Privacy Policy

Who we are

Mailroom is an email client for Gmail at https://mailroom.one. This policy describes what we collect when you use the service and how we handle it.

Information we collect

When you sign in with Google, we store:

• Your Google account identifier, email address, name, and avatar, so we can create and recognize your Mailroom account.
• A session cookie so you stay signed in.
• An encrypted Gmail refresh token in an httpOnly cookie, used only to issue a short-lived access token back to your browser.

Your browser keeps a short-lived Gmail access token in memory and in IndexedDB so the page can call the Gmail API after a reload. Mailroom servers do not store or proxy email bodies, attachments, or message content. The browser requests that data directly from Google.

How we use this information

We use your Google account details — email address, name, and avatar — only to sign you in and keep your session. We do not sell this data. We do not use it for advertising or to train models.

Your emails and their content are different. Mailroom never reads, stores, analyzes, or trains on message bodies, attachments, or inbox contents on our servers. That data stays between your browser and Google. This is a privacy-first boundary: we will not change it.

Google API Services User Data Policy

Mailroom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

We share data only with the infrastructure needed to run the service: Google (sign-in and Gmail API) and our database provider (account and session records). We do not share Google user data with third parties for marketing.

Retention and how to revoke access

Signing out revokes the Gmail refresh token and clears the Mailroom session. You can also remove Mailroom from Google Account → Third-party access. Clearing your browser data removes the local access-token cache; reconnecting Gmail restores mail from Google, not from Mailroom servers.

Cookies

Mailroom sets these cookies:

• Identity session cookie (keeps you signed in).
• Short-lived OAuth state cookie (CSRF protection during sign-in).
• Encrypted Gmail refresh cookie (httpOnly; used only to refresh the access token).

Contact

Questions about this policy: privacy@mailroom.one.