Privacy notice

Effective October 20, 2026. This notice describes this privately operated, self-hosted Inbox Zero installation. It does not describe the commercial hosted Inbox Zero service.

Operator and purpose

The account owner operates this installation for authorized personal and work mailboxes. Contact the operator using the support email displayed on the Google OAuth consent screen. Work accounts remain subject to their organization's policies.

Data accessed

With authorization, the application processes account identity, OAuth tokens, email headers and bodies, sender and recipient details, timestamps, labels, attachment metadata and attachment content where an enabled feature needs it. Optional calendar features process calendar identifiers, event details, availability and the credentials for connected calendars.

Use of data

Data supports owner-configured email classification, labels, archiving, unsubscribe and recoverable Trash workflows, draft preparation, receipt organization, critical-issue reminders and optional calendar features. The deployment also keeps operational records needed to diagnose failures and audit actions. Email contents do not themselves authorize new actions.

Storage and access

Application data, configuration, cached information and audit records are stored on infrastructure controlled by the operator. Sensitive provider credentials are encrypted by the application at rest. The running application must be able to decrypt credentials to access authorized accounts. Administrators of that infrastructure may be able to access stored data; encryption does not eliminate this risk. Original messages and calendars remain with their email and calendar providers.

AI and other service providers

Relevant message content, metadata and extracted facts may be transmitted to the AI services selected by the operator, including OpenAI when a Codex-based provider is configured. Those services' applicable account settings, policies and retention terms govern their processing. This notice does not promise zero retention or that all processing stays on the self-hosted server.

Infrastructure, network and backup providers may process data needed to operate the installation. The operator does not sell Google user data, use it for advertising, or use it to develop or train generalized AI or machine-learning models. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Retention, deletion and revocation

Cached data, derived summaries, rules, review items and audit records may remain until the operator deletes them or applies a retention policy; there is no universal automatic-deletion period promised here. Backups may retain earlier copies until their retention period ends. Disconnecting an account stops future authorized access but does not by itself guarantee erasure of all historical application data or backups.

The owner can revoke access in Google Account connections. To request access, correction or deletion of application records and backups, contact the installation operator. Application-record deletion is separate from deleting original mail or calendar events.

Security and changes

The operator is responsible for infrastructure access, secure configuration, updates and backups. No service can guarantee absolute security. This notice should be updated when the deployment's actual processing changes.

Application overview · Terms of use