Privacy Policy

Last updated: August 14, 2026

This policy explains what data MailNet ("the Service", "we") accesses, what it stores, and what it never does with your information. MailNet is operated by an individual developer and exists to let you manage your own email with AI assistance. The short version: your email is processed to answer your requests, never sold, never used for advertising, and never used to train AI models.

1. Data we access

Account information

When you sign in with Google or Microsoft, we receive your name, email address, and profile picture to create your account.

Email data

With your explicit OAuth consent, the Service accesses your Gmail or Outlook mailbox to perform the actions you request: reading and searching messages, creating drafts, sending, labeling, and scheduling. Email content is fetched on demand, per request, and processed to fulfill that request.

Chat and usage data

Your conversations with the assistant, your settings and preferences, and basic technical logs (timestamps, request status, errors) are processed to operate the Service.

2. What we store

• OAuth tokens: stored encrypted (Fernet symmetric encryption; see the exact code). Access tokens live in your server-side session, which expires after 24 hours; a refresh token is stored encrypted so reconnects and scheduled actions work.
• Conversation history: your chat threads with the assistant, so you can revisit them. Email content quoted inside a conversation is part of that thread until the thread is deleted.
• Memory facts: short preference notes the assistant saves to personalize your experience (for example, who you usually CC). You can view and delete each one in Settings, Memories.
• Your API keys (optional): stored encrypted; never displayed back in full, removable at any time in Settings.
• Preferences: writing tone, default provider, approval settings, and similar configuration.
• Usage events: counts of what happens in the app (a message was sent, which AI provider answered it and how long it took, a tool ran, an approval was accepted or declined, a memory was saved), tied to your account id. They never contain message text, email content, subjects or addresses. They are used only to keep the Service running and to understand which features are used, and are deleted automatically after 90 days.
• Tester requests: if you request Gmail access, we store the email address you submit in order to add you as a tester and contact you.

We do not store a copy of your mailbox. Your email lives with your provider; the Service reads it through their APIs when you ask.

3. What we never do

• We never sell your data or share it with advertisers or data brokers.
• We never use your email content to train AI models.
• No human reads your email content, except with your explicit permission for debugging you request.
• We never send email from your account without an instruction from you (and, unless you enable auto-approve, your explicit confirmation).

4. AI processing and subprocessors

To answer your requests, relevant content is sent transiently to the following categories of processors:

• AI model providers: NVIDIA, Groq, and Google (Gemini) process the text of your requests and relevant email excerpts to generate responses; NVIDIA also powers the semantic memory feature described below. If you supply your own API key for a provider, your requests go to that provider under your key.
• Infrastructure: the Service runs on reputable cloud hosting and managed database providers, which store the data described above on our behalf and do not access it for their own purposes.

These providers process data to deliver the Service and are bound by their own security and privacy commitments.

Semantic memory is on by default: the Service extracts durable facts from your conversations (such as recurring contacts and standing preferences) and stores them to personalize future replies. You can pause memory, or view and delete individual facts or all of them, at any time in Settings, Memories.

5. Google API Limited Use disclosure

6. Security

• All traffic is encrypted in transit with HTTPS (TLS).
• OAuth tokens and API keys are encrypted at rest; the encryption key is held only on the server.
• Application containers are not exposed directly to the internet; access passes through a hardened reverse proxy.
• Sensitive email actions require your in-chat confirmation unless you opt out.

No system is perfectly secure; the Service is an early-stage project and you use it with that understanding.

7. Retention and deletion

• Sessions expire automatically after 24 hours.
• Threads and memories persist until you delete them in the app.
• Usage events are deleted automatically 90 days after they are recorded.
• Revoking access: you can disconnect MailNet at any time from your Google Account permissions or Microsoft account settings; this immediately invalidates the Service's access to your mailbox.
• Full deletion: email astroscoding@gmail.com and all data associated with your account (account record, tokens, threads, memories, keys, usage events) will be deleted within 30 days.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or erase your personal data, and to object to or restrict its processing. To exercise any of these, contact astroscoding@gmail.com. We honor such requests regardless of jurisdiction.

9. International transfers

The Service's infrastructure may be located in regions different from yours; by using the Service you consent to your data being processed in those regions with the protections described in this policy.

10. Children

The Service is not directed at children and may not be used by anyone under 16. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy as the Service evolves; the date above reflects the current version. Material changes will be visible on this page before they take effect.

12. Contact

Privacy questions or requests: astroscoding@gmail.com