Privacy Policy
OneInbox shows all your mailboxes in one place, so your privacy is the product. This policy explains what we collect, why, and the rules we hold ourselves to. It sits alongside our Terms of Service.
1. Information we collect
We collect different types of information to provide and improve the service:
- Personal information: name, email address, phone number, or other details you provide when signing up or using the service.
- Mail data: when you connect a mailbox, we sync a rolling window of recent messages so we can show them in your unified inbox and send the replies you write. Your originals always remain in your mailbox at your provider.
- Usage data: information about how you access and use the service, including IP address, browser type, pages visited, and time spent on pages.
- Cookies and tracking data: cookies or similar technologies to track activity and improve the user experience.
2. How we use your information
We use the data we collect to provide and maintain the service, send updates or announcements, analyze usage to improve features and performance, and ensure security while preventing unauthorized access.
3. Data sharing and disclosure
Your data is never sold or rented.
We may share information with trusted service providers who help us operate the service, such as hosting or analytics platforms. We may also disclose information when required by law or in response to legal requests, or during business transfers like mergers or acquisitions.
4. Google API Services and your Gmail data
If you connect a Gmail account, OneInbox accesses your Gmail data through Google API Services solely to provide the features you use: showing your mail inside your unified inbox, keeping read and archive state in sync, and sending the replies you write.
OneInbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms: we never sell your Gmail data, never use it for advertising, and never let humans read it, except with your explicit permission, for security purposes, or where required by law. If you ask for an AI summary, that conversation is sent to our AI provider only to generate the summary and is not used to train AI models. Synced Gmail messages follow the retention window described below, and disconnecting your account removes its synced mail from OneInbox.
5. How we protect your data
Sensitive data, including your Gmail data, is protected with specific technical mechanisms:
- Encryption in transit: every connection between your device and OneInbox, and between OneInbox and your mail providers, uses TLS. Mail is never fetched or sent over unencrypted connections.
- Encryption at rest: mailbox passwords and OAuth refresh tokens are encrypted with AES-256-GCM using a dedicated application key held outside the database, and all stored message data and backups sit on infrastructure encrypted at rest with AES-256.
- Access controls: every request is authenticated and limited to the signed-in user's own records, row-level security isolates each customer's data, and production access is restricted to authorized personnel.
- Key management: encryption keys live in the hosting platform's secret manager, never in source code.
- Incident response: if a breach affects your personal data we will notify you without undue delay, consistent with applicable law including the Australian Notifiable Data Breaches scheme.
- Secure deletion: disconnecting an account removes its credentials and synced mail from active systems, and residual copies age out of encrypted backups on a fixed schedule.
6. Data retention
We keep your personal information only as long as necessary for the purposes described in this policy or as required by law. Synced mail is kept on a rolling window per connected account, and disconnecting an account removes its synced mail from OneInbox.
Once data is no longer needed, it is securely deleted or anonymized.
7. Your data protection rights
Depending on your location, you may have the right to access, update, or delete your personal information, withdraw consent for processing, or file a complaint with a data protection authority.
To exercise these rights, contact us at ross@tryoneinbox.co.
8. Changes to this privacy policy
This privacy policy may be updated from time to time. Changes will be posted on this page, along with an updated "Last updated" date. We encourage you to review this policy periodically.
9. Contact us
If you have questions or concerns about this privacy policy, please contact us at:
Email: ross@tryoneinbox.co
Tel: 0400 369 865
Address: 802/237 Adelaide Terrace, East Perth WA 6004, Australia