Privacy Policy

What Inbox Triage does

Inbox Triage connects email accounts you already own to the AI agent you choose (for example Claude or ChatGPT) over MCP. Your agent can list, read, and search your messages, draft replies, label, star, archive, mark as spam, move to Trash, unsubscribe after you approve, and undo recent changes. It sends a message only after you approve it in the app or on the approval page. This website is for your account, connecting inboxes, billing, and documentation.

Google user data

Limited Use: Inbox Triage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Workspace APIs: The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In short:

• We use Gmail data only to provide the features you see and use in Inbox Triage.
• We transfer Gmail data only to the AI agent you connect, at your request, to provide those features. We also transfer it if needed for security, to comply with the law, or as part of a merger or sale of the business, with notice to you.
• We do not sell Gmail data. We do not use it for advertising, including retargeting or interest-based ads.
• We do not use Gmail data to train, develop, or improve AI or machine learning models, ours or anyone else's.
• No person at Inbox Triage reads your Gmail data unless you ask us to for a specific message, it is needed for security or to investigate abuse, or the law requires it.

The sections below explain what we access from Google, how we use it, who receives it, how we protect it, and how long we keep it.

Data we access

From Google

• Sign in with Google (scopes openid, email, profile): your name, email address, and Google account ID. We use these only to create and sign in to your Inbox Triage account.
• Connecting a Gmail inbox (scope gmail.modify), asked for separately and only when you choose to connect Gmail:
  • Message headers (sender, recipients, subject, date), Gmail labels, and short previews for the newest messages in the folders you select, about 300 per folder. If you or your agent load older mail, a folder can hold up to 1,000. Spam and Trash are never synced.
  • The plain-text body of a message when you or your agent open it, capped at 20 KB.
  • Messages that match a search you or your agent run.
  • Attachment names, types, and sizes. The attachment file itself is fetched only when your agent asks for it and is passed through without being stored.
  • Your list of Gmail labels, so your agent can apply the right one.
• Changes you ask for: drafts your agent writes, drafts you approve for sending, and label, star, archive, spam, and Trash changes. These are made in your Gmail account.

Data we create from it

• Counts and status per inbox, such as how many messages are synced or unread and when the last sync ran.
• An activity log of actions in your account. Some entries include details from your mail: the subject of a draft, the recipient and subject of a message you approved for sending, an attachment's file name, the sender you unsubscribed from, and triage summaries your agent writes.
• Undo records for archive, trash, spam and label changes: message IDs and the labels or folder to restore. They expire after 7 days.
• Your triage preferences, such as VIP senders and how your agent should handle junk.

Search terms are not stored or logged.

Other information

• Account details: your name, email address, and password (stored only as a salted hash).
• Other mailboxes: OAuth tokens for Microsoft, Yahoo or AOL, an Apple app-specific password for iCloud, or a mailbox password for other IMAP accounts, and the same kinds of message data listed above for those inboxes.
• Agent access: API keys (stored only as hashes) and the OAuth grants you approve for your agent.
• Billing: your plan, subscription status, and Stripe customer and subscription IDs. Card details are handled by Stripe and never reach us.
• Marketing preference: whether you opted in to product updates, and when.

How we use it

• To run the features you use: sync your selected folders, show your mail to you and your agent, and carry out the actions you or your agent ask for, such as drafting, sending after your approval, labeling, archiving, and undo.
• To show you your inboxes, sync status, and activity log.
• To keep your account secure, troubleshoot problems you report, and prevent abuse.
• To send account emails you need, such as email confirmation and password reset. Stripe sends payment receipts.
• To send product updates and tips, only if you opted in. These use your email address only, never your mail content. Every such email has an unsubscribe link, and you can change this in Settings at any time.

We do not use your mail content for advertising, to build profiles for anyone else, or to decide on credit or lending. We do not sell your information.

Sharing and transfer

We share your data only in these cases:

• The AI agent you connect. When your agent asks, Inbox Triage sends it the message data it needs for the task you gave it. This happens only for agents you authorized yourself, with an API key or an OAuth sign-in you approved. You choose the agent and can revoke its access at any time in Settings.
• Service providers that run the service for us, listed below. Only our hosting provider stores your mail data. Stripe, Resend, Cloudflare, and rspamd.com never receive your mail content.
• Legal and safety: when the law requires it, or to protect the security of the service or its users.
• Business transfer: as part of a merger, acquisition, or sale of assets, with notice to you first. The new owner must keep the commitments in this policy.

