Privacy Policy

1. Introduction

MailChrono ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email aggregation service at mailchrono.com (the "Service").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

2. Information We Collect

2.1 Account Information

When you sign up for MailChrono, we collect:

• Your name (as provided by Google or Microsoft)
• Your email address (as provided by Google or Microsoft)
• Your profile picture URL (optional, from Google or Microsoft)

2.2 OAuth Tokens

When you connect your email accounts, we store encrypted OAuth access and refresh tokens. These tokens allow us to fetch your emails on your behalf. We use AES-256-GCM encryption to protect these tokens at rest.

2.3 What We DO NOT Store

We want to be crystal clear about what we never store:

• Email content: We never store the body or content of your emails
• Email metadata: We do not store subjects, recipients, or sender information
• Attachments: We never download or store email attachments
• Contacts: We do not access or store your contact information
• Passwords: We never see or store your email passwords

2.4 Usage Data

We collect limited usage data to enforce free tier limits and improve our service:

• Daily thread view counts (for free tier limits)
• Number of connected email accounts
• Workspace membership information

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service
• Authenticate you and authorize access to your email accounts
• Fetch and display your emails in the unified inbox
• Generate PDF exports when you request them
• Enforce usage limits on free tier accounts
• Process payments and manage subscriptions
• Send you important service updates
• Respond to your support requests

4. Email Access and Permissions

When you connect your Gmail or Microsoft account, we request only the minimum permissions necessary:

4.1 Gmail

• gmail.readonly - Read-only access to your Gmail messages

4.2 Microsoft

• Mail.Read - Read-only access to your Outlook/Microsoft 365 messages

Important: We explicitly do NOT request permissions to send, delete, or modify your emails. Our access is strictly read-only.

5. Data Security

We implement multiple layers of security to protect your data:

• Encryption at rest: OAuth tokens are encrypted using AES-256-GCM
• Encryption in transit: All data is transmitted over HTTPS/TLS
• No email storage: Email content is never persisted on our servers
• Secure infrastructure: We use Cloudflare's enterprise-grade infrastructure
• Regular security audits: We conduct regular security assessments

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• Service providers: We use Paddle for payment processing. They receive only the information necessary to process your payments.
• Legal requirements: We may disclose information if required by law or in response to valid legal processes.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred.

7. Data Retention

We retain your account information for as long as your account is active. Since we don't store email content, there is no email data to retain. When you delete your account:

• Your account information is permanently deleted
• OAuth tokens are securely destroyed
• Workspace and team data associated with you is removed
• Usage counters are deleted

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and data
• Portability: Request your data in a portable format
• Objection: Object to certain processing activities
• Revocation: Revoke email access at any time through your settings

To exercise these rights, please contact us at privacy@mailchrono.com.

9. International Data Transfers

Our Service is operated globally using Cloudflare's edge network. Your data may be processed in data centers located in various countries. We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

10. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us.

11. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: privacy@mailchrono.com
• Address: MailChrono Inc., Privacy Team

14. GDPR Specific Provisions

For users in the European Economic Area (EEA):

• Legal basis: We process your data based on your consent (for connecting email accounts) and our legitimate interests (for operating the Service).
• Data Protection Officer: Contact our DPO at dpo@mailchrono.com
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

15. CCPA Specific Provisions

For California residents:

• We do not sell your personal information.
• You have the right to know what personal information we collect and how we use it.
• You have the right to request deletion of your personal information.
• You will not be discriminated against for exercising your privacy rights.