Privacy Policy

Inbox Organizer · Last updated 2 November 2026

Inbox Organizer ("the app") is a self-hosted application that sorts the Gmail mailbox of a single person, the person who installed it. This policy explains exactly what the app does with Google user data, where that data goes, and how to delete it.

The app is installed and operated by its user. There is no hosted service, no shared infrastructure, and no server operated by the author that receives mail or credentials.

In short

  • The app runs on the user's own computer.
  • Gmail data is stored only on that computer, in a local SQLite database.
  • Nothing is sent to the author, to a model provider, or to any third party.
  • Nothing is sold, shared, or used for advertising.
  • Deleting one folder removes the data permanently.

What data the app accesses

When a Google Account is connected, the app requests a single OAuth scope,gmail.modify. That scope is used to read messages and to apply labels, archive messages, and move messages to Trash. The app reads:

  • Message headers: sender name and address, recipients, subject, date, and list-unsubscribe headers.
  • Message content: the plain-text body and a short snippet.
  • Gmail labels attached to the message, including system labels such as INBOX, UNREAD and STARRED.
  • An OAuth refresh token, which lets the app reconnect without asking again.

The app does not request access to Google Contacts, Calendar, Drive, Photos, or any other Google service. It does not request permission to permanently delete messages, and it does not contain a code path that does so.

How the data is used

  • To display one message at a time as a card in the sorting interface.
  • To score that card and propose a disposition, using rules, sender history and a local embedding model.
  • To record the decision the user makes, so later cards can be scored better.
  • To apply the chosen action back to Gmail: add labels, archive, star, or move to Trash.

This is the entire purpose. Message content is not used to build advertising profiles, is not used to measure engagement, and is not repurposed for any other feature.

Where the data is stored

All mail data, all decisions, and the OAuth refresh token are written to one SQLite file,data/organizer.db, on the machine where the app is running. The app listens on127.0.0.1 by default, so nothing is reachable from the network unless its user deliberately changes the bind address.

There is no cloud storage, no remote backup, and no synchronization between devices. If the user exposes the app on their local network to swipe from a phone, the traffic stays inside that network.

Sharing and third parties

None. The app does not send Google user data to the author, to any analytics service, to any advertising network, or to any third-party API. It talks to exactly one remote service: Google's Gmail API, over HTTPS, using the token the user granted.

Classification runs locally. The embedding model used for semantic scoring is executed on the user's own hardware; message text is never transmitted to a model provider, whether hosted or otherwise.

Separately from the app, this website (barateza.org) uses Vercel Analytics, which records page views only. It has no access to any Gmail data.

AI and model processing

Semantic scoring uses an open-weight embedding model (EmbeddingGemma 2, 270M parameters) running locally through ONNX. Vectors are computed on the local machine and stored next to the messages they describe.

No message content is used to train or improve a general-purpose model. Any learning is limited to the single user's own accounts and decisions, which is the personalised-model exception described in the Google API Services User Data Policy.

Google API Services User Data Policy

Inbox Organizer's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

In line with those requirements, the app:

  • uses Google user data only to provide the sorting features described above;
  • does not transfer Google user data to third parties, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice;
  • does not use Google user data for serving advertisements, including personalised or retargeted advertising;
  • does not allow humans to read Google user data, except where the user gave explicit consent, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the app's internal operations when the data has been aggregated and anonymised;
  • does not use Google user data to determine creditworthiness or for lending purposes.

Retention and deletion

  • Messages moved to Trash are retained by Google for 30 days before permanent deletion, as with any Gmail trash.
  • Disconnecting the account stops all further access. The app provides a disconnect action, and access can be revoked at any time from myaccount.google.com/permissions.
  • Deleting the local database removes all stored mail data, decisions and the OAuth token. This is done by deleting the data/ directory; there is no other copy.
  • Uninstalling the app removes the code; deleting its data directory removes the data.

Because the app is self-hosted, the person who can delete the data is the same person who owns it. There is no third party holding a copy that would need to be contacted.

Security

The OAuth refresh token is stored in the local database in plain text, protected only by the file permissions of the account running the app and by disk encryption if enabled. The app does not transmit it anywhere except to Google's token endpoint, over HTTPS.

Because the token grants access to the mailbox, the app should be run on a machine the user controls, with full-disk encryption enabled, and the token should be revoked from the Google Account permissions page if the machine is lost or shared.

Children

The app is a personal productivity tool and is not directed at children under 13. It is not intended for use by anyone other than the person who installed it.

Changes to this policy

If the app starts handling data differently, for example by adding a hosted sync component, this page will be updated before that version is released and the date at the top will change. Material changes will also be noted in the project's changelog.

Contact

Questions about this policy or about how the app handles Google user data can be sent togilson@barateza.org. This is also the address used as the application's support contact.