the following Linear related data:
- Authorization tokens needed to make API requests
We do not store copies of your issues or projects in our database. All of the Linear data is fetched by the client, and stored only in the client cache. Issue/project data is not stored in a Sunsama database.
Monday integration
Authentication and scopes
We use Monday.com's "Personal Access Tokens" for authenticating and authorizing all requests to the Monday API.
This token allows Sunsama's integration the same permissions to your Monday workspace as your user account. In other words, it can only see/edit what you can see/edit when logged in and doesn't have access to things in the workspace you could not edit yourself.
Data storage
We store the following Monday related data:
- Personal access token needed to make API requests
We do not store copies of your tasks or projects in our database. All of the Monday data is fetched by the client, and stored only in the client cache.
Trello integration
Authentication and scopes
We use Trello's OAuth 2.0 flow. Trello does not support granular authentication permissions, as such, there are no scopes associated with the Trello integration. Sunsama's permissions are connected at the Trello account level, which grants permissions to data in all Trello workspaces your Trello account is a member of.
Data storage
We store the following Trello related data:
- Authorization tokens needed to make API requests
We do not store copies of your tasks or projects/folders/lists in our database. All of the Trello data is fetched by the client, and stored only in the client cache. Task/project data is not stored in a Sunsama database.
Todoist integration
Authentication and scopes
We use Todoist's OAuth 2.0 flow. Todoist does not support granular authentication permissions, as such, there are no scopes associated with the Todoist integration. Sunsama's permissions are connected at the Todoist account level, which grants permissions to all data your Todoist account has access to see.
Data storage
We store the following Todoist related data:
- Authorization tokens needed to make API requests
We do not store copies of your tasks or projects/filters/labels in our database. All of the Todoist data is fetched by the client, and stored only in the client cache. Task/project/label/etc data is not stored in a Sunsama database.
ClickUp integration
Authentication and scopes
We use ClickUp's OAuth 2.0 flow. ClickUp does not support granular authentication permissions, as such, there are no scopes associated with the ClickUp integration.
Data storage
We store the following ClickUp related data:
- Authorization tokens needed to make API requests
We do not store copies of your tasks or projects/folders/lists in our database. All of the ClickUp data is fetched by the client, and stored only in the client cache. Task/project data is not stored in a Sunsama database.
Asana
Authentication and scopes
We use Asana's OAuth flow. Asana does not support granular authentication permissions, as such, there are no scopes associated with the Asana integration.
Data storage
We store the following Asana related data:
- Authorization tokens needed to make API requests
We do not store copies of your tasks or projects in our database. All of the Asana data is fetched by the client, and stored only in the client cache. Task/project data is not stored in a Sunsama database.
Notion
Authentication and scopes
We use Notion's OAuth flow. Notion's API does not support granular permissions but it does allow users to select which pages (and sub-pages) the Sunsama integration gets access to.
Data storage
We store the following Notion related data:
- Authorization tokens needed to make API requests
- List of databases names, metadata and their properties
We do not store copies of your tasks in our database. All of the Notion data is fetched by the client, and stored only in the client cache. Task data is not stored in a Sunsama database.
Slack integration
Authentication and scopes
We use Slack's OAuth 2.0 flow for authenticating and authorizing all Slack requests.
We request the minimum scopes* required to:
- Post messages to the Slack channel of your choosing from Sunsama
- Create Sunsama tasks via Slack message actions
- Create Sunsama tasks via Slack commands
- @mention teammates via Sunsama comments
- Unfurl Sunsama urls
- Update Slack status
app_mentions:read
channels:join
channels:manage
channels:read
chat:write
commands
groups:read
im:history
im:read
im:write
links:read
links:write
mpim:history
mpim:read
mpim:write
team:read
users:read
users:read.email
users:write
*Slack has highly granular scopes, which is why there are so many needed to support the minimum functionality
Data storage
We store the following Slack related data:
- Authorization tokens needed to make API requests
We do not store copies of your Slack messages, channels, or users in our database. All of the Slack data is fetched by the client, and stored only in the client cache.
AI Customizations
Your data is not used to train models and it's encrypted
We use Google's Vertex AI to back our AI Customizations because it provides high quality privacy:
- Data is encrypted in transit
- Your data is not used to train Google's models
Learn more from Google's docs directly.
Always Opt In
Sunsama's AI features are an opt-in feature. No customer data is used for embedding until the feature is explicitly enabled by the user.
Microsoft Teams integration
Authentication and scopes
We use Microsoft's OAuth 2.0 flow for authenticating and authorizing all Teams requests.
We request the minimum scopes required to:
- Post messages to the Teams' team and channel of your choosing from Sunsama
- Create Sunsama tasks via Teams message actions
- Create Sunsama tasks via Teams commands
- Unfurl Sunsama urls
- Update Teams' status
User.Read
Team.ReadBasic.All
GroupMember.Read.All
Channel.Create
Channel.ReadBasic.All
ChannelMessage.Send
TeamsAppInstallation.ReadWriteForUser
Presence.ReadWrite
Data storage
We store the following Team related data:
- Authorization tokens needed to make API requests
- Unique team identifiers (
id
,tenantId
) to more easily display channels for the team you want
We do not store copies of your Teams messages, channels, or users in our database. All of the Teams data is fetched by the client, and stored only in the client cache.
Zapier
We do not require any permissions or store any information about your Zapier integration. The token you provide in Zapier allows them to verify it's valid and send a request to create tasks in Sunsama. We do not have access to any of your Zapier's account information.
Zoom
Authentication and scopes
We use Zoom's OAuth 2.0 flow for authenticating and authorizing all Zoom requests.
We request the minimum scopes required to:
- Get basic user information (profile pictures/name/etc)
- Create a meeting
/user_info:read
/meeting:write
Data storage
We store the following Zoom related data:
- Authorization tokens needed to make API requests
- Meeting URLs, added to and shown in calendar events
We do not store copies of your meetings or participants in our database.
Apple Calendar (iCloud) integration
Authentication and scopes
We use Apple's app-specific passwords flow for authenticating and authorizing all calendar requests.
Apple doesn't provide an API with granular permissions or access, so we do have full access to view and edit calendar events across all of the calendars you have access to.
Data storage
We store the following calendar related data:
- App-specific password needed to make API requests (encrypted in transit and at rest)
- The list of calendars you have access to, and basic details about each calendar, so that you can choose which calendars you want to view within Sunsama
We do not store copies of your calendar events in our database. All of the calendar event data is fetched by the client, and stored only in the client cache. Calendar event data is not stored in a Sunsama database. The only exception is if you import calendar events (in that case we copy the title, location, invitees, and description) or add data to calendar events that can't be stored in Apple Calendar (for example, meeting notes). In this case, we'll store a copy of the event details in our database to preserve the custom Sunsama content linked to it.
Updated 3 months ago