Donezo InboxHome / Company
What we store and what we don't
We do not keep a copy of your mailbox. Your browser reads your mail from Gmail with a short-lived token, and no table on our servers mirrors your conversations. Several features do keep some text when you use them, and this page lists every one, with how long it stays and whether it is on by default. It was written from the code on October 18, 2026, not from memory, and the last section lists what we could not confirm.
Does Donezo Inbox keep a copy of my mail?
No. For Gmail and Microsoft accounts your browser asks the provider for your mail directly, using an access token our server hands it that lasts about an hour. The server does not receive the conversations you read in the app. It does read mail itself, in memory and one request at a time, when a feature works while you are away or on your behalf (the background assistant, Ask, meeting prep, a writing-voice rebuild, an agent you connected, a shared inbox, the notification lane), and it does not write what it read to a table except as listed below. For an IMAP account (iCloud, Fastmail, Yahoo and so on) a browser cannot reach the mail host, so our server relays each request and passes the answer straight back without saving it. A test fails our build when a new database column could hold a message body, subject or header without a written reason; it guards against a stored mailbox, and the written reasons are the rows on this page.
Two things follow. Leaving is easy, because your mailbox was never with us. And the exceptions below are the only places your words can be on our servers, so they are worth reading.
What is stored for every account?
| What | Exactly what is kept | Protection and lifetime |
|---|---|---|
| Sign-in tokens | The Google or Microsoft refresh token and the short-lived access token. For an IMAP account, the app password you typed. | Sealed with AES-GCM under a key held as a Worker secret. The refresh token and the app password are never sent to your browser. Removed when you remove the account or delete your data. |
| The account itself | Address, display name, picture address, which provider, and for IMAP the server name, port and username (these are not sealed). | Until you remove the account. |
| Your settings | One JSON document: switches, signatures, split rules, sender lists, the time zone and so on. | Not sealed. Until you delete your data. |
| What you write for the app | Snippets (and files you attach to them), assistant rules, Knowledge Base notes. | Not sealed. Until you delete them or your data. |
| Snoozes, reminders, follow-ups | Conversation and message ids with the time they are due. No subject, sender or text. | Until they fire, plus about a week for the record of one that has. |
| Sessions | A random id, when it started and was last used, a device description and a country guess. No IP address. | Until it expires or you revoke it in Settings, Security. |
| Plan and billing | Free, Pro or trial; the trial dates; how many hosted AI calls you have used; for a subscriber, Polar's customer and subscription ids and the renewal date. | Card details go to Polar and never reach us. Until you delete your data, except one keyed hash that stops the free trial from restarting. |
| Daily counts | Per day and mailbox: conversations cleared, replies sent, minutes active, whether you reached zero. No subjects, senders or text. | Until you delete your data. |
What is stored only when you use a feature?
| Feature | What is kept | Default and lifetime |
|---|---|---|
| Send later | The whole message: recipients, subject, the message text as you wrote it, and an encoded copy including attachments. None of it is sealed. | Only when you schedule a send. After it goes, the encoded copy is blanked, but the record with recipients, subject and message text stays until you delete your data. A send that failed keeps the encoded copy too. We do not yet delete these automatically. |
| Read receipts | Per tracked email: a token, who it went to, the subject, which Gmail message it is, when it left and how often it was opened. Per image load: the time, a coarse kind (Apple Mail, Gmail or Yahoo image proxy, security scanner, other) and how soon after sending. Never an IP address or the reader's browser identifier. | Off until you turn it on, whatever the server default is. Loads are deleted after 180 days. The per-email records are not deleted automatically. |
| Background assistant | Each conversation's category and whether it needs a reply; a log of what it did and a change log that powers Undo (subject and sender, cut to 200 characters, label ids, a reason written by the AI or a rule); the list of what Auto-archive moved (subject and sender); the ids, subject and sender of drafts it saved in Gmail, with a one-line 'why' (up to 400 characters) and up to eight short quotes (70 characters each) of anything in the draft the conversation did not support, such as a price, a date or a name; the senders you told it matter or to archive; and up to five short excerpts of your own sent mail (40 to 700 characters each) used to match your tone. | Off until you switch it on. The activity log, change log and Auto-archive list are cleared after 14 days when the assistant next scans for you, so they can linger if you switch it off. Draft records: 45 days while open, 14 days once settled. Categories, sender lists and the tone excerpts are not deleted by age; the excerpts are refreshed weekly. The excerpts are also written when you use a follow-up draft or the inbound assistant address, even with the assistant off. |
| Your writing voice | A short description of how you write (greeting, sign-off, length, formality, habits), built from your last 60 or so sent messages and cleaned of addresses and links. The sent mail is read for that one request, sent to Cloudflare Workers AI and not kept. Not sealed. | Only after you press Rebuild in Settings, AI, or type one yourself. Kept until you delete it, remove the account or delete your data; not deleted by age. Switching it off stops its use but keeps the text. |
