Privacy Policy

1. What We Access

Gmailytics accesses your Gmail account through Google OAuth to provide email analytics. We only access email metadata, which includes:

• Sender email addresses and names
• Date and time emails were received
• Read/unread status
• Gmail labels (categories like Social, Promotions)

We never access, read, or store the actual content of your emails.

2. How We Use Your Information

We use the accessed metadata to:

• Generate email volume charts and trends
• Identify your top email senders
• Show daily email activity patterns and trends
• Categorize emails by type (work, personal, social, etc.)
• Perform actions you request: trash or archive emails
• Unsubscribe from newsletters on your behalf by sending requests to unsubscribe URLs found in email headers

3. Data Storage

We never store the content of your emails. We do not store email bodies, subject lines, or attachments. Here is what we do store:

Account information:

• Your email address and account creation date
• Aggregate cleanup statistics: total emails cleaned and total storage freed

Cleanup history:

• For each cleanup action you take (trash, archive), we store the sender email address, sender name, number of emails affected, and timestamp
• This allows you to view your cleanup history and undo actions across devices

Inbox snapshots:

• Aggregate statistics from each scan: total email count, storage used, unread count, number of unique senders, and email category breakdown
• These are summary numbers only — no individual email data is stored

Cached data:

• Your OAuth tokens are stored in httpOnly cookies in your browser and transmitted only over HTTPS
• Email metadata is fetched from Gmail's API and cached on our server so the dashboard loads without re-scanning your inbox every visit. This cache persists while your account is active and holds sender address, sender name, date, size, read status, category and unsubscribe link — never subject lines, message bodies or attachments. It is deleted in full when you delete your account.
• Your browser caches email metadata locally for faster loading — you can clear this anytime by disconnecting

In summary: we store your email address, cleanup action history (sender names and counts), aggregate inbox statistics, and a cache of email metadata that keeps the dashboard fast. We never store email content, subject lines, or attachments.

4. Data Sharing and Disclosure

We do not sell, rent, trade, or share your Google user data with any third parties. Specifically:

• We do not share your email metadata, cleanup history, or account information with advertisers, data brokers, or any other external parties
• We do not transfer your Google user data to third parties for their own purposes
• We do not use your Google user data for advertising, market research, or profiling
• Your Google user data is only used internally to provide and improve Gmailytics's core functionality as described in this policy

The only circumstances under which we would disclose your data are:

• If required by law, regulation, or valid legal process (e.g., a court order or subpoena)
• To protect the rights, safety, or property of Gmailytics, our users, or the public

5. Data Protection

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers uses HTTPS/TLS encryption
• Encryption at rest: Your stored data (account info, cleanup history, inbox snapshots) is held in a database with encryption at rest enabled
• Secure token storage: Your Google OAuth tokens are stored in httpOnly, secure, SameSite cookies — they are never exposed to client-side JavaScript or third-party scripts
• Minimal data collection: We only access the minimum data necessary to provide our service — email metadata, never email content or attachments
• No persistent email storage: Email metadata fetched from Gmail is processed in memory and temporarily cached for performance. It is not permanently stored on our servers
• Access controls: Database access is restricted to the application only, protected by environment-level credentials that are not exposed publicly

6. Third-Party Services

Gmailytics uses Google's Gmail API to access your email metadata. Your use of Gmailytics is also subject to Google's Privacy Policy and Terms of Service. We use the gmail.modify scope, which allows us to read email metadata and perform actions you explicitly request, such as trashing or archiving emails, and unsubscribing from newsletters using the List-Unsubscribe header. We never perform any actions on your emails without your direct instruction.

Gmailytics's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Ahrefs Analytics to collect anonymous usage data such as page views and feature usage. This helps us understand how the product is used and improve it. Ahrefs does not receive any of your email data or Gmail account information.

7. Data Retention

We retain your account data and cleanup history for as long as your account is active. If you request deletion of your account, we will delete all your stored data (account info, cleanup history, and inbox snapshots) within 30 days. Disconnecting from the dashboard clears all locally cached data from your browser immediately.

The server-side cache of email metadata (sender, date, size, read status, category and unsubscribe link — never subject lines or message content) persists while your account is active, because it is what lets the dashboard load without re-scanning your inbox on every visit. It is refreshed as you sync and removed entirely when you delete your account, which also revokes our access to your Google account.

8. Your Rights

You have full control over your data:

• Revoke access anytime through your Google Account settings at myaccount.google.com/permissions
• Disconnect from Gmailytics to clear all locally cached data
• Request complete deletion of your account and all stored data (account info, cleanup history, and inbox snapshots) by contacting us at jacob@gmailytics.com

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

10. Contact Us

If you have any questions about this Privacy Policy, your data, or security concerns, contact us at jacob@gmailytics.com.