Your account details (email address, authentication) are handled by Clerk. For each inbox you connect we store the project label, the address, and the contents of the messages that reach us. If you choose to connect over IMAP, or to enable replying, we also store the server details and password you provide.
Every password you enter is encrypted with AES-256-GCM. The decryption key is not kept in the database, and passwords are never shown again in any screen or API response.
Message contents are processed for one purpose: showing them to you and building your notification emails. We do not analyse them for advertising, sell them to third parties, or use them to train models.
Clerk (authentication), Stripe (payments), Resend (sending your notification emails), Cloudflare (receiving forwarded mail and your replies) and our hosting provider. Your replies to customers go out through your own mail server, not through ours.
Removing an inbox deletes every message stored for it along with any encrypted credentials. To delete your account entirely, email support@allyourinboxes.com.