This Privacy Policy explains how Mail Sender ("Mail Sender", "we", "us") collects, uses, stores and shares information when you use the Mail Sender website, dashboard and connection service (the "Service"). By using the Service you agree to this policy.
1. Information we collect
Account information
- Email sign-up: your name, email address and a password. Passwords are stored only as a salted one-way hash (scrypt); we cannot read them.
- Sign in with Google: your name, email address, Google account identifier and profile picture URL (scopes
openid,email,profile).
Linked Gmail accounts
When you link a Gmail account, Google gives the Service OAuth access and refresh tokens for that account, together with its email address. See section 2.
Activity and technical data
- An activity log of actions taken in your workspace, for example sign-ins, accounts linked, searches, emails read, drafts created and emails sent. For mail actions the log records the account used, the search query or message subject, and recipient addresses. It does not record email bodies.
- The IP address and time of requests, used for security (for example to block repeated failed sign-ins).
- A session cookie that keeps you signed in. We do not use advertising or analytics cookies.
2. Google user data
To link a Gmail account, you approve access on Google's own consent screen. The Service requests the following permissions:
| Permission (scope) | Why we need it |
|---|---|
https://mail.google.com/ (read, compose, send and permanently delete email) | To show your mailbox and attachments, search, apply labels, mark read/unread, archive, move to Trash, permanently delete messages only when you choose "Delete forever", save drafts and send the emails you (or an assistant on your instruction and with your confirmation) choose to send. |
gmail.settings.basic | To show and update the Gmail settings you choose, including filters, conditional forwarding to an already verified address, signatures, sender identity, language, POP/IMAP and automatic replies. |
calendar.events | To show, create, edit and delete events on your primary Google Calendar when you use the Calendar page or ask the assistant to schedule something. |
openid, email, profile | Only when you choose "Continue with Google": to sign you in with your Google account. |
Email and calendar content is fetched from Google only at the moment you or your assistant request it, and is passed straight through to you or that assistant. The Service does not keep copies of email bodies or attachments. Messages are only deleted when you (or an assistant, after you confirm) ask for it.
3. How we use information
- To provide the Service: authenticate you, show your mailbox, and perform the email actions you request through the dashboard or your connected AI assistant.
- To keep the Service secure: prevent abuse and unauthorised access, and investigate incidents using the activity log.
- To communicate with you about your account when necessary.
We do not use your information or Google user data for advertising, we do not sell it, and we do not use it to train or improve artificial intelligence or machine-learning models.
4. Google API Services User Data Policy (Limited Use)
Mail Sender's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing features described in this policy.
- We transfer Google user data to others only when necessary to provide those features at your direction (for example, to the AI assistant you connected), to comply with applicable law, or as part of a merger or acquisition with notice to you.
- We do not use or transfer Google user data for serving advertisements, and we do not sell it.
- No person reads your email unless you give explicit consent for specific messages (for example, for support), it is necessary for security purposes such as investigating abuse, or it is required to comply with law.
- We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
5. AI features
Built-in assistant (Google Gemini)
When you use an AI feature in the dashboard (AI Assistant, Summarize, Draft a reply, Help me write, Refine, Schedule with AI), the text needed for that request, such as the email you are summarising, your instruction, search results or calendar entries, is sent to Google's Gemini API to generate the answer. This happens only when you use those features. The Service operates the Gemini API on a paid plan under Google's terms, under which inputs are not used to improve Google's models. Actions that send, delete or change data are only carried out after you confirm them.
AI assistants you connect
Your dashboard gives you a personal connection URL (MCP) and API key. When you add it to an AI assistant such as ChatGPT, Claude or Cursor, that assistant can request your email data through the Service on your instructions. Data sent to that assistant is then handled under that provider's own privacy policy and terms (for example OpenAI or Anthropic). Only connect assistants you trust. You can reset your connection URL at any time, which immediately stops the old one from working.
6. Sharing and service providers
We share information only as described here:
- Google, to authenticate you and to access Gmail on your behalf.
- Infrastructure providers that host the Service and its database (currently Render and Supabase), which process data only to operate the Service for us.
- Razorpay, our payment processor, when you buy a paid plan. You enter your payment details on Razorpay's own checkout; we never receive or store card numbers, UPI IDs or bank details. We keep only your plan, subscription status, renewal date and Razorpay subscription ID.
- Google Gemini API, only for the AI features you use, as described in section 5.
- AI assistants you connect, as described in section 5.
- Legal reasons: when required by law, or to protect the rights, safety and security of users and the Service.
7. Storage, security and retention
- Data is transmitted over HTTPS and stored in a managed database with restricted access.
- OAuth tokens for a Gmail account are kept until you disconnect that account or delete your Mail Sender account, then deleted.
- The activity log keeps your most recent events (up to a fixed limit) and older events are removed automatically.
- Account information is kept while your account exists and deleted when the account is deleted.
No method of transmission or storage is completely secure, but we use reasonable measures to protect your information.
8. Your choices and rights
- Disconnect any Gmail account from the dashboard to delete its stored tokens.
- Revoke the Service's access at any time at myaccount.google.com/permissions.
- Reset your AI connection URL from the dashboard.
- Access or delete your data, or close your account, by emailing us from your account's email address. We respond within 30 days.
Depending on where you live (for example under India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR), you may have additional rights such as correction or portability. Contact us to exercise them.
9. Children
The Service is not intended for anyone under 18 years of age, and we do not knowingly collect information from children.
10. Changes to this policy
We may update this policy. We will change the "Last updated" date above and, for significant changes, notify you in the dashboard or by email.
11. Contact
Questions or requests about privacy: skumartandon22@gmail.com