Email attachments — extracted from your connected Gmail and/or Outlook accounts. We only access messages that contain attachments. We do not read email bodies, contacts, or other mailbox content.
Account information — your name, email address, and OAuth tokens (stored securely, encrypted at rest).
Usage analytics — anonymized page views via Google Analytics (GTag).
Your data is used solely to provide the attachment extraction and storage service. We do not sell, share, or process your data for any other purpose.
Data is encrypted in transit (TLS 1.3) and at rest. Stored on Railway (PostgreSQL + ephemeral disk). OAuth tokens are refreshed automatically and never exposed client-side.
Retention follows your plan: Free (7 days), Starter (90 days), Pro (unlimited). An hourly auto-purge removes data past the retention window. You can request immediate deletion by contacting support.
We use Razorpay for payment processing (they receive your payment info, not us). Google and Microsoft provide OAuth authentication — we never see your email password.
You can sign out at any time (data persists for the retention grace period). To request full deletion, email support. You can revoke OAuth access at any time via your Google/Microsoft account settings.
Email: support@inboxark.com