How Peakly keeps your email safe

Two ways in

• Easiest — connect your inbox. Google or Microsoft asks you for read-only access to your email and permission to add events to your calendar. Peakly checks who each email is from and opens only the ones from your school, its apps and the addresses you added. Everything else stays unopened.
• More private — forward only. Peakly gets no access to your inbox. You set up one rule in Gmail, Outlook or iCloud Mail, once, and from then on your school’s emails are forwarded to your private Peakly address automatically. If you sign in with Google or Microsoft, they ask only for your calendar; sign in with an email code and Peakly asks for nothing at all.
• You can never be asked for your email password, and Peakly can never send, reply to, move or delete your email.

Your private Peakly address

If you forward, Peakly gives you an address made only for you, like school-k7m2xq9p4d@peakly.me. It works like a letterbox only Piku can see into — a drop-box, not an email account: nobody signs in to it and nothing is kept there.

An email sent to it is read only if your own Gmail, Outlook or iCloud account forwarded it — Peakly checks the security signatures those providers add — and only if it comes from your child’s school or a school app you chose. Anything else is thrown away unread. A forwarded email waits in short-lived memory, never more than an hour and usually a few seconds, and is then deleted.

What we keep, and what we never keep

• Never kept: the text of your emails and PDF letters. They are read in memory, the dates and to-dos are taken out, and the email itself is discarded.
• Kept: the event Piku found (title, date, time, what to do) and the email’s subject line, so you can see where it came from.
• Never sold, never used for advertising, never used to train AI models.
• Delete your account in Settings and your data goes with it.

Checked by others

• Google CASA security assessment, including a dynamic scan, completed September 2026.
• Microsoft Verified Publisher.
• Every change to our code is scanned for security problems and vulnerable dependencies, and everything is scanned again every week.

How it is protected

• Access keys to Google and Microsoft are encrypted with AES-256-GCM; everything travels over TLS.
• Our servers and database are in the EU.
• Sign-in sessions rotate on every renewal, and sign-in codes expire after 10 minutes and five tries.
• Your calendar link, if you use Apple Calendar, contains a 256-bit random key, is looked up only by its hash, and can be replaced at any time — the old one stops working at once.

Your calendar is optional

Summaries come to WhatsApp whatever you choose. If you want the dates in a calendar too, Peakly adds them to Google Calendar or Outlook (asking only to add events), or gives you a private link for Apple Calendar or any app that subscribes to one.