Privacy

Effective October 12, 2026

Who we are

MailGPT ("we") operates mailgpt.com, an AI email assistant that triages your inbox and delivers what matters to Telegram, Slack, WhatsApp, or the web app at my.mailgpt.com. Contact us at support@mailgpt.com or via the MailGPT bot on Telegram (@mailgptcombot).

What we access

• Google account, with your consent via Google OAuth: basic profile (openid, email, profile), read-only Gmail access to classify your mail (gmail.readonly; if you use Maxine, it is also how she reads your Sent folder and the mail about a meeting she arranges, as described below), sending only when you explicitly approve a reply (gmail.send), and your Google Calendar (calendar.events): we read your upcoming events to give you a heads-up the evening before and shortly before a meeting, to put today's schedule in your morning brief, and to check a time an email proposes against your calendar. Apart from the meetings Maxine books (below), we add an event only when you ask, and we answer an invitation or move an event you organize only when you approve it: your answer shows on the organizer's invitation, and a move notifies the event's guests. If you use Maxine, she also reads the events on the primary calendar of each Google account you connected with calendar access, and on any calendar you name, to find when you are free.
• Microsoft account, if you connect Outlook: basic profile (User.Read), your mail (Mail.ReadWrite, because Microsoft prepares a reply as a draft before it is sent; we don't change or delete your existing mail), sending only when you explicitly approve a reply (Mail.Send), and offline_access so triage keeps working while you're away. We don't request access to your Outlook calendar.
• App Store Connect, if you add an API key in Settings: the key is used only to check and release your app versions. We read your apps and their versions, and we release a version only when you ask.
• Messaging identities you connect: your Telegram chat, Slack workspace/user, or WhatsApp phone number — used only to deliver your assistant.

What we store

• Account records: your email address and connected channel IDs.
• Triage records: sender, subject, the decision (skip / notify / act), whether Gmail confirmed who sent the email, and a short AI-written summary.
• Emails waiting for your morning brief (or your daily or weekly digest): the sender, subject, date and the short preview of the text that Gmail or Outlook gives for each, with the decision and a short AI-written summary. They are deleted once the brief that carries them is delivered, or, if no brief goes out, 45 days after the newest one was added.
• Assistant memory: facts, sender relationships (including how often and when you write to each person, counted from the To and Cc of your sent mail), events, and commitments extracted from your email to personalize triage for you.
• Contacts you ask the assistant about: a person's role and company, with the web page it came from.
• Things you ask the assistant to wait for: what to watch your mail for, what to do when it arrives, and which email completed it. Each is deleted 30 days after the assistant stops watching for it: when it is done or cancelled, or when its watch period ends (30 days, or up to 90 if you ask).
• OAuth tokens, encrypted at rest with AES-256-GCM.
• An App Store Connect API key, if you add one in Settings, encrypted at rest with AES-256-GCM. Disconnecting it in Settings deletes it.
• Your recent conversation with the assistant, including the alerts we send you: the last 20 messages per channel, deleted 7 days after your last activity on that channel. They can include a guest's name and address and a meeting's title and times.
• For some messages the assistant shows you that were written from an email or found on the web (such as a reply it drafted from a guest's email, what it found about a person or a place, or a meeting heads-up that says what your mail says about the guest), we keep a hash of the message as it was delivered (on Slack, of its message ID), never its text, so that if you quote it back it is not read as an instruction. On each channel we keep the newest 20, until 7 days after the newest.
• A reply the assistant drafts for you waits for your Send for 1 hour from when it is drafted or last edited (24 hours for one drafted with an alert and not edited).
• When you cancel a reply the assistant drafted for you, we keep a copy of its text and the ID of the email it answers; when you replace its text with your own, we also keep your text and its subject. We keep these to improve the replies it drafts, and delete them 90 days after you cancelled or changed the draft. A reply the assistant drafts for you to a guest Maxine is arranging a meeting with is never copied this way.
• Error records: when something fails we log it, which can include your account ID or email address. They are kept for 30 days, then deleted.
• Calendar events are read when they are needed and kept for at most 15 minutes, so one check can serve several emails. We don't store them beyond that, apart from the meetings Maxine arranges (below). While an answer to an invitation, or a move of an event Maxine did not book, waits for your approval, we keep only a reference to the event, not its details, for at most 30 days.

