Privacy Policy

Overview

Tidybox is an AI-powered Gmail triage tool. It reads your inbox, classifies emails using GPT-4o-mini, applies labels, and generates a daily briefing. This policy explains what data Tidybox accesses, what it stores, and how it is protected.

Google Account & Gmail Access

Tidybox uses Google OAuth to authenticate you and requests the following Gmail API scopes:

• gmail.readonly: Read email content (including headers, body, and snippet) to classify your inbox.
• gmail.labels: Create and manage Tidybox label folders in your Gmail account.
• gmail.modify: Apply labels, archive emails, and trash emails on your behalf when you request it.

During a scan, Tidybox fetches the full email body from Gmail to have complete context — but the body is held only in memory and is never written to our database. Only the sender, subject, and Gmail's native snippet are forwarded to the AI for classification. Snippets are purged from our database immediately after analysis.

What Data Is Stored

Tidybox stores the following in a private PostgreSQL database:

• Your Google account name and email address for authentication.
• OAuth tokens (access token and refresh token), encrypted at rest using AES-256-GCM before being written to the database.
• Email classification records: sender name, sender email, subject, assigned category, confidence score, priority score, and received date. No email bodies or full content.
• AI-generated briefings: a summarised digest and action items derived from your classified emails. These contain no raw email content.
• Sender rules: a cache of past classifications per sender email to speed up future scans.

What Is Never Stored

• Full email bodies — fetched in memory during scanning, never written to the database
• Email snippets — temporarily stored during classification, then purged from the database immediately after
• Attachments or inline images
• Email thread contents

Data Sent to OpenAI

To classify emails, Tidybox sends the following fields to the OpenAI API:

• Sender name and email address
• Email subject line
• Gmail's native snippet — a short preview generated by Google, used only during classification and not retained afterward

The full email body is never sent to OpenAI — it is fetched locally for context but discarded in memory after the scan completes. sent to OpenAI is governed by OpenAI's Privacy Policy.

Security

• Token encryption: All OAuth tokens are encrypted with AES-256-GCM before storage and decrypted only when needed to make Gmail API calls.
• HTTPS only: All communication between your browser and Tidybox is encrypted in transit.
• Security headers: The app enforces a Content Security Policy, X-Frame-Options, and other standard security headers.
• Rate limiting: Scan operations are rate-limited per user to prevent abuse.

Data Retention & Deletion

You can delete all your data from Tidybox at any time from the Settings page. This removes all classification records, briefings, action items, and sender rules. Your Gmail account and emails are not affected — only Tidybox's own database records are deleted.

If you disconnect your Google account or stop using Tidybox, your data remains in the database unless you explicitly delete it via Settings.

Third-Party Services

Tidybox uses the following third-party services:

• Google OAuth & Gmail API — for authentication and inbox access.
• OpenAI API — for email classification and briefing generation (limited metadata only, as described above).
• Supabase / PostgreSQL — for secure database storage.
• Vercel — for application hosting.

No advertising networks, social media trackers, or analytics services are used.

Children's Privacy

Tidybox is not intended for use by children under 13. We do not knowingly collect data from anyone under 13.

Contact

Questions about this policy? Reach out at himanshu20032002@gmail.com.

Changes to This Policy

If this privacy policy is updated, the changes will be reflected here with an updated date. Continued use of Tidybox after changes constitutes acceptance of the updated policy.