1. Introduction
InboxFlow ("we", "our", or "us") is an email management application that helps you organize, read, and delete emails connected to your mailbox. This Privacy Policy explains what data we collect, why we collect it, and how we protect it.
By using InboxFlow, you agree to the practices described in this policy.
2. Data We Collect
- Personal Information — email address, name — for account creation and authentication.
- Messages — email content, subject, sender, recipients — to display and manage your emails inside the app.
- Credentials — your mailbox (IMAP) app password, stored encrypted — to connect to your mailbox on your behalf.
- App Activity — search queries, filter usage, actions on emails — to provide app functionality.
- Device / Other IDs — advertising ID (via Google AdMob) — to show ads to free-tier users (no mailbox data used).
- App Performance — crash logs, error diagnostics — to improve app stability.
3. How We Use Your Data
- Email management: we access your mailbox to display, organize, mark as read, and delete (move to Trash) on your behalf.
- Sync: emails are temporarily stored on our secure servers to allow fast loading and offline access.
- Delete limits: we track the number of emails you delete per day to enforce free-tier and premium usage limits.
- Advertising: free-tier users may see ads served by Google AdMob, based only on non-mailbox signals; we never use your email content or metadata for ads.
- Push notifications: we use your device token to send notifications about new emails.
4. Data Sharing
We do not sell your personal data. We share data only with:
- Mailbox providers: we connect to your mailbox via IMAP using the credentials you provide, only to perform actions you initiate.
- Google AdMob: used to display ads in the free tier; no mailbox data is shared with AdMob.
- Google Firebase Cloud Messaging: used to deliver push notifications.
- Payment processors: premium subscriptions are handled by Google Play Billing. We do not store credit card information.
5. Data Storage and Security
- All data transmitted between your device and our servers is encrypted in transit using HTTPS / TLS.
- Your emails are stored on our server only as long as needed to provide the service.
- Mailbox credentials are encrypted at rest using AES-256-GCM, and encryption keys are stored separately from the data.
- API access is authenticated, and you can only access your own mailboxes and messages.
6. Data Retention
We retain your data for as long as your account is active. If you delete your account, all your data is permanently removed from our servers within 30 days.
7. Your Rights and Data Deletion
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and all associated data.
- Disconnect a mailbox at any time in the app.
When you disconnect a mailbox or delete your account, we delete the stored data and credentials, so the app no longer has access to your mailbox.
You can delete your account directly in the app, or email us at support@inboxflow.cloud with the subject "Delete my account". We will acknowledge your request within 7 business days, and all associated data will be permanently removed within 30 days. See our Account & Data Deletion page for full instructions.
8. Children’s Privacy
InboxFlow is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13.
9. Third-Party SDKs
- Google AdMob — advertising.
- Google Firebase (Cloud Messaging) — push notifications.
- Expo / React Native — app framework.
- Google Play Billing — in-app purchases.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top.
11. Contact Us
If you have any questions about this Privacy Policy, please contact us at: support@inboxflow.cloud