Privacy Policy & Terms of Service

1. Introduction

Inbify ("we," "our," or "us") operates an AI-powered email management platform that helps users organize, classify, and respond to emails from multiple providers. This Privacy Policy explains what information we collect, how we use it, and what choices you have regarding your data.

By creating an account or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Account Information

When you register, we collect:

• Email address — used as your unique identifier and login credential
• Full name — for personalization and display purposes
• Password — stored as a one-way cryptographic hash (never in plain text)
• Profile avatar — optional, uploaded by you

2.2 Email Provider Data

When you connect a Gmail or Outlook account, we access your email data through OAuth 2.0 authorization. We collect and store:

• Email metadata — sender, recipients, subject, date, snippet/preview text
• Email body content — loaded on-demand only when you open a specific email (lazy loading)
• Read/unread status, starred status, labels
• Attachment metadata — filename, content type, size (we do not download attachment content)
• Thread/conversation identifiers — for grouping related emails

2.3 Usage & Subscription Data

• Subscription plan — your current plan (Free, Basic, Pro, or Lifetime)
• AI classification usage — number of AI classifications used per billing period
• Billing cycle — monthly, yearly, or lifetime
• Feature usage patterns — which features you access and how often

2.4 AI-Generated Data

Our AI system generates and stores the following data derived from your emails:

• Email category — classification into one of 10 categories (work, personal, newsletters, bills, ads, receipts, updates, social, spam, other)
• Priority level — low, medium, or high
• Action required flag — whether the email requires a response
• AI summary — a one-sentence summary of the email content (max 20 words)
• Smart reply suggestions — generated on-demand and not permanently stored

2.5 Analytics Data

• Daily email statistics — aggregated counts of received, read, and sent emails per day
• Category distribution — breakdown of emails by category
• AI insights — tips and alerts generated from your email patterns

3. How We Use Your Data

We use the information we collect for the following purposes:

We do not use your email content for advertising, marketing profiling, or selling to third parties. Your email data is processed solely to provide and improve the Inbify service.

4. AI Processing & Automated Decision-Making

4.1 Email Classification

We use Anthropic's Claude AI (specifically Claude Haiku) to automatically classify your emails. The following data is sent to the AI model for classification:

• Sender email address
• Email subject line (first 120 characters)
• Email preview/snippet (first 200 characters)

We do not send the full email body to the classification model. Only metadata and short previews are processed. Emails are classified in batches of up to 10 for efficiency.

4.2 Smart Reply Generation

When you explicitly request smart reply suggestions, we send the following to the AI model:

• The email body content (up to 500 characters)
• Thread context from related emails (up to 5 emails, 300 characters each)
• Your selected tone preference

Smart replies are generated on-demand only when you request them and are not permanently stored on our servers.

4.3 Rule-Based Fallback

When AI classification is unavailable or returns inconclusive results, we use a rule-based system that analyzes sender domains and subject line patterns locally on our servers. No data is sent to external services for rule-based classification.

4.4 Classification Limits

AI classification is subject to monthly limits based on your subscription plan. Classification is applied to:

• New unread emails — classified automatically after each sync
• Old emails — classified on-demand when you open them

You have full control over manual reclassification via the reclassify feature.

5. Third-Party Service Providers

We use the following third-party services to operate Inbify:

5.1 Google API Services

Inbify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request access to data that is necessary to provide our email management features
• We do not use Google user data for serving advertisements
• We do not transfer Google user data to third parties except as necessary to provide or improve our service, or as required by law
• We do not use Google user data to develop or improve AI/ML models unrelated to the Inbify service
• Human access to Google user data is limited to debugging and support with user consent

5.2 Microsoft Graph API

Our use of Microsoft Graph API complies with Microsoft's API Terms of Use. We request only the permissions necessary to read, modify, and send email on your behalf.

5.3 Anthropic AI

Email data sent to Anthropic's Claude API for classification and smart reply generation is subject to Anthropic's Privacy Policy. Anthropic does not use API inputs to train their models. Data sent via the API is processed for the sole purpose of generating a response and is not retained by Anthropic beyond what is necessary for abuse prevention.

6. Data Storage & Security

6.1 Storage

• All data is stored in a PostgreSQL database on our infrastructure
• Email bodies are fetched on-demand (lazy loading) and cached locally after first access
• Attachment files are not downloaded or stored; only metadata is retained

6.2 Security Measures

• Password hashing — passwords are stored using Django's PBKDF2 hashing with SHA-256
• JWT authentication — access tokens expire after 60 minutes; refresh tokens after 7 days
• Token blacklisting — refresh tokens are blacklisted on logout, preventing reuse
• Token rotation — refresh tokens are rotated on each use
• CORS protection — API access restricted to authorized origins
• OAuth 2.0 — we never see or store your Gmail/Outlook password; access is granted via industry-standard OAuth tokens

6.3 Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, in compliance with applicable data protection regulations. We will also notify the relevant supervisory authorities as required by law.

7. Data Retention

• Account data — retained for the duration of your account. Deleted upon account deletion request.
• Email data — retained while your email account is connected. When you disconnect an email account, all associated emails are permanently deleted from our servers (hard delete).
• Soft-deleted emails — emails you delete within Inbify are soft-deleted (moved to trash). You can restore them. They are permanently purged after 30 days.
• AI classifications — stored alongside email records and deleted when emails are deleted.
• Analytics data — daily statistics are retained for the lifetime of your account.
• AI usage counters — reset automatically every 30 days.
• Smart reply data — generated on-demand and not stored permanently.
• Server logs — application logs are retained for up to 90 days for debugging and security purposes.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

8.1 Access & Portability

You can access your data at any time through the API. The GET /api/v1/auth/me/dashboard/ endpoint provides a comprehensive export of your profile, subscription, connected accounts, and recent emails.

8.2 Rectification

You can update your personal information (name, avatar) via PATCH /api/v1/auth/me/ and change your password via POST /api/v1/auth/me/change-password/.

8.3 Deletion

• Disconnect an email account — removes the account and all its emails from our servers
• Delete your user account — permanently removes all your data including profile, subscriptions, connected accounts, emails, analytics, and AI-generated data

8.4 Revoke Email Access

You can revoke Inbify's access to your email at any time by:

• Disconnecting the account within Inbify
• Revoking access in your Google Account permissions
• Revoking access in your Microsoft Account permissions

8.5 Opt Out of AI Processing

You can avoid AI processing of your emails by not triggering sync or by using the Free plan with its limited classification quota. However, core email management features (reading, replying, organizing) work independently of AI processing.

8.6 GDPR Rights (EU/EEA Users)

If you are in the EU/EEA, you additionally have the right to:

• Object to processing of your personal data
• Restrict processing of your personal data
• Lodge a complaint with a supervisory authority
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

8.7 CCPA Rights (California Users)

If you are a California resident, you have the right to:

• Know what personal information we collect and how we use it
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

9. Cookies & Tracking

Inbify is primarily an API-based service consumed by mobile and web applications. Our backend API does not set cookies for tracking purposes. Authentication is handled entirely via JWT tokens in HTTP headers.

Client applications (mobile app, web dashboard) may use local storage to persist authentication tokens and user preferences. These are stored on your device and are not accessible to third parties.

10. Children's Privacy

Inbify is not intended for use by individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information promptly.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Compliance with applicable data transfer frameworks
• Ensuring third-party processors maintain adequate security standards

Note that data sent to Anthropic's Claude API for AI processing may be processed in the United States, subject to Anthropic's data processing terms.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this document and, where appropriate, by sending a notification through the app. Your continued use of Inbify after changes are posted constitutes acceptance of the updated policy.