Privacy Policy

Last updated: October 7, 2026

This service ("MailAPI") lets you connect your own Gmail mailbox and use it through a personal API key. This policy describes how your Google user data is accessed, used, stored, and shared.

What we access

When you sign in, you grant MailAPI the Gmail scope https://www.googleapis.com/auth/gmail.modify plus basic profile scopes (openid, email). This allows the service to read your messages, send messages on your behalf, and manage labels in your mailbox, only when you (or someone holding your personal API key) request it.

How your data is used

Google user data obtained through the Gmail API is used solely to provide the user-facing features you request: listing, reading, sending, and organizing your own mail through the dashboard and the API. MailAPI complies with the Google API Services User Data Policy, including its Limited Use requirements.

MailAPI does not: sell your data, transfer it to third parties, use it for advertising or retargeting, use it to train AI or machine-learning models, or allow humans to read your mail, except where necessary for security investigations, to comply with law, or with your explicit consent.

What we store

In Cloudflare Workers KV storage we keep: your Google account ID, your email address, an encrypted copy of your OAuth refresh token (AES-256-GCM), a short-lived cached access token, and a SHA-256 hash of your API key (the key itself is stored encrypted so the dashboard can show it). Message contents are not stored; they are fetched from Google on request and returned to you directly.

Data retention and deletion

Nothing is kept after you delete your account. "Delete account" on the dashboard immediately revokes your Google OAuth grant at Google and deletes your stored record, keys, and tokens from our storage. You can also revoke access anytime at myaccount.google.com/permissions.

Security

The service runs on Cloudflare Workers. Google tokens are encrypted at rest, API keys are stored only as hashes, dashboard sessions use HttpOnly Secure cookies, and all traffic is served over HTTPS.

Contact

Questions about this policy or your data: pushkarsingh4343@gmail.com.