Privacy policy

GInbox is a desktop application (identifier com.ginbox.app) for Windows and Apple Silicon macOS. The developer and operator is Guilherme Costa. Support email: gaa.cost@gmail.com.

This policy applies to the GInbox desktop app and to the public website that hosts this page. It does not apply to Gmail itself. Google's handling of your account is described in Google's own policies.

When you choose Add Gmail account, GInbox starts Google's OAuth 2.0 flow in your default browser and requests these scopes:

• Gmail modify. https://www.googleapis.com/auth/gmail.modify. Read messages, change labels, send mail, manage drafts, move mail to trash, and keep the local mailbox in sync. This is the Gmail scope for a full desktop client. GInbox does not request the broader mail.google.com scope that allows permanent delete that skips trash.
• Email address. https://www.googleapis.com/auth/userinfo.email. Show the connected account address in the sidebar and keep accounts distinct.
• Profile. https://www.googleapis.com/auth/userinfo.profile. Show the account display name and avatar next to the mailbox.

Through those scopes GInbox can read message metadata and bodies (including attachments), labels, drafts, and profile fields (email, display name, avatar URL). It can also send mail, create and update drafts, change labels, and move messages to trash. GInbox does not request https://mail.google.com/, so it cannot permanently delete messages while skipping trash.

GInbox does not access Google Drive, Calendar, Contacts, or other Google APIs. It does not request Gmail settings scopes.

Google user data is used only to provide the GInbox user interface:

• Show your mailboxes, conversations, and labels.
• Let you read, search, star, archive, label, trash, and restore mail.
• Let you compose, reply, forward, save drafts, and send, including attachments.
• Keep a local copy in sync with Gmail using the history API after the first download.
• Show the connected account's email, name, and avatar in the account rail.
• Show desktop notifications for new mail, if you leave notifications on.

GInbox does not use Google user data for advertising, analytics products, credit decisions, or training a machine learning or artificial intelligence model. There is no GInbox account on a server, so mail is not uploaded to the developer.

HTML mail is rendered in a sandboxed iframe. Scripts are stripped. Remote images stay blocked until you choose Load images.

After Google returns tokens, GInbox stores them in the operating system's credential store, keyed by account id, under the service name com.ginbox.app:

• Windows: Credential Manager
• macOS: Keychain
• Linux: Secret Service (libsecret), when that platform is used

Mail, labels, drafts, sync cursors, and settings are stored in a SQLite file named ginbox.db in the app data directory:

• Windows: %APPDATA%\com.ginbox.app\ginbox.db
• macOS: ~/Library/Application Support/com.ginbox.app/ginbox.db
• Linux: ~/.local/share/com.ginbox.app/ginbox.db

Downloaded attachments are written under the app cache directory, for example %LOCALAPPDATA%\com.ginbox.app\attachments\ on Windows and ~/Library/Caches/com.ginbox.app/attachments/ on macOS.

Profile avatar URLs returned by Google may be fetched by the app to display the picture. Those image bytes are not copied to a GInbox server.

GInbox also stores local preferences (theme, layout, notification snooze) in the same SQLite database. Those preferences are not Google user data.

GInbox does not sell Google user data. It does not transfer mail, tokens, or profile data to advertising platforms, data brokers, or other information resellers.

The only parties GInbox talks to with Google user data are:

• Google. OAuth token exchange and refresh, userinfo, and the Gmail REST API over HTTPS. That is required to sign in and to sync, send, and modify mail.
• You, on this computer. The local database, cache, and credential store. Anyone with access to your user account on that computer can read those files the same way they can read other apps' data.

Separately, GInbox may check GitHub Releases (and an optional update feed URL if you configure one) for a newer installer. That check sends a normal HTTPS request. It does not include mail content, tokens, or your Gmail address.

The developer cannot read your mailbox. There is no admin console and no support backdoor into Gmail data. If you email support, you control what you paste into that message.

The use of information received from Google Workspace APIs and Google Workspace scopes will adhere to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including the Limited Use requirements.

In practice that means:

• Data from Gmail and userinfo is used only to provide or improve user-facing mailbox features that are visible in GInbox.
• GInbox does not transfer that data except to Google to operate the mailbox, to comply with law, for security investigations, or as part of a sale of the project after asking you first.
• Humans working on GInbox do not read your mail unless you send it to support yourself, or as required by law or to investigate abuse.
• GInbox does not use Google user data to serve ads, to determine credit-worthiness, or to train or improve a machine learning or AI model.

See also the Google API disclosure.

You can remove GInbox's access in three places. Do all three if you want a clean break.

1. In GInbox. Remove the account from the account rail. That deletes the account's rows from ginbox.db (messages, labels, drafts, attachments metadata) and deletes the OAuth tokens from the OS credential store.
2. On disk. Uninstall GInbox, then delete the app data and cache folders listed above if they remain. That removes the local mailbox and any downloaded attachments.
3. At Google. Open Google Account permissions and revoke GInbox. Google then stops issuing tokens to this app until you add the account again.

Deleting local data does not delete mail in Gmail. Archive, trash, and send that already reached Google stay in your Gmail account unless you change them there.

Traffic to Google uses HTTPS. OAuth uses Authorization Code with PKCE. The redirect URI is http://127.0.0.1:<random-port> on the same computer. Tokens are stored in the OS credential store, not in the SQLite file.

GInbox is a local client. Restricted Gmail data is not stored on a GInbox server and is not accessed through a third-party backend operated by the developer. You are responsible for the physical and account security of the computer where GInbox runs, including disk encryption and who can log in.

If you believe there is a security issue in GInbox, email gaa.cost@gmail.com.

The GInbox website is hosted on Vercel. It does not offer sign-in and it does not receive Gmail data. Like most hosts, Vercel may collect standard request logs (IP address, user agent, URL, time) to operate the site. This site does not set an advertising cookie and does not load a third-party analytics script.

If you email support, the contents of that email are stored in the mailbox that receives it, for as long as needed to answer you.

GInbox is not directed at children under 13 and does not knowingly collect Google user data from them. A Gmail account is required to use the app.

If GInbox starts using Google user data in a new way, this policy will be updated and, where Google's rules require it, you will be asked to consent before that new use. The date at the top of this page is the last revision.

Questions about this policy or a deletion request: gaa.cost@gmail.com.

Related pages: Terms of service, Google API disclosure, GInbox home.