What we access in your mailbox
When you connect Gmail or Outlook, you approve InboxPrep on the provider’s own screen. The permission covers sending mail and reading messages, and InboxPrep uses it narrowly:
- It looks only for messages InboxPrep itself sent. Each one carries a private header, and that header is how InboxPrep finds them again in your mailbox.
- It reads those messages as metadata only: the headers, the folder or label they landed in, and the thread they belong to. It does not read the body of any other message, and it never opens your contacts or calendar.
- It has no delete operation. Nothing InboxPrep does can remove mail from your mailbox.
- It does not keep your password or the provider’s access tokens. Composio, the connection service, holds the authorization and relays InboxPrep’s requests to Google or Microsoft.
The Gmail permission is Google’s mail scope (https://mail.google.com/), managed by Composio. Outlook grants Mail.Read, Mail.Send, User.Read and offline_access: the first two are for reading and sending as described above, User.Read identifies the connected mailbox, and offline_access keeps the connection working between your visits.
A domain in your own Cloudflare account works differently. InboxPrep sends and receives as the address you chose, through Cloudflare’s email services, and keeps only the metadata of what arrives at that address. The Cloudflare authorization you grant for this is stored in encrypted form so InboxPrep can keep sending from the address.
What we send
From each connected inbox, InboxPrep sends:
- Ten short warm-up emails a day from day one, and half that on Saturdays and Sundays, each to an inbox InboxPrep operates. The text is generated by InboxPrep and shown in your dashboard.
- At most one reply per thread, when an InboxPrep-operated inbox writes to yours.
- About one test email a day to InboxPrep-operated Gmail and Outlook inboxes, to see where it lands.
Volume goes down, or warm-up pauses, when placement results show a problem. Nothing is sent to your contacts, to anyone outside the inboxes InboxPrep operates, or to another customer.
What we store
- Your sign-in identity and organization: name, email address and organization membership, handled by Clerk.
- The address of each connected inbox, its provider, and whether the connection is working.
- Warm-up state and history: what was sent, received and replied to, with the message and thread identifiers the provider assigned.
- The generated text of every warm-up message and reply, so you can read it in the dashboard.
- Placement results and the evidence behind each one.
- Billing records for a subscription, handled by Stripe. Card details go to Stripe, not to InboxPrep.
- Operational logs for security and support. Email addresses are redacted in logs.
We do not store the password of a mailbox you bring, and we do not store Google or Microsoft access tokens. A managed Google inbox bought through InboxPrep is different: its password and sign-in code are kept in encrypted form so an organization administrator can reveal them in the dashboard.
How long we keep it
While a mailbox is connected, InboxPrep keeps its warm-up history and placement results so the dashboard can show them. When you disconnect a mailbox, InboxPrep stops reading from it and sending from it immediately; an email already accepted by the provider may still be delivered.
History stays available afterwards so we can answer support questions, investigate security problems, and keep billing records straight. You can ask us to delete it by writing to support@inboxprep.com.
Who processes data for us
- Composio connects Gmail and Outlook. It holds the Google or Microsoft authorization and relays InboxPrep’s requests; InboxPrep never sees the tokens.
- Clerk handles sign-in, accounts and organizations.
- Cloudflare hosts InboxPrep, stores its database, and routes and sends the email that InboxPrep-operated addresses receive and send.
- Stripe handles payments, invoices and card details.
- Icemail sets up Google Workspace for a managed Google inbox bought through InboxPrep.
Each of them processes only what its part of the service needs, under its own terms and security practices.
Google user data
InboxPrep’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice: Google user data is used only to provide the warm-up and placement features described on this page. It is not used for advertising, it is not sold, and it is not passed to anyone else except as needed to provide those features, for security, or to comply with the law. People at InboxPrep do not read your messages unless you ask us to for support, it is needed to investigate a security or abuse problem, or the law requires it.
How to revoke access
- In the dashboard: open the mailbox and choose Disconnect. InboxPrep stops sending and reading straight away.
- Google: Google Account → Security → Your connections to third-party apps and services. The connection may be listed under Composio.
- Microsoft: Microsoft account → Privacy → Apps and services that can access your data.
- Cloudflare: remove the address in the dashboard. You can also revoke InboxPrep’s authorization from your Cloudflare account.
Revoking at the provider has the same effect as disconnecting: the next time InboxPrep tries to send or read, the provider refuses, and the mailbox shows as needing to be reconnected.
Contact
Questions about this page, or a request to delete your data: support@inboxprep.com.
When this page changes, the date at the top changes with it.