Privacy Policy

Outbox lets you send email from your own Gmail or Outlook account. This policy explains what information we handle to make that work, why, and the choices you have. We keep it short because we collect as little as we can.

Information we collect

• Account details. The email address and password you use to sign in to Outbox. Passwords are handled by our authentication provider and are stored only as salted hashes.
• Profile details. Your name and profile photo, if you choose to add them. They are shown in your account menu.
• Contact messages. If you write to us through the contact form, the name, email address and message you send.
• Spreadsheet automation (optional). If you use it, the ID and tab of the Google Sheet you link, the column letters you choose, your daily limit, the instructions you save for the AI, and a record of which addresses were emailed (so nobody is emailed twice).
• Connected mailbox details. When you connect Gmail or Outlook we store the address of that mailbox and the OAuth access and refresh tokens needed to send mail for you. Tokens are encrypted before they are stored.
• Send history. For each message you send we keep the sender address, recipient address, subject, time and whether it succeeded. We do not store the body of your messages.

How we use Google and Microsoft data

We request the narrowest permissions needed. For Gmail this is gmail.send (send email on your behalf) and your account email address. For Outlook this is Mail.Send, User.Read and offline_access. Outbox cannot read, search, modify or delete the messages in your mailbox.

If you turn on spreadsheet automation we also request Google Sheets access (spreadsheets). Google words this permission as access to your spreadsheets, but Outboxreads and writes only the sheet you link: it reads the websites and addresses, and writes a “sent” mark next to addresses it has emailed. This permission is optional and is requested separately from sending mail.

The content you write is passed to Google or Microsoft only to deliver the message you asked us to send. Outbox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and do not allow humans to read it except where you ask for support, it is needed for security, or the law requires it.

Service providers

We rely on Supabase (authentication and database), Vercel (hosting), and Google and Microsoft (the mail services you connect). They process data only to provide their service to us and are bound by their own privacy terms.

AI-assisted drafting

If you use “Generate with AI”, the instructions you type are sent to an AI provider, Groq or Google (Gemini), which writes a draft. We do not send recipient addresses or the contents of your mailbox. Depending on the provider and plan, text sent to a free service may be retained or used by that provider to improve its services, so please do not put passwords or confidential information in your instructions. We keep only a daily count of drafts per account to apply fair-use limits; we do not store the instructions you type in the compose window or the drafts the AI writes. If you use spreadsheet automation, we store the instructions you save there so they can be reused each day.

Cookies

We use only strictly necessary cookies: a sign-in session cookie and a short-lived security cookie during the connect-mailbox flow. We do not use advertising or third-party analytics cookies.

Retention and deletion

You can disconnect a mailbox at any time from the dashboard, which deletes its stored tokens. You can also revoke access from your Google or Microsoft account’s app permissions page. You can delete your account at any time in Settings, which permanently removes your account, connected mailboxes, send history and profile photo. Contact messages are kept only as long as needed to reply.

Security

Tokens are encrypted at rest with AES-256-GCM, data is protected by row-level access rules so each account can reach only its own records, and all traffic uses HTTPS. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you.

Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. To use these rights, contact us using the details below.

Children

Outbox is not intended for anyone under 16, and we do not knowingly collect their information.

Changes to this policy

If we change this policy we will update the date above and, for material changes, notify you in the app or by email.

Contact

Questions or requests: hmtahirs1@gmail.com