Privacy Policy

Email Message Management · Last updated 21 July 2026

This policy explains how the Email Message Management app (the “app”) handles data when it connects to a Google account. The app is an individual, non-commercial project operated by its author for personal use. Each installation is run by, and serves, a single account owner on their own hardware.

What the app accesses

With the account owner's consent, the app uses Google OAuth to obtain access to Gmail through the https://mail.google.com/ scope. This grants the ability to read, organise, and manage messages in the account owner's own mailbox — moving, labelling, and filtering mail as the owner has configured. The app accesses only the mailbox of the account that granted consent.

How Google user data is used

Mailbox data is used for one purpose only: to organise the account owner's email on their behalf, according to rules the owner defines. The app does not use Google user data for any other purpose.

How Google user data is stored

Message content is not stored. The app reads messages to act on them and passes them between the mail client and Gmail, but it does not retain the content of your email, and it does not write message bodies or headers to disk.
Access tokens are held in memory only and are never written to persistent storage.
An OAuth refresh token is stored on the account owner's own hardware, in a local database file readable only by the account that runs the app. It exists solely to keep the session authenticated so filtering can run without repeated sign-ins. It is never transmitted to anyone other than Google, at Google's own token endpoint, for the purpose of refreshing access.

How Google user data is shared

The app does not share Google user data with any third party. It communicates only with Google's own servers (to authenticate and to access the mailbox) and with the account owner's own mail-management software on the same private infrastructure. Data is not sold, not transferred, and not disclosed to anyone else. Because each installation serves a single owner, there are no other users to share data with.

How Google user data is protected

Connections to Google are made over TLS.
The stored refresh token is held in a database file with owner-only file permissions on the owner's own hardware.
Access tokens exist only in memory for the lifetime of the running process.
Access to the running system is restricted to the account owner.

Limited Use disclosure

The app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and revocation

The stored refresh token is retained only while the account owner continues to use the app. The owner can revoke the app's access to their Google account at any time at myaccount.google.com/permissions. Revoking access invalidates the stored token; deleting the app's local database removes it entirely. No mailbox content is retained to delete, because none is stored.

Children's privacy

The app is a personal tool and is not directed to children.

Changes to this policy

If this policy changes, the updated version will be posted at this address with a revised date.

Contact

Questions about this policy can be sent to mario.kasuba@soulik.work.