Privacy Policy

Information we access

• Google sign-in requests only openid, email and profile permissions. We receive your Google account identifier, email address, email verification status and basic profile information, such as your name and profile picture. We use this to identify you, authenticate you and manage your Mailthing account. Signing in with Google does not by itself give Mailthing access to your Gmail messages.
• Connecting a Gmail mailbox is a separate authorization. It requests openid, email and the full-mail scope (https://mail.google.com/) to synchronize and inspect messages and support authorized sending, mailbox changes and permanent deletion. Depending on the features you use, this includes message bodies, subjects, sender and recipient addresses, headers, folders, labels, flags, timestamps, drafts and attachments. Permanent deletion requires separate authorization within Mailthing and can be irreversible.
• Microsoft and IMAP/SMTP mailbox connections process comparable mailbox data and the credentials needed for the connection. We also process workspace memberships, invitations, scoped API access, webhook configuration, operation status and audit records to run your integration.

How we use information

We use account information to provide sign-in and workspace access. We use mailbox data to provide the integration features you authorize: synchronization, message inspection, content extraction, draft comparison, sending, mailbox changes and webhook delivery. We process operational records to protect the service, investigate failures and maintain reliable access. We do not sell Google user data, use it for advertising or use it to train general-purpose AI models.

Mailthing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. These restrictions also apply to data derived from Google user data.

Sharing and optional processing

Mailbox information is available to authorized users and integrations in the connected workspace, according to their permissions. Configured webhooks can deliver message and event information to destinations selected by your workspace. Email providers receive requests needed to perform authorized operations; recipients receive messages you authorize Mailthing to send. Service providers supporting hosting, storage and operation process information as needed to provide the service, subject to the restrictions in this policy.

Content extraction can use a workspace-configured external AI endpoint instead of local rules. When enabled, relevant message text is sent to that endpoint to extract the new-message content for your integration. This processing must be limited to that user-facing feature, with appropriate user consent and provider terms that prohibit advertising use and general-purpose AI training of Google data. Do not enable an endpoint that cannot meet these restrictions. Ask your workspace administrator which endpoint is configured before connecting a mailbox if you do not want this processing.

We do not allow human access to Google user data except with your affirmative agreement to view specific data, as necessary for security investigations or legal obligations, or for internal operations using aggregated data in accordance with applicable law. Other disclosures are limited to those permitted by Google's Limited Use requirements, including necessary security or legal disclosures. We do not share Google user data with advertising platforms, data brokers or surveillance services.

Storage and security

Mailthing stores account records, synchronized mailbox content, credentials, operation records and retained events in its server-side database. Mailbox credentials and OAuth tokens used for mailbox connections are encrypted using a separate credential keyring. Session cookies maintain sign-in, and a workspace-selection cookie remembers your console context. Access controls separate workspace data and limit integration actions. No storage or transmission system can be guaranteed completely secure.

The website includes Vercel Web Analytics to understand website usage. Browser preferences also remember your selected theme. Website analytics is separate from mailbox integration processing; mailbox content and Google account data are not provided for advertising or general-purpose model training. See Vercel's analytics privacy information for details about its usage measurement.

Retention and deletion

Retention depends on record type and configured settings. Workspace administrators control event and confirmed-deleted-content retention; operators control audit and upload retention. An initial mailbox import window is not a rolling deletion policy: older active messages and messages outside monitored folders can remain stored. Disabling a mailbox pauses integration activity; it is not a request to erase stored data.

An authorized workspace administrator can delete a connected mailbox account in Mailthing. This blocks further application access and queues cleanup of its stored messages, attachments, extractions, credentials and related integration records. Cleanup is asynchronous and can be delayed by provider cleanup failures or unresolved send outcomes whose evidence must be preserved. Limited deletion-ledger, audit or operation evidence may remain for security, reconciliation and legal obligations. We do not promise a fixed deletion deadline.

To request deletion of your Mailthing sign-in account or personal data, or help with mailbox deletion, email support@mailthing.app. We may need to verify your identity and authority over the affected data. Database deletion does not automatically erase backups: backup erasure is a separate manual process. Copies already delivered to recipients, workspace applications or webhook receivers are outside Mailthing's deletion controls.

Your choices and rights

You can revoke Google access through your Google Account connections. Revocation stops future authorized Google access but does not itself delete data already stored in Mailthing; request deletion separately as described above. Revoking Google sign-in is also separate from ending existing Mailthing sessions. Your workspace administrator can help manage mailbox access and integration settings.

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your personal information, object to or restrict processing, or complain to a data protection authority. Contact support@mailthing.app to exercise these rights. If your organization manages the workspace, we may coordinate with its administrator to address the request.

Changes to this policy

We will update this page and its revision date when this policy changes. Before using Google user data for a new purpose beyond the disclosed practices, we will notify affected users and obtain the consent required by Google's policies. See our Terms and Conditions for service-use obligations.