Privacy policy.

1. Who we are

Inboxed is an open-source command-line and terminal-interface application maintained by Kryštof Marval and contributors. The project’s website is inboxed.fyi, and its source is available on GitHub. This policy describes the application as distributed by this project. Modified versions and extensions may behave differently.

2. Data Inboxed accesses and why

When you connect a mailbox and scan it, Inboxed accesses the information needed to organize messages:

• Account identity: your mailbox email address, provider, and local account alias, to associate scans and actions with the correct mailbox.
• Email content and metadata: senders, subjects, message text, dates, message identifiers, labels or flags, and attachment filenames, to classify messages, suggest tags, display previews, and review actions. Inboxed does not analyze attachment contents.
• Authentication information: Google access and refresh tokens, or the IMAP credentials you configure, to connect to your mail provider.
• Your decisions and settings: categories, model settings, approvals, rejections, edits, proposed actions, execution results, and error details, to save review history and apply your choices.

Scanning prepares proposals without changing the mailbox. When you grant write access and apply actions, Inboxed can create or apply labels, archive messages, or move messages to Trash. Optional automation only runs for the rules and approvals you configure.

3. Google permissions

Gmail authorization opens Google’s website in your browser. Inboxed receives OAuth tokens after your consent. It does not collect your Google password.

Granting write access does not itself apply any proposals. You choose when to apply changes. Read the Google Gmail scope descriptions for the full capabilities of each permission.

4. How local AI uses email data

Inboxed passes relevant message content and metadata to your configured local Ollama instance for classification and, if enabled, topic-tag suggestions. Supported built-in settings require a local loopback endpoint and reject models named with a :cloud suffix. Keep Ollama configured for local processing; Inboxed cannot control changes you make to Ollama, your network, or third-party extensions.

Previously approved examples from your local scan history may be included in future classification prompts. These examples can contain the sender, subject, and a short preview. This is inference for your email workflow. Inboxed does not train or fine-tune AI models on your messages, and it does not use Google user data to develop generalized AI or machine-learning models.

The app communicates directly with Google or your configured IMAP provider for mailbox operations. It has no project-hosted server for receiving your email content, model prompts, or OAuth tokens.

5. Local storage and security

Inboxed stores OAuth token files and a SQLite scan-history database in its local app data directory. The default on macOS is ~/Library/Application Support/inboxed; other operating systems use their standard application-data location. You can select a different location with --data-dir.

Saved runs include account identity, message identifiers, senders, subjects, message previews of up to 2,000 characters, classifications, proposed and executed actions, errors, and configuration snapshots. A short message may fit entirely within a saved preview. Message bodies are otherwise processed in memory and can be fetched again for viewing.

Configuration snapshots can include account settings. If you enter an IMAP password directly in the configuration, that password can also appear in saved runs. Prefer a password environment variable when configuring IMAP.

Token files and the database are created with owner-only file permissions on systems that support them. Run contents can optionally be encrypted with a password in Settings. Enabling this setting encrypts existing and future saved run contents, including previews and configuration snapshots, using authenticated Fernet encryption and an Argon2id-derived key. Run identifiers, creation times, and encryption metadata remain readable. The password and derived key are not saved to disk; a forgotten password cannot be recovered. History is decrypted in memory while unlocked. Turning encryption off requires the password and stores history without encryption. This setting does not encrypt the separate OAuth token or configuration files, existing backups, JSON exports, or old filesystem snapshots. Replacing the database cannot guarantee forensic erasure of earlier plaintext disk blocks. Protect your device, use operating-system disk encryption where appropriate, and consider what your local backup or sync tools include. Local Ollama logs and backups are controlled by your own setup.

6. Sharing, human access, and Google Limited Use

Inboxed does not sell or rent Google user data, use it for advertising, or send it to a hosted analytics service. Its built-in email workflow uses Google user data only to provide the email organization features you choose. Maintainers cannot read your local mailbox content or tokens through the app.

The normal recipients of the app’s requests are your mail provider and the local Ollama service on your computer. Their services are subject to their own policies and your configuration. Downloading dependencies and models may contact the corresponding package and model providers; these downloads do not require Inboxed to send them your email content.

Inboxed’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, credit decisions, data-broker services, or generalized AI training.

If you voluntarily send information in a bug report or support request, the maintainers can see what you share and use it to respond. GitHub issues are public. Do not include email content, passwords, tokens, or database files in public reports. Any human access to Google user data must be consistent with Google’s Limited Use requirements, including your affirmative agreement where applicable.

7. Retention, deletion, and your controls

Local scan history remains until you delete it; Inboxed does not impose an automatic expiration. Google tokens remain locally until removed or replaced and may become invalid if access is revoked.

1. Revoke Google access: remove Inboxed from your Google Account’s third-party connections. This stops Google authorization; it does not delete local history.
2. Remove a connected account: remove it in the TUI’s Accounts tab. This removes its local account entry, token file, and all saved runs for that account. Unlock encrypted history before removing an account.
3. Delete scan history: select and delete runs in the Runs tab. Removing a run does not undo mailbox actions already applied.
4. Remove all local app data: close Inboxed and delete its app data directory, plus any configuration files, exports, and backups you created. Also revoke Google access if you want the authorization removed.

Deleting local Inboxed data does not delete messages from Gmail or your IMAP provider. Messages moved to Trash remain subject to your provider’s retention rules. Local history deletion does not guarantee forensic erasure from storage devices or backups.

8. This website

The Inboxed website does not add analytics, advertising trackers, cookies, or mailbox sign-in forms. Fonts and page assets are served with the site. A visit to this website does not connect your mailbox.

The site is prepared for hosting on GitHub Pages. GitHub states that it logs visitors’ IP addresses for security purposes. DNS and any proxy services you enable through Cloudflare may also process connection information under their own policies. See the GitHub Privacy Statement and Cloudflare Privacy Policy. Following links to Google, GitHub, or other websites is subject to those websites’ policies.

9. Changes and contact

Policy changes will be published on this page with an updated effective date. Material changes to the app’s use of Google data require updated disclosures and consent where required before that new use begins.

For support or privacy questions, contact the maintainer through the Inboxed issue tracker. For a sensitive request, ask for a private contact route without posting the sensitive details. Because mailbox data is held locally, the maintainers cannot directly retrieve or delete it from your device; use the controls described above.