| Screener | For each sender you have never corresponded with: their address and display name, the subject of their first message (cut to 200 characters), its first line (cut to 240), the conversation id, and what you decided (allow, block, not now). Also a ledger of message ids. Not sealed. | Off until you switch it on, per mailbox. Senders still waiting are forgotten when you switch it off, and you can forget any sender. Decided senders, and senders found to be people you already know (with the same first subject and line), stay until you remove the account or delete your data; they are not deleted by age. The ledger goes after 3 days. |
| Agent links and API keys (Pro) | When a key or link that cannot send on its own asks to send, schedule, forward or delete: a summary line (who it goes to and the subject) and the exact request including the message text, sealed. Also a log line per call: time, tool and a short summary such as recipient and subject, never the text. | Only if you create a key or link. The sealed request text is emptied when you approve or reject it, after 24 hours unanswered, or when its key is revoked; the rest of that row is deleted 30 days after the decision. The activity log is kept 90 days. |
| Closed-app notifications | The push address your browser or phone gives us, and a ledger of message ids with one outcome word. A notification is built in memory from the message's sender and subject and handed to Apple or your browser's push service; we do not keep it. It names no sender or subject unless you chose that. | Only if you turn notifications on. The ledger goes after 3 days. The push address stays until you turn notifications off on that device, the push service reports it gone, you remove the account or you delete your data. |
| Ask your inbox history | Your question (up to 500 characters), the answer (up to 2,000, written by the AI from your mail) and up to ten citations with subject, sender and date. Not sealed. The answer is written by the AI from your mail, so it can repeat parts of it. | On by default; switch it off in Settings. Kept 90 days or 100 questions. Never a whole email or file. |
| Meeting notes | The transcript, summary, decisions, action items, the follow-up we drafted, the attendees, and the subject, date and sender of up to four recent email threads with them. Audio is held only until it has been turned into text. | Only when you record or upload a meeting. Audio is deleted right after transcribing unless you chose to keep it for 7 or 30 days. The text stays until you delete it unless you chose a window (30 days to 2 years). |
| Chat | Messages, sealed with the same server key as the tokens. This is not end-to-end encryption: the key is ours. Replies sent by email are copied in (quoted text removed, up to 4,000 characters each). | Only if you chat. Kept until deleted by default. |
| Sharing a conversation with a team | Who shared it and its subject (cut to 120 characters). The messages are read live from your mailbox and are not copied. Comments teammates write are stored as written. | Only when you share. Removed 90 days after you revoke the share. |
| Shared inboxes | Conversation ids, times, counts and tags; internal comments and private notes your team wrote (not sealed; they hold whatever was typed or pasted); the rules and canned replies; reply drafts in progress (sealed; recipients, subject and text, which can include quoted customer text). The customers' own messages are not stored: a list is read from Gmail on each request and held in memory for up to a minute, and a rule that looks for a word reads the newest customer message in memory only. | Only for a team that sets one up. Drafts go on send, on discard or after 30 idle days; resolved conversations and their history after 400 days; comments follow the team's retention setting. |
| Team drafts, notes and reports | Shared drafts: recipients, subject and text, sealed. Comments, team snippets, knowledge notes and follow-ups, as text your team wrote (not sealed). Phishing reports: the sender, the subject (cut to 120 characters), SPF, DKIM and DMARC results, the link domains and who reported it; never the message. | Only for a team and only when used. A shared draft goes on send, on discard or after 30 idle days. Comments and shares follow the team's retention setting if it set one. Phishing reports are not deleted automatically; they go when the team or your data is deleted. |
| Meeting prep | A cached brief: attendee names and addresses, a summary written by the AI, and up to four thread subjects and senders. A planned notification keeps the meeting's id, time and a one-way fingerprint, not its title. | Briefs are treated as fresh for 30 minutes; the row is removed once its meeting is more than a day old and a later briefs request runs. Planned notifications are removed two days after the meeting. |
| Home Screen widget (iPhone) | One summary per person, including the title of your next meeting (up to 80 characters). | Only with the widget set up. Overwritten each time and not deleted by age. The title is stored whether or not you chose to show it; it is only withheld when the widget asks. |
| Booking pages | The visitor's name and email, for the confirmation. | Only for a page you made. Removed 30 days after the meeting. |
| CRM | The CRM's sign-in tokens (sealed) and a ledger of which emails were already logged (message id, the CRM's activity id, a one-way hash of the contact). | Only if you connect one. Removed when you disconnect. |
| Gmail filters we create | Gmail's id for the filter, who it matches and which kind it is. | Only if you create one from the Cleaner. |
| The inbound assistant address | The forwarded email is not stored. A hash of its Message-ID is kept so a retry counts once, and the answer is emailed to you. | Hash removed after 3 days. |
What do we never keep?
