InboxSift Privacy Policy

InboxSift's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

InboxSift limits its use of Google user data to providing or improving user-facing features that are prominent in the InboxSift interface: inbox classification (Act / Know / Noise), Briefing, contact-handling preferences, opening a thread in the overlay, and optional Smart Reply drafts.

InboxSift does not use Google Workspace APIs, Gmail data, or any Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models.

InboxSift does not use Google user data for any of the following:

• Targeted, personalized, retargeted, interest-based, or other advertising
• Selling data to data brokers or providing it to information resellers
• Determining credit-worthiness or lending
• Creating databases unrelated to providing InboxSift to you
• Training non-personalized AI and/or ML models (ours or a third party's)

InboxSift asks you to sign in with Google. The OAuth request includes your basic Google profile (openid, email, profile) and Gmail read access (gmail.readonly). That mailbox access is used only to load recent Inbox messages, open a thread in the overlay, classify mail, build Briefing, and — if you use it — draft Smart Reply.

We may access:

• Your Google account email and name
• Recent Gmail Inbox messages and, when you open one, the full thread (headers, snippet, body text/HTML)
• OAuth access and refresh tokens, so the extension can keep loading Inbox
• Extension settings, contact-handling preferences (Always Act / Know / Noise), and a local Briefing cache on your device

We do not request permission to send, delete, or modify Gmail messages. InboxSift does not replace Gmail as the place your mail is stored.

Email content is processed only to operate InboxSift for you. That processing is used to:

• Sort messages into Act, Know, or Noise
• Write Briefing lines (what to do or what to know)
• Show categories and contact handling in the overlay
• Draft a Smart Reply when you tap that feature

Models that classify mail or draft a reply run per request to produce that result for you. They are not used to train a general model on your mailbox.

On your device. The overlay runs on mail.google.com. Preferences, per-sender handling, and a cache of classified inbox items are stored in Chrome extension storage locally.

On our servers. The extension calls our backend so we can talk to Gmail and run classification:

• GET /api/inbox-sift/inbox — fetches up to 100 recent Inbox messages through the Gmail API using your token
• GET /api/inbox-sift/thread — fetches a full thread (text and HTML) when you open it in InboxSift
• POST /api/inbox-sift/classify — sends sender, subject, snippet, a clipped body preview, and your contact-handling hints; we return Act / Know / Noise labels and Briefing text
• If you use Smart Reply, thread context is sent to our generate APIs so a model can propose a draft. We do not send the email for you.

We do not keep a copy of your mailbox. Inbox and thread responses are returned to the extension. Classification is request/response. OAuth tokens are stored so InboxSift can keep reading Gmail until you disconnect or revoke access.

InboxSift does not transfer Google user data to third parties except to provide or improve InboxSift's user-facing features, for security, to comply with law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.

• Google— sign-in and the Gmail API. Google's own terms and privacy policy apply to that access.
• OpenAI — our servers send the classification payload (and Smart Reply context, when you use it) so a model can return labels, Briefing lines, or a draft for you. That transfer is only to provide those InboxSift features. We do not authorize OpenAI to use Google user data to train generalized or non-personalized models, and we do not sell Gmail data to them for advertising.

Product analytics (feature use, errors) may go to PostHog. Those events do not include Gmail message bodies, subjects, or other Restricted Scope Google user data.

We do not sell, rent, or share Google user data for advertising, data brokerage, or credit/lending.

InboxSift personnel do not read your Gmail messages or other Google user data unless: you give affirmative agreement to review specific messages; it is necessary for security (for example, investigating a bug or abuse); it is necessary to comply with applicable law; or the data is aggregated and used only for internal operations in accordance with applicable law.

Gmail API traffic uses HTTPS. OAuth tokens are stored so the extension can keep reading Inbox and are not used for unrelated products. Access to production systems is limited to operating InboxSift.

• Local extension data stays on your device until you clear it, reset InboxSift storage, or uninstall the extension.
• OAuth tokens stay until you disconnect Gmail or revoke InboxSift in your Google account. After revoke or disconnect, InboxSift stops new Gmail reads.
• API requests are processed to return a result. We do not operate a long-term archive of your emails. You may email us to request deletion of account-related data we still hold (such as stored tokens).

You can:

• Revoke InboxSift in your Google account (Security → Third-party access / Google Account permissions)
• Uninstall the Chrome extension
• Stop using Smart Reply; classification still requires mailbox read access

Revoking access or uninstalling stops new Gmail reads from InboxSift.

InboxSift is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

We may update this policy. The effective date at the top will change. If we change how InboxSift uses Google user data, we will notify users and obtain consent before using that data in a new way.

Questions about this policy or InboxSift: superfalling12@gmail.com or the contact page.