Privacy Policy

Effective date: 9 November 2026

This policy explains what data Inbox Reader (the "Service") handles when you use it, and how. It applies to the data you provide to read email accounts.

1. What we handle

• Account data you enter — the email address, OAuth refresh token, and client id you paste or save. These are used only to sign in to that mailbox and read its messages on your request.
• Mail content — messages are fetched live from the email provider to display to you. We do not store the content of your emails.
• Your Service account — if you register, your login email and a hashed password (we never store your password in plain text).

2. Quick read (no storage)

When you use Quick read, the account line you paste is used in memory to fetch the inbox once and is not saved to our database.

3. Saved accounts

If you log in and save mailboxes, the refresh tokens are encrypted at rest (AES-GCM) in our database and are decrypted only momentarily to read your mail when you request it. Tokens that the email provider rotates are re-encrypted and updated automatically. You can delete any saved account at any time, which removes its stored token.

4. What we do not do

• We do not sell or share your account data or tokens with third parties.
• We do not read your mail except to display it back to you in the Service.
• We do not use your mail content for advertising or profiling.

5. Third-party services

• Microsoft — sign-in and mailbox reading happen through Microsoft's OAuth and Microsoft Graph. Your use of the underlying account is subject to Microsoft's terms.
• Cloudflare — the Service is hosted on Cloudflare (Pages, Functions, and the D1 database). Standard hosting logs may apply.

6. Cookies

If you register and log in, we use a single session cookie (HttpOnly) to keep you signed in. We do not use advertising or tracking cookies.

7. Data retention and deletion

Quick read data is not retained. Saved accounts and your Service account remain until you delete them. Deleting a saved account removes its token from our database.

8. Security

We encrypt stored tokens and hash passwords. However, no system is completely secure; you use the Service at your own risk and are responsible for the credentials you choose to enter.

9. Changes and contact

We may update this policy; the effective date above will change. See also our Terms of Service.

For privacy questions, contact the Service operator. (Add your contact here.)