1. Who we are

InboxZero is a Chrome extension built by an independent developer. The extension helps Gmail users organise and clean their inbox using AI-powered email clustering. For questions about this policy, contact us at hello@inboxzero.app.

2. What data we access

InboxZero accesses your Gmail account through the official Google Gmail API using OAuth 2.0. We request the following permissions:

We access email metadata only when you click the Scan button. We do not monitor your inbox in the background or access emails automatically.

3. How we process your data

Email subject lines and sender names are sent to the Claude AI API (operated by Anthropic, Inc.) for classification into clusters. This is the only external service that receives any part of your email data.

Specifically:

• We send: email subject lines and sender names (no body content, no attachments)
• Anthropic receives this data to perform classification and returns cluster labels
• Anthropic's privacy policy applies to this processing: anthropic.com/privacy
• If you have not configured a Claude API key, all clustering is done locally in your browser using keyword matching — no data is sent externally

Cluster results are cached temporarily in your browser's local storage (Chrome Storage API) to avoid repeated API calls. This cache is stored on your device only and is cleared when you disconnect the extension.

4. What we store

• On your device (Chrome Storage): Your cluster cache, your preferences, and your Pro licence status. This data never leaves your device except as described in section 3.
• On our servers (if you create an account): Your email address, account creation date, and subscription status. We do not store any email data on our servers.
• We do not store: Email subject lines, sender names, email content, or any Gmail data on our servers at any time.

5. Gmail API limited use disclosure

InboxZero's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we confirm that:

• We do not use Gmail data to develop, improve, or train generalised AI or ML models
• We do not allow humans to read your Gmail data unless you explicitly grant permission or it is required for security purposes
• We do not transfer Gmail data to third parties except as necessary to provide the InboxZero service (i.e. sending subject lines to Claude API for classification)
• We do not use Gmail data for serving advertisements
• Our use of Gmail data is limited to providing and improving the InboxZero email clustering feature

6. Data retention and deletion

• Disconnect the extension: All locally cached data is deleted immediately. Revoke Gmail access via your Google account permissions page.
• Delete your account: Email us at hello@inboxzero.app and we will permanently delete all account data within 30 days.
• Waitlist data: If you joined our waitlist, your email address is stored only for launch notification. You can unsubscribe at any time using the link in any email we send.

7. Third-party services

8. Your rights

Depending on your location, you may have the following rights under GDPR, CCPA, or other applicable privacy laws:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate personal data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain types of processing

To exercise any of these rights, email hello@inboxzero.app. We will respond within 30 days.

9. Security

We use OAuth 2.0 (the industry standard) for Gmail authentication. Access tokens are stored in Chrome's secure identity API and are never exposed to web pages. All communication with the Gmail API and Claude API occurs over HTTPS. We do not store Gmail access tokens on our servers.

10. Children

InboxZero is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to this policy

If we make material changes to this policy, we will notify users via email (if you have an account) and update the effective date at the top of this page. Continued use of InboxZero after changes take effect constitutes acceptance of the revised policy.

12. Contact