Privacy Policy

Last Updated: July 11, 2026

Este documento está disponível apenas em inglês. A versão em inglês é o texto oficial e rege o uso do serviço.

1. Introduction

MailBox Unjunker ("MailBox Unjunker," "we," "our," or "us") is an AI-powered Gmail organization service operated as an individual proprietorship from the United States. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.

By using MailBox Unjunker, you agree to this Privacy Policy and our Terms of Service.

2. Compliance with the Google API Services User Data Policy

MailBox Unjunker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve user-facing features that are prominent in the MailBox Unjunker interface (classifying and organizing your Gmail messages).
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read your Google user data, except: (a) with your explicit consent for specific messages; (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized so it cannot identify any individual user.
• We do not use Google user data to develop, improve, or train generalized or non-personalized AI and machine learning models. The OpenAI API we call to classify your messages also does not train models on data submitted through its API (see Section 6).

3. Information We Collect

3.1 Account Information

When you sign in with Google, we collect:

• Your Google email address and basic profile information (from the openid, email, and profile scopes).
• Your service preferences (cleanup method, prompt type, and any custom prompt text you choose to write).

3.2 Google OAuth Credentials

We store the OAuth access token and refresh token Google issues to MailBox Unjunker, along with the granted scopes and expiration timestamps. These tokens are encrypted with AES-256-GCM at the application layer before being written to our database, and are used only to call the Gmail API on your behalf. We never receive or store your Google password.

3.3 Email Metadata — What We Store

For each Gmail message we process, we store:

• The Gmail message ID — a non-content identifier such as 18c5f3a2b4d8e9f1 that cannot be used to reconstruct the email's subject, body, sender, or recipients.
• The classification result (for example, "junk", "keep", or "reserved").
• The number of OpenAI input and output tokens used for the classification call, for usage analytics.
• A processed-at timestamp.
• The latest Gmail historyId we have synced, so we know where to resume processing.
• Your Gmail watch expiration timestamp, so we can renew the watch before it lapses.

3.4 Email Content — What We Do NOT Store

We do not store the subject lines, bodies, headers, attachments, sender or recipient addresses, or any other content of your Gmail messages. Email content is read from Gmail at classification time, forwarded to the OpenAI API for classification (see Section 6), and discarded as soon as the classification result is returned. It is never written to our database, our log files, or any other persistent storage.

3.5 Feedback You Send Through the In-App Chat

The dashboard includes a feedback chat where you can send us product feedback, report a bug, or request a feature. If you use it, we store:

• The messages you type, and the assistant's clarifying replies, as a conversation transcript.
• Which dashboard page and tab you were on when you started the conversation (for example, /dashboard.html · AI Prompt).
• A short title, summary, and category derived from the conversation when you submit it.
• Your account email, so we can associate the submission with your account.

The messages you type are forwarded to OpenAI so the assistant can reply and so a summary can be produced when you submit (see Section 6). Our operators read these submissions — that is the purpose of the feature.

Please do not paste the contents of your emails, passwords, API tokens, or other secrets into the feedback chat. Unlike the classification pipeline, anything you type here is stored and read by a person. If you send us something by mistake, email [email protected] and we will delete it.

This is a separate, opt-in channel: it does not change what we do with your Gmail messages. Email content read by the classifier is still never stored (see Section 3.4).

4. How We Use Google User Data — Scope by Scope

MailBox Unjunker requests the following Google OAuth scopes. Each is used solely for the user-facing feature described.

• openid, email, profile — to identify the account you are signing in with and create or recognize your MailBox Unjunker account.
• https://www.googleapis.com/auth/gmail.modify — to read incoming messages so they can be classified; to create and manage the "JUNK" and "AI-OK" labels (and any other labels MailBox Unjunker applies) in your Gmail account; to apply or remove labels, mark messages as read, and move messages out of the inbox in accordance with your "cleanup method" preference; and to register a Gmail "watch" so that Google can notify MailBox Unjunker of new incoming messages in near real-time. We do not delete messages.

