Privacy policy

Effective September 19, 2026. Postbox is a personal-use email assistant operated by its owner, not a public email service.

Data and purpose

With authorization, Postbox reads connected Gmail or Microsoft email messages and basic account identity. It uses message text and metadata to identify possible action items, subscription evidence and sorting suggestions. It does not request permission to send, delete or modify messages.

Processing and storage

The application runs on Cloudflare Workers. Message text is sent to Cloudflare Workers AI for analysis. The application stores derived findings, source message identifiers and links, account identity, review progress and encrypted connection tokens in Cloudflare D1. Full message bodies are processed transiently rather than stored in the application database. Findings can contain personal information derived from messages.

The dashboard is restricted to the owner's approved login. Personal and family mailbox findings are labeled separately within that dashboard; they are visible to the same dashboard owner.

Use and disclosure

Data is used to provide the owner's email review features. The application does not sell email data, use it for advertising, or expose it to other dashboard users. Google and Microsoft supply the connected mailbox APIs; Cloudflare provides hosting, storage and AI processing.

Postbox's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Retention and control

Stored findings and connection records remain until removed by the operator; automatic retention deletion is not currently implemented. You can revoke authorization in your Google or Microsoft account settings to stop future access. Revocation does not itself erase previously stored findings. The operator can remove those records from the application's Cloudflare database. This personal-use application is administered by its owner through the same Google, Microsoft and Cloudflare accounts used to set it up.