Privacy
InboxLink connects a mailbox to an app that you use. This page explains what InboxLink stores and why. It is a plain-language summary of how the service works.
What we receive
- The mailbox address and the permission you grant (read-only access to Gmail, or the equivalent for other providers) when you connect.
- A long-lived refresh credential from the provider, used only to read the mailbox for the app you connected it to.
- Message data needed for that app: sender, recipients, subject, a short snippet, labels, dates and, when requested, the body and attachment names. Attachment contents are not fetched.
How it is used
Only to provide the mailbox connection to the app you connected, and to keep it in sync. We do not sell data, use it for advertising, or use it to train models. People working on the service do not read your mail except where you ask for support, where security requires it, or where the law requires it.
InboxLink's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How it is protected
Refresh credentials are encrypted at rest (AES-256-GCM) and are never returned by the API. The host app receives an opaque grant ID, not your credential. Logs redact tokens and secrets. Data is stored in a managed Postgres database.
Who receives it
The app you connected the mailbox to receives message data through the API and, if it registered one, signed webhook events (event type, grant and message identifiers, and the subject line). The service runs on Vercel and a managed Postgres provider as infrastructure processors. Nothing else receives your data.
Keeping and deleting
Data is kept while the connection is active. Disconnecting (revoking the grant) deletes the stored credential and the stored messages for that connection. You can also revoke InboxLink's access from your Google account permissions page at any time, which stops all access immediately. To ask for deletion, use the contact below.
Contact
Questions, security reports, or requests to delete data: efokou@cieltd.org.