- A copy of your mailbox, your attachments, or your contacts list (Google Contacts are read in your browser and not stored on our servers).
- Your Google password. Google never gives it to anyone, and Donezo Inbox has no passwords of its own.
- IP addresses of the people who open an email you tracked, or of your sessions.
- Anything for advertising. We do not sell data, show ads or build profiles of the people you write to, and we do not use your mail to train models.
Who else receives data?
| Who | What they receive, and when |
|---|---|
| Cloudflare (our host, and Workers AI) | The app and database run on Cloudflare. When an AI feature uses our hosted AI, the text it needs for that request is sent to Cloudflare Workers AI. With your own AI key or a model on your computer it goes there instead and nowhere else. |
| Google and Microsoft | Your mail and calendar, to and from your browser, and our server when the assistant or an agent works for you. Gmail's push service tells us an account changed, with the address and a history number. |
| Polar | Your email address and our id for you, for billing. Card details go only to Polar. |
| PostHog (US) | A short list of product events with counts and feature names, tied to an internal id. Autocapture, heatmaps and session recording are off, and no event carries a subject, address or message text. |
| Amazon SES | The email we send you: welcome and plan notes, security notices, the daily briefing if you turn it on, booking confirmations, and answers from the inbound assistant address. |
| Gravatar | A one-way hash of a sender's address, to show their photo. |
| Logo providers | The sender's domain name, fetched by our server from public favicon services to show a logo. |
| Unsplash | If you use live Unsplash pictures, your browser asks Unsplash for them, so it sees your address. |
What happens when I delete my data or export it?
Settings, then Accounts, then Delete my data revokes Google access, stops Gmail watches, disconnects your CRMs, cancels a Polar subscription, and deletes every row about you, your meeting audio and your chat rooms. Things that stay, on purpose: one keyed hash that stops the free trial from restarting; a team's own records (shared inbox state and audit logs), with your name removed; and whatever other companies hold, namely PostHog's events, Polar's billing records, Cloudflare's own logs, and Microsoft or IMAP access, which you revoke at the provider.
Backups are the exception: Cloudflare keeps a point-in-time history of the database, and a nightly encrypted export of the whole database is kept for 30 days outside Cloudflare. Delete my data does not reach either; deleted rows age out of them. Export my data in the same place gives a JSON file of everything we store, or single tables as CSV. It leaves out anything that works as a password, the encoded copy of scheduled sends, and sealed columns such as shared-inbox drafts. See what we promise about leaving.
What could we not verify?
Said plainly, so you do not have to find out later:
- Whether Cloudflare's AI Gateway keeps the text of AI requests for our app, and for how long. Only our free writing tools switch that logging off in code; the setting for the app itself lives in a dashboard we did not check for this page.
- Whether the nightly encrypted database export is actually switched on in production. The workflow and the restore drill are in our repository, but the secrets it needs live in GitHub and we did not check them for this page. If it runs, it holds every table on this page, including the text of scheduled sends, for 30 days.
- Whether the backstop rule that deletes meeting audio from storage after 35 days is switched on. The code deletes audio itself; the rule is a second line of defence that exists only as an instruction in our setup notes.
- Whether request logs kept by Cloudflare contain account addresses, because a few routes carry the address in the URL. Our own code is written to avoid logging mail text, with two small exceptions: a failed send-as lookup logs the account's address, and an unexpected error is logged as it was thrown.
- Whether a third AI service, TypeSafe, is switched on in production. Mail text can be sent to it only if its key is set; we did not check the production secrets.
- How long Cloudflare keeps deleted database rows for recovery.
- How PostHog treats IP addresses and location for its own records.
- That a new account sends nothing to any AI before it picks one. The design says so, but we did not run a fresh account end to end to confirm it. Auto-summarize is on by default and is switched off in Settings, General.
If you find a difference between this page and what the app does, tell us at ankur@kmfv.cc and we will fix whichever is wrong. The legal version is the privacy policy; how the system is protected is on the security page.
See it for yourself
The live demo runs with sample mail, no sign-in.
Try the live demoContinue with Google