Privacy policy

This policy explains what Inboxes ("we") collects, why, and what we do with it. The short version: we collect what the product needs to work, we do not sell data, and you can ask for deletion at any time.

What we collect

• Account and signup data. Your email address, signup confirmation status, the page you signed up from, and standard request metadata (IP address, user agent). We use this to create and secure your account and to contact you about the service.
• Mailbox credentials. The IMAP server details and the password or app-specific password for each mailbox you connect. These are stored encrypted and used only to connect to that mailbox on your behalf. You can disconnect an account at any time, which removes them.
• Message data. To show you a unified inbox, we read the messages in the mailboxes you connect, including headers, subjects, bodies, and attachments, and we cache them so the board loads. Your mail continues to live at your own provider. We do not migrate, move, or delete it.
• AI categorization. Message content is passed to an AI model (Google Gemini), which returns a category (Important, Newsletter, Notification, Spam, or Other), a spam score, up to four short tags, a one-sentence summary, a priority score with a short reason for it, and a suggested reply draft. Sorting your mail and drafting a reply you can edit is the only purpose it is used for. Everything it produces is stored alongside the message.
• Contact messages. If you write to us, we keep the message to answer it.

What we do not do

• We do not sell or rent personal data, and we do not sell or share your mail. Ever.
• We do not train AI models on your mail, and our AI provider is contractually bound not to train on it either.
• We do not use the content of your mail for advertising, profiling, or marketing, to you or to anyone who writes to you.
• We do not read your mail as humans, except in the narrow case where you explicitly ask us to look at a specific message to support you.
• We do not run third-party advertising trackers on this site.

Legal basis and retention

We process your account data and your mailbox data to perform our contract with you: you asked us to show you a unified inbox, and reading the connected mailboxes is how that is done. Product analytics are processed in our legitimate interest to keep the service working.

Cached messages and their categories are kept while the mailbox is connected and your account is active. Disconnecting a mailbox removes its cached mail from our systems, and deleting your account removes everything: within 30 days from live systems and within 90 days from backups. Because your mail lives at your provider and not with us, deleting your Inboxes account never deletes your actual email.

Sharing

We use a small set of processors to run the service: cloud hosting, an AI provider (Google) for the categorization and spam decisions described above, transactional email delivery for codes and alerts, and error monitoring. Processors act under contract and only on our instructions, and the AI provider does not train on the content we send it. We disclose data if the law genuinely requires it, and we tell you when we are allowed to.

Your rights

You can request access, correction, export, or deletion of your personal data by writing to [email protected] from the address on the account. Depending on where you live (GDPR, UK GDPR, CCPA), you may have additional statutory rights; we honor requests from anywhere the same way.

Security

Data in transit is encrypted with TLS; data at rest is encrypted on managed infrastructure with access limited to people who operate the service. No system is perfectly secure, and we will notify affected users of any breach as the law requires.

Contact

Privacy questions: [email protected], or the contact form. If we change this policy materially, we will note it here with a new effective date.