Privacy Policy

Administrator email access

Active platform administrators can read connected mailbox contents and inspect reader links for platform administration. These admin views bypass reader access codes, recipient restrictions, expiry, session caps and message cutoffs. Each admin email request is recorded in an audit log. Mailbox provider authorization is still required; provider credentials and reader access codes are not displayed to administrators.

1. Mailbox access

• InboxReader connects to Outlook, Hotmail, Microsoft 365, Gmail and Google Workspace mailboxes through provider OAuth, after you sign in with Microsoft or Google and approve access.
• We request the delegated, read-only permissions Mail.Read, User.Read and offline_access. We do not request permission to send, delete or modify email.
• Other providers (for example AOL, Yahoo, iCloud, GMX, Zoho, hosting providers and company mail servers) connect over IMAP with an app password or mailbox password that you enter. InboxReader opens their folders read-only, over an encrypted connection.
• The reader and API display messages from the Inbox and Junk Email/Spam folders only.
• For Outlook and Gmail we never ask for, receive or store your email password. For IMAP mailboxes we store the password you enter, encrypted, and use it only to read that mailbox.

For Gmail, we request gmail.readonly and basic Google identity scopes. Email content is used only to display the messages and verification codes you authorize through reader links and API keys. It is not used for advertising, sold, or used to train AI models.

InboxReader’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

2. Reader links

A reader URL acts like a password. Anyone who has a valid reader URL may be able to view the mailboxes assigned to it, unless an access code or authorized sign-in is required by the owner. Keep links private and rotate a link immediately if it is exposed. You can rotate, disable or delete links at any time.

3. What we store

• Account: email address, display name and authentication data managed by our authentication provider (passwords are stored hashed by that provider).
• Connected mailboxes: mailbox address, display name, provider account identifier, connection status and timestamps.
• Mailbox credentials: OAuth refresh and access tokens, and for IMAP mailboxes the password you entered, encrypted with AES-256-GCM before storage. For IMAP mailboxes we also store the server name, port and username.
• Reader links: name, status, mailbox assignments, access count and last access time, a SHA-256 hash of the secret, and an encrypted copy of the secret so you can copy the URL again. Optional controls include expiry, a recipient email, session limits, code-use counters and a salted access-code hash.
• Reader sessions: hashes of random session tokens, their expiry and the link policy version. The browser holds an opaque HttpOnly cookie. Access codes are not stored in plaintext. Expired session records are removed by the retention job.
• API keys: a SHA-256 hash and a short non-secret prefix. The full key is shown to you once and not stored.
• Activity log: security-relevant events (for example sign-ins, link rotations, reader access) with the time, a keyed one-way hash of the IP address and a coarse device/browser category (such as “mobile · Safari”).
• Usage counters: daily totals such as reader views, API requests and the number of new messages and codes seen. These are counts only.
• Billing: plan and subscription status, and payment-provider identifiers if paid plans are enabled. Card details are handled by the payment provider, not by us.

4. What we do not store

• Email contents. Messages are fetched live from your email provider when you open a reader or call the API, and are not saved to our database.
• Verification codes. Codes are detected on the fly while a message is displayed.
• Raw IP addresses in the activity log, or device fingerprints.

5. Analytics and cookies

We record a small set of first-party product events (for example “mailbox connected” or “reader link created”) without email contents, addresses or IPs. We use only essential cookies: your sign-in session and a short-lived cookie that protects the provider sign-in flow. We do not use advertising or third-party tracking cookies.

6. Service providers

We rely on providers to run the service: our database and authentication provider (Supabase), our hosting provider, your email providers (Microsoft, Google or the IMAP server of a mailbox you connect, to read mailboxes you authorize), and a payment processor if paid plans are enabled. They process data only to provide their services.

When connecting a company email address or detecting its server settings, we send only its domain to Cloudflare’s DNS-over-HTTPS resolver to find public mail service records. Your full email address, mailbox password and email contents are not included in those DNS requests.

7. Retention and deletion

• Activity logs are kept for 90 days, product analytics for 180 days and operational error logs for 30 days, unless configured otherwise by the operator.
• Disconnecting a mailbox deletes its stored tokens or IMAP password immediately. Removing it deletes the mailbox record.
• Deleting your account (Settings → Danger Zone) deletes your profile, mailboxes, encrypted credentials, reader links, API keys, usage and activity records. Backups held by our database provider expire on their own schedule.
• You can also revoke InboxReader’s access from your Microsoft or Google account’s app permissions page. For IMAP mailboxes, delete the app password (or change the password) at your provider.

8. Your choices

You can export your account data from Settings → Data & Privacy, correct your profile, and delete your account at any time. For other requests contact aymenlasfar@hotmail.com.

9. Changes

We will update this page when our practices change and revise the date above.