Full email bodies are never written to our database. While a message is being processed it waits in our processing queue, at most 4 days; if processing keeps failing, it is retried for a few minutes, then set aside and deleted 4 days later. Short snippets may be kept up to 30 days to learn from your explicit feedback, then expire automatically.

Maxine, our scheduling assistant

Maxine arranges meetings for you, if she is switched on for your account. She is an AI assistant and says so: she writes from her own address, maxine@maxine.ai, signs as your assistant, and her own emails never go from your Gmail or Outlook. Mail goes from your own mailbox only on your own act: a short reply shown word for word on a meeting plan's card is sent from your Gmail when you tap Go on that card (or Book on a card for a time the guest proposed) or tell the assistant "go", if that mailbox can send; and a reply the assistant drafts for you to a guest is sent only when you tap Send, or tell the assistant to send it after you have seen it.

• What she reads. The events on your calendar (see above). For a Gmail mailbox: your Sent folder (its last 13 days when it is first read), then every hour, and every 10 minutes while she is arranging a meeting for you, using only the recipients (To and Cc), message ID, thread and time of each message (Gmail's answer also carries a short preview of the text, which is neither used nor kept), so that she steps back when you write to the guest yourself; the whole of a message you send and copy her on, to set up the meeting from your own words; an email in your inbox asking to meet you, when you are alerted to it or your morning brief names it, to offer you a plan for that meeting (with any times it proposes); and the mail in your inbox about a meeting she arranges (her own copies, a guest's replies to her emails, including one sent to you alone, and what you write on that meeting's thread), which is recorded with its sender and subject only and handed to her in place of an alert. What a guest writes to her (a reply, or a note on the booking page) is read to work out what they chose or asked. When she shows you the settings she would start with (on the card that switches her on, or before you have confirmed any), she reads your meetings with guests over the last 8 weeks: when each was, and how it was held (Google Meet, Zoom, phone or in person, from its call details, place and description, where she also looks for your own Zoom link), never their titles or who was on them. That read is arithmetic, not AI, and nothing from it is kept but the settings you confirm.
• What she writes. A proposal of times; up to two reminders by default if the guest does not answer, and then a question to you; other times when the guest asks for them; a confirmation; a note when a meeting is moved, put back or cancelled; and, when you ask her to answer a meeting request with a no, a polite no. Reminders and other times go to the guest alone; her other emails copy you.
• Your calendar. When a time is agreed inside a plan you approved, or one you started by copying her on a message (a time the guest picks from those she offered, a free time inside your settings that the guest names, or a time you say yes to), she adds the meeting to your calendar with the guest invited, and Google sends them the invitation. She moves or cancels only a meeting she booked. She does not change a meeting with more than one guest: you change that one in your calendar. The guest can move it to another free time inside your settings, or cancel it, from the link in her email, and a guest who writes asking for another time has it moved by her only when that time is free and inside your settings; you are told either way. Any other change, such as a time outside your settings, or a guest writing that they can't make it, waits for your yes. You can also ask her to cancel it, or to offer the guest other times. Google tells the guest of each change.
• What we store about a meeting. A record for each meeting she arranges: the guest's address and name (as you wrote it or as their mail gave it), and anyone you agreed to add; the meeting's title, what it is about in your words (up to 200 characters, which the guest sees in her email and the invitation), its length and format, and any Zoom link or place you set; the dates she may offer, any part of the day you asked for, kept as hours, which every time she offers or books for that meeting keeps to unless you approve a time outside it, and the language she writes in; the times she offered and the time that was booked, with the calendar event's ID; the subject (up to 200 characters) and message IDs of the email it began from, and its thread in