Privacy policy

1. Email access and purpose

You select the accounts to connect. InboxGuardian reads inbox messages to synchronize local records, classify messages, produce summaries and suggested actions, and decide whether to notify you.

For Gmail, the app requests only https://www.googleapis.com/auth/gmail.readonly. It uses browser-based Google OAuth with PKCE and a protected token cache, not a Gmail password field. The current Gmail connector processes messages in the Inbox; it is not a complete archive of every folder or label.

The other implemented connectors use delegated Microsoft Graph Mail.Read and read-only IMAP for QQ/126 with provider-issued authorization codes. InboxGuardian does not send, reply to, delete, archive, move, mark read/unread, or otherwise modify email or mailbox rules. Removing local data is not a source-mailbox write operation.

2. Data stored on your computer

Application data is stored under the current Windows user's local application-data directory. The app does not synchronize this history to an InboxGuardian cloud service.

Raw MIME messages and attachment file contents are not persisted by the current app. The SQLite database is not encrypted by InboxGuardian; it relies on the Windows user's filesystem protections. A person or program with access to that Windows account or its backups may be able to read local email metadata, cleaned text, and summaries.

3. Secrets and authentication

OAuth tokens, the OpenAI API key, IMAP authorization codes, and OAuth client configuration entered through the app are stored using Windows Credential Manager. Larger token caches use chunked entries. Login secrets are not placed in the SQLite email database, Activity records, or public pages.

Authentication credentials are used only with the corresponding service to authenticate requests; they are not part of the email content sent for AI analysis. The app also supports externally supplied OAuth client configuration through environment variables, which you control separately.

Operating-system protection is not a guarantee against access by compromised software running as you. Keep the computer, account, and backups protected.

4. Optional OpenAI API processing

AI analysis is enabled when you save your own OpenAI API key using the app's “Save and start analysis” control. Eligible pending messages, including retries, may then be sent directly to https://api.openai.com/v1/responses. A local filter may handle clearly low-value messages without an AI request; it is not a guarantee that all advertisements or suspicious messages remain local.

The analysis payload may contain:

• Mail provider name, sender, recipients, received time, and subject.
• A cleaned text body, length-limited to 60,000 characters in the current configuration.
• Folder/label and up to 100 attachment metadata items: filename, content type, and size.

This data can include personal or confidential information. Text cleaning is not anonymization. Attachment contents, mailbox OAuth tokens, IMAP codes, unrelated local files, and provider message links are not included in the analysis payload. The OpenAI API key is used to authenticate the request, not inserted into the email analysis text.

OpenAI returns classifications, Chinese summaries, reasons for attention, suggested actions, and extracted deadlines or reply requirements. The app validates and stores those results locally. It gives the model no tools to send mail, follow links, execute files, or change accounts.

Requests set store:false and do not link messages through previous_response_id. This does not enable Zero Data Retention by itself or guarantee that OpenAI keeps no logs. Provider-side processing and retention depend on OpenAI's policies and your API account settings. Review the official OpenAI data controls before enabling analysis.

InboxGuardian does not include advertising, data-sale, or model-training upload features. Email content is sent to OpenAI to provide the analysis you enable, not to an InboxGuardian analytics backend. This statement does not override the API provider's own terms or account-level choices.

5. Retention and deletion

The default cleaned-body retention is 30 days measured from local storage time. At startup and at the beginning of scheduled checks, maintenance clears bodies stored before that cutoff. If the app is not running, cleanup waits until it runs again; it is not an exact deletion timer.

The 30-day cleanup clears the cleaned body, not all content derived from it. Sender, subject, message metadata, summaries, actions, classifications, synchronization checkpoints, and deduplication records can remain for local history. These may still contain personal information and have no automatic 30-day expiry in the current implementation.

Using Accounts → Remove and confirming removal clears that account's local account record, checkpoints, message records, analyses, associated notification history, and retry diagnostics, together with the app-managed credentials for that account. It does not delete the provider's original messages or revoke provider consent remotely.

Shared app settings, saved OAuth client configuration, your separate OpenAI API key, and the non-message-specific cost ledger are not removed by deleting one mailbox account. No secure disk erasure is promised: deletion and body cleanup do not wipe SQLite journal remnants, independent backups, or data already processed by third-party services.

6. Your controls

• Pause an account to stop subsequent scheduled reads for that account. A request already in flight may finish; local commits are rechecked against account state.
• Remove the OpenAI API key in Settings to stop subsequent AI requests. Already submitted requests cannot be recalled by this control.
• Remove an account to clear its account-associated local data as described above. Re-adding creates a new local identity, not a history-preserving reconnect.
• Revoke Google access separately through your Google Account's third-party access controls. Local account removal does not itself perform remote revocation.
• Exit the app to stop its background checks. Closing the main window normally leaves the app running in the system tray.

Notifications and Recent Activity can display sender, subject, summaries, and actions on your screen. The current app does not promise automatic hiding on a lock screen or shared display.

7. No advertising or application telemetry

InboxGuardian has no advertising, analytics telemetry, remote logging, or third-party crash-report upload. Local diagnostics use processing stages, counts, timestamps, and safe error categories rather than email bodies, tokens, or raw authentication responses. This does not mean the mailbox and AI services involved in normal requests keep no service logs.

These static pages contain no scripts, analytics, advertising, forms, cookies set by page code, or remotely loaded fonts/images. Cloudflare Pages is the selected host for these public review drafts. Cloudflare may process connection data such as IP addresses and security logs to serve and protect the site; this is separate from application telemetry. See Cloudflare's privacy policy. No email history, database, or application credentials are uploaded with this site.

8. Publication status and contact

This is a public review draft for a personal-use project, not a claim of Google OAuth verification, regulatory certification, or a commercial service. No public support or privacy-contact channel has been established in this draft. The maintainer must confirm a real contact method before adopting it as a final policy.

Future implementation changes should be reflected in an updated policy and review date. This draft does not promise a notification or support process that the app does not implement.