Google API Services User Data Policy & Limited Use

Privacy Policy & Data Disclosure

Last Updated: September 29, 2026 • Version 1.3

1. Overview

Innmail ("we", "our", or "us") helps users send personalized email sequences through their connected Google Workspace and Gmail accounts. We respect your privacy and are committed to protecting personal and Google account data processed through our application.

Google API Services User Data Policy — Limited Use Disclosure

Innmail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google Workspace or Gmail user data to develop, improve, or train generalized AI/ML models.
We do not sell, lease, or monetize your Google account data or email content.
We do not serve advertisements or transfer your email content to third-party ad networks or data brokers.
Human review of your email content is strictly prohibited unless required for critical security investigations, compliance with applicable law, or with your explicit affirmative consent.

2. Google Scopes & Data Collected

Innmail uses Google Sign-In to confirm who you are and, with your permission, to connect your Gmail. We request these OAuth 2.0 scopes:

openid, email, profilePurpose: Identifies your Innmail account by your verified email address and display name.

https://mail.google.com/Purpose: Lets Innmail use Gmail’s encrypted SMTP to send the emails you compose or schedule, and Gmail’s encrypted IMAP to (a) detect replies and bounces on threads Innmail started, so sequences stop when a prospect responds, (b) show your inbox inside Innmail when you open it, and (c) read a small sample of your sent emails when you ask Innmail to learn your writing voice. Innmail does not delete mail or change your Gmail settings.

Innmail’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Gmail access at any time from Settings or at myaccount.google.com/permissions. Mailboxes at other providers connect with an App Password you create and can revoke.

Service provider: when you ask Innmail to learn your writing voice, up to 12 of your recent sent emails are sent to Google’s Gemini API, which returns a writing-style profile. The sign-off detected in your sent mail may also be included when Innmail drafts an email for you. Gemini processes this only to provide those features. Innmail stores the resulting style profile and signature, not the email samples.

3. Data Storage & Encryption

Your security is foundational to our architecture:

Credential Encryption: Google refresh tokens and mailbox App Passwords are encrypted at rest with AES-256-GCM and are only decrypted server-side when connecting to your mail server.
Encrypted In-Transit: All communication between your browser, our hosting functions, Supabase PostgreSQL, Google Sign-In, and your mail server uses TLS.
No Permanent Storage of Full Inboxes: We do not clone, scrape, or permanently retain your general incoming mailbox. We only retrieve message metadata for thread continuity on campaigns dispatched through our platform.

4. Revoking Access & Data Deletion

You retain full control over your Google Account at all times. You can disconnect your account and revoke all tokens at any time by:

Navigating to the Connect Gmail settings screen inside Innmail and clicking Disconnect.
Visiting your Google Account security permissions at myaccount.google.com/permissions and selecting Innmail → Remove Access.

Upon account deletion or disconnect, all OAuth tokens and stored email credentials are permanently purged from our database immediately.

5. Developer & Contact Information

If you have any questions or data privacy inquiries regarding this policy or our Google API integration, please contact:

App: Innmail

Developer: Harshal Pathak

Support & Privacy Email: harshal.pathak3@gmail.com

Website: This Innmail site