Your account details (email address, authentication) are handled by Clerk. For each inbox you connect we store the project label, the address, and delivery metadata (sender address, subject, timestamps, delivery outcome). Message contents are not kept: the body of an email is held only long enough to build and deliver your notification, then it is removed from our servers. The dashboard never displays message content — it cannot, because we no longer have it. If you connect over IMAP or enable replying, we also store the server details and password you provide, encrypted.
Every password and API token you enter is encrypted with AES-256-GCM. The decryption key is not kept in the database, and credentials are never shown again in any screen or API response.
Message contents are processed for one purpose: building the notification email that is delivered to your own inbox. To score it for spam and phishing, the sender, subject and the first part of the text are sent to TypeSafe AI (the Jev model); we keep only the resulting score and category, and you can switch this off per inbox in its settings. If you enable the AI features (Pro), the text of an incoming message is additionally sent to our AI provider (OpenRouter) to produce the spam verdict, translation and suggested reply — and is not stored there. We never analyse your mail for advertising, sell it to third parties, or use it to train models.
Clerk (authentication), Polar (payments — merchant of record; card details never touch our servers), Resend (sending your notification emails), Cloudflare (receiving forwarded mail and your replies), Supabase (database), Vercel (hosting), TypeSafe AI (spam scoring, unless switched off for an inbox) and OpenRouter (AI features, only when enabled). Your replies to customers go out through your own mail server or connected account, not through ours.
Removing an inbox deletes its stored metadata along with any encrypted credentials, and cleans up forwarding rules we created. You can export everything we hold about you (JSON) and delete your entire account yourself in Settings → Your data — no support ticket needed. Deleting the account removes your inboxes, message history and the Cloudflare rules we created, immediately and permanently. If you prefer, you can also email support@allyourinboxes.com.