your mailbox; for each message she sent or received, its ID, sender, kind and time, and what she took from it as a short code (a time chosen or named, a limit on hours or days, a date the guest is away until), never its text; whether the guest replied, asked her to stop or could not be reached; and a hash of the token in the guest's booking link, never the token. While she is offering times she also holds each one against your other meetings, until 72 hours after she last offered it. The record is deleted 30 days after the meeting is over: once it has taken place, or been stopped, or run out of dates to offer. If Maxine is paused for everyone, a meeting is not marked over until she resumes, so its 30 days start then.
• What she keeps about a guest between meetings. When a meeting she arranged for you with one guest is booked or moved, she keeps a short note for your next meeting with that person: their email address, a time zone they named in their own message (only if they named one), whether the meeting's time was in the morning, afternoon or evening and the time zone that was read in, and when the note was last updated. It is used only to lean which of your free times she offers them: it is never shown to them, never adds a time outside your settings, and never decides a time zone for them. Unlike a meeting's record it is not deleted 30 days after the meeting. It is deleted 12 months after the last meeting she booked or moved with that person, when you delete your account, or as soon as that person's address goes on the list of addresses she must not write to (see If Maxine wrote to you), for every account that keeps a note about them.
• Your scheduling settings. Whether she is switched on for you and when you last switched her on or off, the hours you take meetings, how much notice you need, how far ahead she may book, buffers, a daily limit, the default length and format, any Zoom link, places and extra calendars you name, her reminder schedule, and whether she offers a reply for you on a card, are kept until you delete your account.
• Short-lived records. A plan waiting for your Go or Book, with the guest's address and name, the title, the times, the subject and IDs of the email it answers and, if the card showed one, your reply, is kept 24 hours, or until you answer it; a copy of the card a morning brief carries is kept at most 3 hours, and deleted once the brief is delivered. A question she asks you, such as whether to book a time outside your settings, is kept 72 hours, or, for a meeting already booked, until the meeting starts if that is later, but no more than 30 days; it holds times, IDs, an address the guest wrote that she checked, and codes, never a guest's words. The last card shown on a channel is remembered for up to 4 hours, so that a typed answer reaches it. When you press Change on a plan that answers an email, the guest's address and that email's subject and IDs are kept 1 hour for the next plan. A card about your scheduling settings (switching her on with the settings it shows, a change to them, or switching her off) is kept 1 hour, or until you answer it, with those settings. A notice held over the night, or one that reached none of your channels and waits to be sent again, is kept at most 36 hours. A reply the assistant drafts for you to a guest is kept 1 hour from when it is drafted or last edited, and your own reply from a plan's card is staged for at most 1 hour while it is sent.
• Messages in flight. What a guest writes to her, with its sender, recipients, subject and text (up to 20,000 characters), a note typed on a booking page, and what you write on a meeting's thread, wait in a processing queue until she has handled them. If handling keeps failing, a message is retried for up to about a day, then set aside and deleted 4 days later. The text is never written to our database: a booking-page note is known only by a hash of it, and the same note sent again within the same 10-minute period is passed on once. Short processing records of what she has handled (IDs, times and codes, no text), among them the record of a notice she owes you until it reaches you, are deleted 14 days after she last acted on them, as is the one that stops a guest's words being passed on to you twice; the ones that stop an email she sends to a guest (her proposal, reminders, confirmation and notes among them) going twice, or a meeting being booked or changed twice, are kept as long as the meeting's record.
• What a guest sees. What she writes to them, which shows your email address when it copies you, and what their booking page shows: the meeting's title, length and format, your name, and the free times she offers inside the dates you approved.

