Privacy policy

Who we are

Outbox is run by [legal entity], [address]. Questions about this policy: [contact email].

What Outbox does with your mail

You connect a Gmail or Outlook account and choose which client addresses Outbox may read. Outbox imports only messages from, to or copied to those addresses, from the last 90 days. Everyone else’s mail stays in your inbox and is never read.

Access is read-only. Outbox never sends, moves or deletes mail. If you turn on reply drafts, Outbox creates a draft in your mailbox and stops there; you decide whether to send it.

What we store

• Your sign-in identity (email address) and workspace settings.
• OAuth refresh tokens for the accounts you connect, encrypted at rest and bound to your workspace. Disconnecting an account deletes its token.
• Imported messages: sender, recipients, subject, text, quoted history, links, attachment names and sizes. Attachment contents are fetched from your mailbox on demand and not kept unless you upload a file.
• Files you upload to a request, within your storage (2 GB included plus any packs). They stay until you delete them.
• Requests, stages, notes and history you create on the board.
• If we ask you to verify a mobile number, we store it only to confirm it is yours and to prevent repeat abuse. It is deleted when your workspace is deleted.

Processors

• Cloudflare hosts the app, database and file storage, and runs Turnstile human checks when we ask for one.
• [SMS provider, e.g. Twilio] delivers verification codes if we ask you to verify a mobile number.
• Google and Microsoft provide mailbox access under the consent you give them. You can revoke it in your Google or Microsoft account at any time.
• OpenAI receives message text only if you enable AI classification. It is used to suggest a client or request; it never creates clients, sends mail or sets a status. Data sent this way is not used to train models.

We do not sell your data and do not share it with anyone else.

Cookies and local storage

The marketing site stores two values in your browser: your theme and your language choice. No analytics, no tracking, no third-party cookies.

Retention and deletion

Imported mail and files stay while your workspace exists. Disconnecting an account deletes its credentials immediately. Deleting your workspace deletes everything it contains within 30 days of the request.

Your rights

You can ask for a copy of your data, correct it, or have it deleted by writing to [contact email]. If you are in the EU or UK you also have the right to complain to your data protection authority.

Changes

If this policy changes in a way that matters, we will tell you by email before it takes effect.