AI and model training

• Inbox Triage does not run any AI model on your mail. It does not train, fine-tune, or improve any AI or machine learning model with your data, and it does not let anyone else do so.
• We do not send your data to any AI service for our own purposes.
• The one exception is the AI agent you choose to connect, such as Claude or ChatGPT. When you ask your agent to work on your mail, Inbox Triage sends that mail to the agent at your direction, only to provide the triage features you asked for.
• Once your agent receives your mail, that provider handles it under its own terms and privacy policy. Some AI providers let you control whether your chats are used to improve their models. Please review your provider's terms and settings before you connect it.

Security

• All traffic to Inbox Triage uses HTTPS. Calls to Google and other mail providers also use encrypted connections.
• Mailbox credentials, including Google OAuth tokens, are encrypted with AES-256-GCM before they are stored.
• Your data is stored with our hosting provider, Fly.io, on disks that are encrypted at rest.
• Each account's data is kept separate. Your agent can reach only your account, using an API key or OAuth grant you created. API keys and passwords are stored only as hashes.
• No connect flow asks for a password in chat. Message bodies sent to your agent are marked as untrusted content, to reduce prompt-injection risk.
• Access to production systems is limited to the people who run the service, and only for the reasons in the Google user data section above.

See Security for more detail. If a breach ever affects your data, we will tell you promptly and as the law requires.

Retention and deletion

• Synced mail is a rolling window. As new mail arrives, older messages drop out of the window and are removed from our storage.
• Undo records expire after 7 days. Download links for attachments expire after 15 minutes.
• The activity log keeps your most recent 5,000 events. Older events are removed.
• Disconnect an inbox (Inboxes page) to delete its stored credential and synced mail. For Gmail, we also ask Google to remove Inbox Triage's access to your account.
• Delete your account (Settings) to remove your account, inboxes, synced mail, stored credentials, activity log, API keys, and agent access, and to cancel your subscription. For Gmail, we also ask Google to remove our access.
• Database backups roll over, and deleted data leaves them within 30 days.
• Stripe keeps billing records as required for tax and accounting.
• You can ask us to delete your data at any time by emailing help@getinboxtriage.com.

You can also remove access from the provider side at any time: Google Account third-party connections, Microsoft app permissions, or Apple app-specific passwords.

Analytics and cookies

We measure visits to our public pages (the home page, pricing, docs, and similar) so we know which pages help people. We never run analytics in your account, on your inboxes or messages, or during sign-in or connecting a mailbox, and analytics never sees your mail. The one exception is the sign-up and purchase signals described under Meta Pixel below.

• Cloudflare Web Analytics counts page views without cookies and without identifying you.
• Google Analytics runs only after you click Accept on the cookie notice. It sets first-party cookies to count visits and see which pages people use. Google Signals and ad personalization are off, and Google Analytics does not store IP addresses. You can change your choice any time with Cookie settings at the bottom of a public page.
• Meta Pixel also runs only after you click Accept, and only on our public pages. It tells Meta that a visit came from one of our ads so we can see which ads work. Meta sets its own cookies and receives the page address, your browser details, and your IP address. It never runs in your account or sees your mail. If you clicked Accept and then create an account, your browser sends Meta signals that a sign-up and free trial started, and one when you subscribe, which includes the amount paid. Each comes with Meta's cookies, your browser details, and your IP address, so we can see which ads lead to sign-ups, trials, and sales. They carry no name, email address, card details, or anything about your mail.
• Our own cookies: signing in, form security, your cookie choice, your time zone (so "today" in your inbox means your day), and a short-lived note that you just signed up or subscribed, which holds nothing but the amount paid. These are needed for the site to work and are never used for tracking.
• Where you heard about us: if you arrive from one of our ads or newsletter sponsorships, a cookie remembers which one for 30 days, and we note it on your account when you sign up so we know which placements work. It holds only the campaign name, never anything about you, and it is not shared with the publisher.

Your choices and rights

You can see and change your account details in Settings, opt out of product updates, and delete your account. To request a copy of your data or ask a question, email help@getinboxtriage.com. Depending on where you live, you may have more rights to access, correct, or delete your information. We will respond to requests within 30 days.

Children

Inbox Triage is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes

If we change this policy, we will update the date below, and we will email you before material changes take effect. We will not use Google user data in a new way without asking you first.

Last updated: November 1, 2026. Easterday Strategy Group LLC, Florida. Contact: help@getinboxtriage.com. See also Terms of Service.