If Maxine wrote to you

Maxine is an AI assistant, not a person. She arranges meetings for the person named in her email, from maxine@maxine.ai, as part of their MailGPT account.

• What we keep about you. Her record of the meeting holds your email address and name, the language she writes to you in, the times she offered you and the time you took, the subject and message IDs of your email if the meeting began from it, the dates and kinds of the messages and a short code for what she took from them (a time you chose or named, a limit you stated on hours or days, a date you said you are away until), never their text, and whether you replied, asked her to stop or could not be reached. It is part of that person's account and is deleted 30 days after the meeting is over, as described above. She also keeps a short note for that person's next meetings with you (your address, a time zone you named, and the part of the day your meeting was at), described above: it is deleted 12 months after your last meeting she booked or moved, when that person deletes their account, or when you ask her to stop.
• What you write to her. It is read by OpenAI's models, through our AI router, to work out what you chose or asked, and its text is not written to our database. She may pass it on to that person by email. Email you send to that person directly is handled like the rest of their mail, except a reply to one of her emails: for a Gmail mailbox she reads that too, and if you left her off it she asks that person before writing to you about it.
• Your booking page. The link in her email opens a page that shows the meeting's title, length and format, the host's name, and free times inside the dates the host approved. Anyone who has the link can open it. The network address you open it from is kept until 1 hour after you last open it, to stop abuse.
• Stopping her. Reply to one of her emails, from the address she wrote to, asking her to stop, up to 30 days after that meeting is over. Once she reads it as a request to stop, she stops writing to you about that meeting. If she can confirm it came from you (your email passed your domain's authentication checks, or you wrote it on your booking page), she will not write to you again, for anyone she works for: a hash of your address (not the address itself) goes on a list with no end date that belongs to no account, so it stays when an account is deleted. If she cannot confirm it, she tells the person she works for so, and another meeting with you is theirs to set up. Your address goes on the same list if you ask the person she works for to stop her, in an email she can confirm came from you, and they agree; if a delivery report from your own mail server says mail to it cannot be delivered; if her mail service already blocks it; or if you complain to us about her mail. Her notes about you are deleted then, for everyone she works for; her records of your meetings are kept as described above.
• Questions. To ask about what we hold about you, write to support@mailgpt.com. To have her forget you, write to us from the address she wrote to: we delete her notes about you, for everyone she works for. We keep your address's hash on the list above if it is there, since removing it would let her write to you again, and the record of any meeting she is arranging or arranged with you, until 30 days after that meeting is over.

How AI processing works

Your email content, what the people you meet through Maxine write to her, and the calendar events described above are processed by OpenAI's models, reached through an AI router we operate, solely to classify, summarize, and extract what the assistant shows you, to answer your questions, and to arrange the meetings you ask Maxine for. We handle it under the requirements of the service it comes from: for Gmail, the Google API Services User Data Policy, including the Limited Use requirements below; for Outlook, the Microsoft APIs Terms of Use. It is used only to operate the assistant for you: no advertising and no profiling for third parties.

What leaves our systems

• Email content and calendar events go to OpenAI through our AI router, as described above.
• When you ask who someone is, their name, company and email address are sent to OpenAI's web search, and the answer is saved with its source.
• Notifications and chat replies are delivered through the messaging platforms you connect (Telegram, Slack, WhatsApp) and are subject to those platforms' terms. WhatsApp messages travel through Meta's WhatsApp service, either through Meta's Business API or through a WhatsApp relay we host on Render.
• If you connect App Store Connect, we call Apple's App Store Connect API with your key, only to check and release your app versions; nothing from your email is sent to Apple. What Apple returns about your apps goes to OpenAI through our AI router when you ask the assistant about them.
• Sign-in links and service emails are sent through Resend.
• If you use package tracking or flight lookups, only the tracking or flight number is sent to 17TRACK or aviationstack — never email content.
• Mail to and from maxine@maxine.ai passes through Cloudflare's Email Routing and Email Service, and her booking pages at maxine.ai are served by Cloudflare. A meeting she books is sent to its guests by Google Calendar.
• Hosting and storage run on Cloudflare (Workers, D1, KV, Queues).
• Our website, mailgpt.com, uses Google Analytics to count visits. It sets cookies in your browser and never receives your email.

Google API Services — Limited Use

MailGPT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the user-facing features described here; it is not used for advertising and is not sold. People at MailGPT don't read your email unless you ask us to look at a specific message, it's needed to investigate a bug, abuse, or a security issue, or the law requires it.

Retention & deletion

We keep your data while your account is active, except where this policy gives a shorter time. To delete it, open Settings at my.mailgpt.com and choose Delete account, confirming with your email address. That removes your account and everything we store about you, including Maxine's meeting records and her notes about guests, disconnects your mailboxes, and revokes our Google access. It does not remove the list of hashed addresses Maxine must not write to (see If Maxine wrote to you), which belongs to no account. You can also email support@mailgpt.com and we'll do it for you. Copies in our database backups expire within 30 days. You can revoke our access at any time at myaccount.google.com/permissions, or for Outlook in your Microsoft account's app permissions.

Security

Encrypted tokens (AES-256-GCM), signature-verified webhooks on every inbound channel (Telegram, Slack, Meta, 17TRACK), TLS in transit, and least-scope OAuth. No system is perfectly secure, but silent failure modes are monitored daily.