InboxSift Privacy Policy

InboxSift asks you to sign in with Google. The OAuth request includes your basic Google profile (openid, email, profile) and Gmail read access (gmail.readonly). That mailbox access is what lets us load recent Inbox messages, open a thread in the overlay, classify mail, build Briefing, and — if you use it — draft Smart Reply.

We may access:

• Your Google account email and name
• Recent Gmail Inbox messages and, when you open one, the full thread (headers, snippet, body text/HTML)
• OAuth access and refresh tokens, so the extension can keep loading Inbox
• Extension settings, contact-handling preferences (Always Act / Know / Noise), and a local Briefing cache on your device

We do not request permission to send, delete, or modify Gmail messages. InboxSift does not replace Gmail as the place your mail is stored.

InboxSift processes email content to do its job. We do not claim that we never read your emails.

That processing is used to:

• Sort messages into Act, Know, or Noise
• Write Briefing lines (what to do or what to know)
• Show categories and contact handling in the overlay
• Draft a Smart Reply when you tap that feature

Gmail data is used to provide these InboxSift features — not to sell advertising, not to build a marketing profile, and not as a public dataset.

On your device. The overlay runs on mail.google.com. Preferences, per-sender handling, and a cache of classified inbox items are stored in Chrome extension storage locally.

On our servers. The extension calls our backend so we can talk to Gmail and run classification:

• GET /api/inbox-sift/inbox — fetches up to 100 recent Inbox messages through the Gmail API using your token
• GET /api/inbox-sift/thread — fetches a full thread (text and HTML) when you open it in InboxSift
• POST /api/inbox-sift/classify — sends sender, subject, snippet, a clipped body preview, and your contact-handling hints; we return Act / Know / Noise labels and Briefing text
• If you use Smart Reply, thread context is sent to our generate APIs so a model can propose a draft. We do not send the email for you.

We do not keep a copy of your mailbox. Inbox and thread responses are returned to the extension. Classification is request/response. OAuth tokens are stored so InboxSift can keep reading Gmail until you disconnect or revoke access.

• Google— sign-in and the Gmail API. Google's own terms and privacy policy apply to that access.
• OpenAI — our servers send the classification payload (and Smart Reply context, when you use it) to OpenAI so a model can return labels, Briefing lines, or a draft. That is email content leaving our servers to a processor. We do not sell it to them for ads.
• PostHog — the extension may send product analytics (feature use, errors). Those events are not full email bodies.

We do not sell, rent, or share your email content for advertising.

• Local extension data stays on your device until you clear it, reset InboxSift storage, or uninstall the extension.
• OAuth tokens stay until you disconnect Gmail or revoke InboxSift in your Google account.
• API requests are processed to return a result. We do not operate a long-term archive of your emails.

You can:

• Revoke InboxSift in your Google account (Security → Third-party access / Google Account permissions)
• Uninstall the Chrome extension
• Stop using Smart Reply; classification still requires mailbox read access

Revoking access or uninstalling stops new Gmail reads from InboxSift.

InboxSift is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

We may update this policy. The effective date at the top will change. If you keep using InboxSift after an update, you accept the revised policy.

Questions about this policy or InboxSift: superfalling12@gmail.com or the contact page.