Privacy Policy

What we collect

• Account: your email address and a hash of your password (we never store the password itself).
• If you sign in with Google: your Google account id and email address. We request only the “openid email” scopes and do not store Google tokens for sign-in.
• Connected mailboxes and senders: credentials or access tokens, stored encrypted.
• Mail you sync and the contacts derived from it, plus your sequences, auto-responder settings and business profile.
• AI usage counts, used to apply daily limits.

How we use it

To provide the service: sign you in, sync and display your mail, run the sequences and auto-responders you configure, and send you account emails (confirmation codes, password resets, notices).

Who we share it with

Only service providers needed to run the features you use:

• Your own mail providers (the mailboxes and SMTP senders you connect).
• The AI provider configured by you or by the server administrator.
• The site email provider that sends confirmation, reset and notice emails.
• Google, when you use Google sign-in or connect a Google mailbox.

AI features

When you use AI features, the following may be sent to the configured AI provider: recent messages in the relevant email thread (sender address, date, subject and the start of the message text), the subject and text of the message being classified or answered, drafts you ask it to rewrite, and your business profile settings (such as tone and signature).

Cookies and browser storage

• session (cookie, not readable by page scripts): Keeps you signed in. Holds a random sign-in token (only its hash is stored on our server). Set when you sign in and deleted when you log out. Lasts: 30 days. Essential.
• g_nonce (cookie, not readable by page scripts): Protects 'Continue with Google' against forged sign-in requests by tying the request to your browser. Lasts: 10 minutes. Essential. Only set when you click 'Continue with Google' (and Google sign-in is configured).
• theme (browser storage): Remembers your Light / Dark / System appearance choice. Never sent to our server. Lasts: Until you clear your browser data. Essential. Only written when you pick a theme.
• onboarding:dismissed (browser storage): Remembers that you dismissed the 'Get started' checklist on the dashboard so it stays hidden. Never sent to our server. Lasts: Until you clear your browser data. Essential. Only written when you click 'Dismiss' on the Get started checklist.

We do not use analytics, advertising or tracking cookies.

Security

Mailbox passwords, tokens, sender credentials and API keys are encrypted at rest. Account passwords are stored as hashes. Email confirmation codes are stored only as keyed hashes and expire after 15 minutes. Sign-in, sign-up and email sending are rate limited. No system is perfectly secure.

Your rights and deleting data

You can ask us to access, correct or delete your data. You can download your data and delete synced mail or your whole account yourself under Settings → Account & data; for anything else, contact us at the contact address provided by the operator of this service.

Retention

Your data is kept until you delete it or ask us to delete it. When you delete your account, your data is deleted immediately from our database; copies in backups age out according to our backup policy. Accounts that never confirm their email address are removed automatically after a few days.

Children

The service is not intended for children under 16.

Changes

We may update this policy; the date above shows the latest version.

Contact

Questions: the contact address provided by the operator of this service.