5. How We Use Your Information

We use the information we collect to:

• Provide the inbox-classification service (read incoming messages, classify them, and apply labels and other Gmail actions per your preferences).
• Maintain your account and preferences.
• Renew the Gmail watch registration before it expires, so that the service does not silently stop.
• Send transactional and service-related communications.
• Investigate abuse, fraud, or security incidents.
• Generate aggregated, non-identifying usage statistics.

6. Service Providers

We rely on the following service providers to operate MailBox Unjunker. Each of them processes data on our behalf under their own contractual data-protection obligations.

• Google (Gmail API and Cloud Pub/Sub): the source of incoming-mail notifications and the target of label, read-state, and archive actions. Subject to Google's Privacy Policy.
• OpenAI: we forward the subject and body of each incoming Gmail message to OpenAI's API (model gpt-4o-mini) over TLS, and we receive a JUNK / keep classification in return. We also forward the messages you send through the in-app feedback chat (see Section 3.5) to the same model, so the assistant can reply and summarize your submission. Per OpenAI's API data usage policy, content submitted through the API is not used to train OpenAI's models. OpenAI may retain API content for up to 30 days for abuse and misuse monitoring, after which it is deleted. MailBox Unjunker does not retain email content after the classification call returns; feedback transcripts you deliberately send us are retained as described in Section 9.
• Supabase: database hosting for the metadata described in Section 3. Data is encrypted at rest.
• DigitalOcean: application hosting (DigitalOcean App Platform).

7. Other Sharing and Disclosure

We do not sell or rent your personal information. We do not share Google user data for advertising or marketing purposes. We may share information when:

• Legal compulsion: we are required to do so by valid legal process, or to protect rights, property, or safety.
• Business transfer: in connection with a merger, acquisition, or sale of substantially all of our assets, in which case affected users will be notified.

8. Data Security

We implement industry-standard security measures, including:

• HTTPS/TLS for all data in transit.
• Application-layer AES-256-GCM encryption of Google OAuth tokens before they are written to the database, in addition to our database provider's at-rest disk encryption.
• Server-side database access only; OAuth tokens are never exposed to the browser.
• Session authentication via signed, HTTP-only cookies.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and the appropriate authorities as required by applicable law.

9. Data Retention

• Account information, preferences, and OAuth tokens: retained while your account is active.
• Processed-message metadata (message ID, classification result, token counts): retained while your account is active; used to avoid reclassifying the same message and to power usage analytics.
• Email content: not retained (see Section 3.4).
• Feedback conversations (see Section 3.5): retained while your account is active, and deleted together with the rest of your data when you delete your account. A conversation you start but never submit is deleted automatically within 7 days.

When you delete your account, we stop the Gmail watch, revoke the OAuth refresh token with Google, and delete your data from our database within 30 days, except where retention is required by law.

10. Your Rights and Choices

You can, at any time:

• Revoke Gmail access at https://myaccount.google.com/permissions. Revoking access in your Google account immediately disables MailBox Unjunker's ability to read or modify your Gmail.
• Delete your account from the MailBox Unjunker dashboard. This stops the Gmail watch, revokes the OAuth refresh token with Google, and deletes your data from our database.
• Request access, correction, or deletion of personal information by emailing [email protected].

Depending on where you live, you may have additional rights under laws such as the EU General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). You can exercise any of those rights by contacting us at the email above.

11. International Users

MailBox Unjunker is operated from the United States. By using the service, you understand that your information will be processed in the United States, where data protection laws may differ from those in your country.

12. Children's Privacy

MailBox Unjunker is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please email [email protected] and we will delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above and, for material changes, notify you by email or through the service. Your continued use of MailBox Unjunker after the changes become effective constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

MailBox Unjunker
Email: [email protected]
Website: www.mailboxunjunker.com