Mailroid ("we", "our", "us") provides an AI-powered productivity layer on top of Gmail and Google Calendar. This policy explains what data we access, why we access it, and how it is stored and used.
1. Information We Access
When you connect your Google account, Mailroid requests access to:
- Your basic profile — name, email address, and profile picture, used to identify your account.
- Gmail messages and metadata — senders, recipients, subject lines, timestamps, message content, labels, and read/unread state. Mailroid reads this data to show your mail, and uses the access you grant to send email and to change message state (for example labels, read status, or moving a message to Bin) when you do so in the app.
- Google Calendar events — event titles, times, attendees, and descriptions, used to show your schedule, find available times, and create, update, or cancel events (including Google Meet links and invitations to attendees) when you do so or approve it.
We also store information you give Mailroid directly, such as:
- your answers to the priority-personalization questions and your settings;
- scheduling preferences you save (for example working hours or meeting rules);
- your conversations with the AI assistant;
- feedback you submit.
We access Google data only through Google's official Gmail API and Calendar API, using OAuth 2.0. We never ask for or store your Google password.
2. How We Use Your Data
- Syncing and displaying your inbox and calendar inside Mailroid. To do this, Mailroid keeps a synced copy of your messages and events in its database.
- Maintaining real-time sync via Gmail/Calendar push notifications ("watch"), so new messages and events appear without manual refreshing.
- Search, including search by meaning using AI-generated search embeddings (see Section 3).
- Prioritizing your inbox, generating summaries and daily briefings, and helping you write emails, using the AI processing described in Section 3.
- Scheduling, rescheduling, and cancelling meetings, and keeping track of which email thread a meeting belongs to.
- Providing an AI assistant that can read your inbox and calendar to answer your questions, and can propose actions on your behalf. The assistant cannot send email or create, change, or cancel calendar events until you approve that specific action.
- Recording usage of AI features (for example, how many AI requests were made) to operate usage limits and show you your usage.
3. AI Processing
Mailroid's AI features are powered by OpenAI. Depending on the feature, the following is sent to OpenAI:
- Priority classification — the sender (name and email address), subject, and a short snippet of each incoming message, together with your personalization answers. This runs automatically as mail arrives.
- Search indexing — the subject and body text of your messages, used to create search embeddings that are stored in our database, and the text of your searches when you search by meaning. This text is sent without masking personal identifiers.
- Summaries and writing assistance — the relevant message or thread content. Before it is sent, Mailroid replaces detected personal identifiers (such as email addresses, phone numbers, and card numbers) and detected secrets (such as one-time codes) with placeholders. Detection is automated and may not catch every instance.
- AI assistant and daily briefings — your requests, and the email and calendar information the assistant retrieves to answer them.
- Feedback — feedback you submit may be sent to OpenAI to categorize and evaluate it.
We do not use your data to train AI models. Data sent to OpenAI is handled under OpenAI's API terms, including its own retention practices.
AI output may be inaccurate. Mailroid does not send AI-generated email or make AI-generated calendar changes on your behalf unless you explicitly send or approve the action.
4. Google User Data
For data Mailroid receives from Google APIs:
- We use it only to provide the Mailroid features described in this policy.
- We do not sell it, and we do not use it for advertising.
- We do not use it to train AI models.
- We transfer it only to the service providers listed in Section 6, as needed to provide these features, or where required by law.
5. Data Storage and Security
Your data is stored in a PostgreSQL database running on our own server. The database is not exposed to the public internet. OAuth access and refresh tokens are encrypted before they are stored, and are used only to make authorized API calls to Google on your behalf.
Other stored data — including synced email content, calendar data, search embeddings, summaries, and assistant conversations — is not encrypted by Mailroid at the application level.
Connections to Mailroid use HTTPS. We also apply safeguards such as sanitizing HTML email before it is displayed, screening email content for prompt-injection attempts before AI processing, rate limiting, and verifying notifications received from Google. No method of storage or transmission is completely secure.
We keep operational logs to run and troubleshoot the service. Before logs are sent to our monitoring provider, they are processed to remove message content and replace email addresses.
6. Data Sharing
We do not sell your data. We share data only with the providers necessary to operate Mailroid, each bound by their own terms:
- Google — Gmail and Google Calendar, where your data originates and where actions you take are carried out.
- OpenAI — AI processing, as described in Section 3.
- Our server hosting provider — hosts the server and database that run Mailroid.
- Inngest — runs Mailroid's background jobs, such as mailbox sync and classification. As part of this, it receives and keeps in its job history some message data, including the sender, subject, snippet, and labels of incoming messages being classified.
- Grafana Cloud — receives the redacted operational logs described in Section 5.
7. Cookies
Mailroid uses cookies only to sign you in with Google and keep you signed in. We do not use analytics or advertising cookies, and we do not use third-party tracking. Some interface state may be kept in your browser's local storage.
8. Revoking Access
You can remove Mailroid's access to your Google account at any time via Google Account Permissions. This stops Mailroid from reading new data or acting on your account. It does not, on its own, delete data Mailroid has already stored — see Section 9.
9. Data Retention and Deletion
We retain your synced data, and the data derived from it (such as priority labels, summaries, search embeddings, and assistant conversations), for as long as your Mailroid account exists, including after you revoke Google access. To have your data deleted, contact us (Section 10) and we will delete the associated data from our systems within a reasonable time.
10. Contact
Questions about this policy or requests regarding your data can be sent to agarwalshriyansh007@gmail.com.
11. Changes to This Policy
We may update this policy as Mailroid evolves. Material changes will be reflected by updating the "Last updated" date above.