Privacy Policy
Last updated: August 14, 2026
This policy explains what data MailNet ("the Service", "we") accesses, what it stores, and what it never does with your information. MailNet is operated by an individual developer and exists to let you manage your own email with AI assistance. The short version: your email is processed to answer your requests, never sold, never used for advertising, and never used to train AI models.
1. Data we access
Account information
When you sign in with Google or Microsoft, we receive your name, email address, and profile picture to create your account.
Email data
With your explicit OAuth consent, the Service accesses your Gmail or Outlook mailbox to perform the actions you request: reading and searching messages, creating drafts, sending, labeling, and scheduling. Email content is fetched on demand, per request, and processed to fulfill that request.
Chat and usage data
Your conversations with the assistant, your settings and preferences, and basic technical logs (timestamps, request status, errors) are processed to operate the Service.
2. What we store
- OAuth tokens: stored encrypted (Fernet symmetric encryption; see the exact code). Access tokens live in your server-side session, which expires after 24 hours; a refresh token is stored encrypted so reconnects and scheduled actions work.
- Conversation history: your chat threads with the assistant, so you can revisit them. Email content quoted inside a conversation is part of that thread until the thread is deleted.
- Memory facts: short preference notes the assistant saves to personalize your experience (for example, who you usually CC). You can view and delete each one in Settings, Memories.
- Your API keys (optional): stored encrypted; never displayed back in full, removable at any time in Settings.
- Preferences: writing tone, default provider, approval settings, and similar configuration.
- Tester requests: if you request Gmail access, we store the email address you submit in order to add you as a tester and contact you.
We do not store a copy of your mailbox. Your email lives with your provider; the Service reads it through their APIs when you ask.
3. What we never do
- We never sell your data or share it with advertisers or data brokers.
- We never use your email content to train AI models.
- No human reads your email content, except with your explicit permission for debugging you request.
- We never send email from your account without an instruction from you (and, unless you enable auto-approve, your explicit confirmation).
4. AI processing and subprocessors
To answer your requests, relevant content is sent transiently to the following categories of processors:
- AI model providers: Google (Gemini) and Groq process the text of your requests and relevant email excerpts to generate responses. If you supply your own API key for a provider, your requests go to that provider under your key.
- Infrastructure: the Service runs on reputable cloud hosting and managed database providers, which store the data described above on our behalf and do not access it for their own purposes.
These providers process data to deliver the Service and are bound by their own security and privacy commitments.
5. Google API Limited Use disclosure
MailNet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide user-facing features you request, is never used for advertising, is never sold, and is never used to train generalized AI or machine-learning models.
6. Security
- All traffic is encrypted in transit with HTTPS (TLS).
- OAuth tokens and API keys are encrypted at rest; the encryption key is held only on the server.
- Application containers are not exposed directly to the internet; access passes through a hardened reverse proxy.
- Sensitive email actions require your in-chat confirmation unless you opt out.
No system is perfectly secure; the Service is an early-stage project and you use it with that understanding.
Verify, don't trust. MailNet is open source. You can read the encryption implementation, inspect how API keys are stored, and browse the full codebase to check any claim on this page.
7. Retention and deletion
- Sessions expire automatically after 24 hours.
- Threads and memories persist until you delete them in the app.
- Revoking access: you can disconnect MailNet at any time from your Google Account permissions or Microsoft account settings; this immediately invalidates the Service's access to your mailbox.
- Full deletion: email astroscoding@gmail.com and all data associated with your account (account record, tokens, threads, memories, keys) will be deleted within 30 days.
8. Your rights
Depending on where you live, you may have rights to access, correct, export, or erase your personal data, and to object to or restrict its processing. To exercise any of these, contact astroscoding@gmail.com. We honor such requests regardless of jurisdiction.
9. International transfers
The Service's infrastructure may be located in regions different from yours; by using the Service you consent to your data being processed in those regions with the protections described in this policy.
10. Children
The Service is not directed at children and may not be used by anyone under 16. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy as the Service evolves; the date above reflects the current version. Material changes will be visible on this page before they take effect.
12. Contact
Privacy questions or requests: astroscoding@gmail.com
← Back to sign in