Privacy and security
Last reviewed
Postbox is a free utility for reading your own Gmail in one place. It is not an email host: your mail stays in Gmail, and this app holds as little as it can.
What is stored
- Your Postbox account: email address, a salted password hash, and a display name you choose.
- One row per connected mailbox: the Gmail address, the Google account id, the scopes Google granted, when the access token expires, and the encrypted tokens themselves.
- If you supply your own Google OAuth client, its client id and an encrypted client secret.
- An activity feed of message headers — sender, subject and Gmail’s own snippet — for messages that arrive while a mailbox is connected, kept to the latest 500 entries.
- An operations log: what the app did, when, and whether it worked.
What is never stored
- Your Google password. Postbox has no field for it and never will — you authorise on Google’s own screen.
- Message bodies and attachments. Those are fetched from Gmail when you open a conversation and are not written to the database.
- Recipients, subjects or contents of anything you send, in the operations log.
Encryption
Google access tokens, refresh tokens, OAuth client secrets and any OpenRouter key are encrypted with AES-256-GCM before they are written, using a key held only in the server’s environment. Each record is bound to its owner during encryption, so a copied row cannot be read under a different account. Decryption happens only inside server code, only to call Google, and the decrypted values are never returned to the browser.
Who can read your data
Only you, through your own signed-in session. Every database query is filtered by the authenticated user id taken from the session — never from anything the request body can set. Row level security is enabled on every table, and no policy grants access to the public or signed-in API keys, so the database rejects reads that do not come from the server itself.
Third parties
Google, for Gmail itself. Supabase, when the deployment uses it for accounts and storage. OpenRouter, only if you add your own key and only when you press Summarise. There is no analytics, no tracking and no advertising.
Deleting your data
Disconnecting a mailbox revokes the grant at Google and deletes its stored tokens and activity. Deleting your data removes every mailbox, credential, setting, activity row and log belonging to your account. You can also revoke Postbox’s access at any time from your Google account at myaccount.google.com/connections.