InboxIQ

Privacy Policy

Last updated: September 5, 2026

Privacy Standard

InboxIQ handles potentially sensitive emails. We strictly adhere to privacy-minimization principles: we do not warehouse raw email bodies in our application database.

1. Information We Collect

When you use InboxIQ, we collect:

  • Account Identity: Your name, email address, and authentication ID provided via Clerk.
  • Google OAuth Authorization: Encrypted refresh tokens granting scoped access to Gmail (read/send) and Google Drive (file archival).
  • Operational Metadata: Execution timestamps, report generation statuses, error categories, and schedule preferences.

2. How We Process Email Content

During scheduled morning executions, our backend/automation engine queries Gmail API for emails received within your 24-hour reporting window. Email snippets are passed transiently to Google Gemini AI models strictly to classify priority, deadlines, and action items. Email contents are not permanently stored in our database.

3. Security & Token Encryption

All Google OAuth refresh tokens are encrypted at rest using AES-256-GCM. Decryption keys are stored strictly in server-side environment variables and are never transmitted to client browsers, logs, or third parties.

4. Data Deletion & Disconnection

You can disconnect any linked Google account at any time from your account settings. Upon disconnection, the associated encrypted authorization tokens are immediately deleted from our database.