Privacy Policy

Mail Clear reads your unread email messages, classifies them by priority, and delivers a digest to your inbox. It does not send, delete, move, or modify any email. It does not impersonate you.

When you connect Gmail, Mail Clear requests the following OAuth scope:

This scope allows Mail Clear to:

• List your unread message IDs
• Read the content of those messages

This scope does not allow Mail Clear to send email, delete email, move or label messages, or access any Google service outside Gmail. This is enforced at the API layer by Google — not a setting we configured, but a capability that does not exist in the credential.

Email content is processed in memory and never written to disk or database.

• Email subject lines, sender addresses, and body text are loaded into server memory during a run
• This content is passed to an AI classification model (OpenAI API) for categorization
• After the digest is assembled and sent, all in-memory email content is discarded
• No email body, subject line, or sender name is stored in our database at any time

What we do store:

• Your account email address
• Your preferences (timezone, run schedule, digest settings)
• Execution logs: timestamp, count of emails processed, category counts — no message content
• Your OAuth refresh token, encrypted at rest, used only to obtain new read-only access tokens

Email content is sent to OpenAI's API for classification. OpenAI's API terms prohibit training on API-submitted data. No email content is retained by OpenAI beyond the duration of the API call.

• Email content: never stored, discarded after each run
• Execution logs: retained for 90 days
• OAuth tokens: retained until you disconnect Gmail or delete your account
• Account data: retained until you delete your account

You can disconnect Mail Clear from Gmail at any time:

• In Mail Clear: Settings → Disconnect Gmail
• At Google: myaccount.google.com → Security → Third-party apps with account access → Mail Clear → Remove access

Revocation is immediate and complete at Google's layer. No action from Mail Clear is required.

We do not sell your data. We do not share your data with third parties except:

• OpenAI API: email content for classification (not retained, not used for training)
• Resend: your email address, to deliver your digest
• Supabase: database and authentication infrastructure
• Vercel: hosting infrastructure

• All data encrypted in transit (TLS) and at rest
• OAuth tokens encrypted in database storage
• Mail Clear uses magic link authentication — no passwords are ever transmitted to or stored by Mail Clear
• Read-only OAuth scope prevents any write operation at the API layer

Mail Clear is not directed at children under 13. We do not knowingly collect data from children under 13.

We will update this page when our practices change. The effective date at the top reflects the most recent revision.