QuietMail

Privacy Policy

Last updated: August 7, 2026

1. Overview

QuietMail is a subscription service that filters unwanted email out of Gmail inboxes you connect, using rules you configure. This page describes exactly what data QuietMail accesses, how it flows through the system, what is stored, and how to delete it. It is written to match how the product actually works.

2. Google user data we access

When you connect a Gmail inbox, QuietMail requests the https://www.googleapis.com/auth/gmail.modify scope (plus your email address to identify the inbox). We use exactly these capabilities of that scope, each for one reason:

  • Read messages — to filter mail we must read it. QuietMail lists unread inbox messages from the last 30 days (at most 25 per run) and fetches each new one's headers (From, Subject, Date) and body text, truncated to the first 12,000 characters.
  • Modify labels — to carry out the action you chose: "mark as read" removes the UNREAD label; "move to spam" adds the SPAM label and removes INBOX. The optional "tidy old unread" cleanup also removes the UNREAD label from unread inbox mail older than 30 days.
  • Trash messages — only if you chose "move to trash" as your action. Trashed messages remain recoverable in Gmail for about 30 days; QuietMail never permanently deletes mail.
  • Mailbox change notifications — QuietMail registers a Gmail push watch so filtering runs promptly when new mail arrives. These notifications from Google contain only your email address and a history id — no message content.

QuietMail never sends email on your behalf, never reads your contacts, drafts, or attachments as files, and never touches mail outside your inbox's unread messages (plus the specific messages it acts on).

3. How your email is processed, step by step

  1. An unread message arrives in a connected inbox. Filtering runs on a schedule (about every 5 minutes) and when Google's push notification nudges us.
  2. QuietMail fetches the message's headers and body (capped at 12,000 characters) from the Gmail API over TLS.
  3. The sender, subject, date, message ids, and capped body are sent to our AI subprocessor (OpenAI) together with your filtering rules, solely to answer one question. The model is given no tools and no access to your mailbox; its only possible output is a single yes/no answer ("does this message match the user's rules?") in a strict JSON schema.
  4. Our own deterministic code — never the AI — then performs the one action you configured (mark read, move to spam, or trash), or does nothing if the message didn't match.
  5. An audit log entry is written recording only the sender address, subject line, the yes/no decision, and the action taken.

Message bodies are never stored in our database, never written to logs, and never used to train AI models.

Bodies exist in our systems only transiently, in memory, for the seconds a classification takes. If anything fails before an action is taken, QuietMail fails closed: no action is performed. Per OpenAI's API terms, data sent to the OpenAI API is not used to train their models by default, and we have not opted in to any data sharing.

OpenAI may retain API inputs and outputs for up to 30 days for abuse and misuse monitoring, after which they are deleted unless retention is required by law or is reasonably necessary to protect OpenAI's services or others from harm; this data is not used for training. We do not use OpenAI's optional request-storage features, so classification requests are not otherwise persisted on OpenAI's side.

4. What we store, and how it's protected

Our database stores only:

  • Your account email address and optional display name (from sign-in).
  • For each connected inbox: its Gmail address and a Gmail OAuth refresh token encrypted with AES-256-GCM (a 256-bit key held only in our server environment; tokens are decrypted only in memory at run time and are never logged).
  • The audit log: sender address, subject line, decision, and action per filtered message — never message bodies.
  • A list of already-processed Gmail message ids (bookkeeping so no message is classified twice).
  • Your filtering settings (presets, custom rules, whitelist, chosen action).
  • Your support-chat history with our in-app assistant (see section 5).
  • Subscription state: Stripe customer and subscription ids, plan, and status. Card details never touch our servers — Stripe holds them.
  • Session and sign-in tokens, stored only as hashes.

The application runs on Vercel and the database is Neon Postgres; both encrypt data at rest, and all connections — to Google, OpenAI, Stripe, and between our own components — use TLS. Sessions use httpOnly secure cookies. Application logs never contain message bodies, tokens, or credentials.

5. Who we share data with

We never sell your data, never use it for advertising, and no human reads your message content in the ordinary course of operating the service. We share data only with the subprocessors needed to run QuietMail, each receiving only what its function requires:

  • Google — sign-in (OAuth) and the Gmail API itself.
  • OpenAI — receives message metadata and the capped body for the yes/no classification described above, and the messages you type into the in-app support chat (which are also stored so the conversation has context). API data is not used for model training by default.
  • Stripe — billing; holds your payment details and email.
  • Vercel — application hosting.
  • Neon — Postgres database hosting.
  • Mailgun — sends transactional email such as sign-in links; receives your email address and the message we send you.

6. Retention & deletion

  • Disconnecting an inbox deletes the inbox record immediately, including its encrypted refresh token, its entire audit log, its processed-message bookkeeping, and any per-inbox settings.
  • Deleting your account (Settings → Delete account) cancels any active Stripe subscriptions, deletes your Stripe customer record, and deletes your user row — which cascades to all inboxes, encrypted tokens, audit logs, settings, chat history, and sessions.
  • You can also revoke QuietMail's Gmail access at any time at myaccount.google.com/permissions; QuietMail then loses all access to that mailbox and will prompt you to reconnect or disconnect it.
  • Data listed in section 4 is kept while the associated inbox or account exists and is deleted as described above; we do not keep our own backups of message content, because we never store it.

7. Google API Limited Use disclosure

QuietMail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Gmail data is used only to provide the user-facing filtering feature described above, is never transferred except to the subprocessors listed in section 5 as necessary to provide that feature, is never used for advertising, and is never read by humans except with your explicit consent for support, when required for security purposes, or to comply with applicable law.

8. Changes & contact

If this policy changes materially, we will update this page and its date. For privacy questions or data requests, use the in-app support chat or write to privacy@quietmail.app.