Privacy Policy

Last updated: September 6, 2026

Inbox OCD is a desktop email application that consolidates your Gmail and Microsoft Outlook accounts into one inbox. This policy explains what data Inbox OCD accesses, how it is used, and where it lives. The summary: Inbox OCD runs on your computer and your mail is fetched straight from Google and Microsoft to your device — we operate no mail server and never receive, store, or read your mailbox. The one exception is the optional AI assistant when you use prepaid credits; that path is described in full below.

What Inbox OCD accesses

When you connect an account, you grant Inbox OCD permission through Google's or Microsoft's official sign-in (OAuth). Depending on the permissions you approve, Inbox OCD accesses:

Email messages (Gmail and/or Outlook): read messages to display your inbox; apply labels/folders and read state according to rules you create; send messages you compose, reply to, or schedule.
Mailbox settings: read your existing Gmail filters and labels, and Outlook rules and categories, so Inbox OCD can import and display them.
Calendar (read-only, Google): read events on your primary Google Calendar to display them in Inbox OCD's calendar view.
Basic profile (email address, name): to label which account is which inside the app.

Where your data lives

Your email is fetched directly from Google and Microsoft to your device over encrypted connections (HTTPS).
Sign-in tokens, sender rules, settings, and the action journal are stored locally on your device (on macOS under ~/Library/Application Support/Gridline; on Windows under %APPDATA%\Gridline).
Inbox OCD operates no mail server. Your mailbox is never synced, copied, or relayed to us. We run one small service (a Cloudflare Worker) that exists solely to handle credit purchases and, if you choose prepaid AI credits, to pass that one request through to the AI provider. It stores no message content — see Optional AI features and Payments.

Optional AI features

Inbox OCD's AI features (message summaries, the inbox assistant) are off by default. Nothing is sent anywhere until you turn one on and use it. There are two ways to run them, and they differ in where the request goes:

Your own API key. You add a key for an AI provider of your choice (e.g., Anthropic, OpenAI, or OpenRouter). The relevant message content is sent from your device directly to that provider, under your account and their privacy terms. Your key is stored locally on your device. No request touches us.
Prepaid credits. If you buy credits instead of supplying a key, the request is sent to our Cloudflare Worker, which forwards it to Anthropic using our key and meters what you spent. The message content you submit passes through that Worker in transit. It is not written to disk, not logged, and not retained — we record only the model used, the request status, and token counts for billing. Our records contain no column for message content. If you would rather no request of yours ever transit our infrastructure, use your own API key instead.

In both modes only the content needed for the feature you invoked is sent, and only when you invoke it. There is no background or automatic AI processing of your mailbox.

Google API Services — Limited Use disclosure

Inbox OCD's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide the email and calendar features you see in the app; it is not used for advertising; it is not sold; it is not transferred to third parties except as necessary to provide features you initiate (such as an AI request you configure and trigger yourself) or as required by law; and humans do not read it.

Payments

If you buy AI credits, the payment is processed by Stripe, and you enter your card details on Stripe's own checkout page. We never see or store your card number. We keep a record of the purchase (an account identifier, the amount, and the resulting credit balance) so credits can be applied and reconciled. Stripe's handling of your payment data is governed by the Stripe Privacy Policy.

What we collect about you

Nothing automatically. Inbox OCD currently includes no analytics, telemetry, or tracking. If you email support, we receive whatever you choose to send us.

Data sharing and selling

We do not sell, rent, or share your personal data or mailbox contents with third parties. Period.

Data retention and deletion

Because your data is stored only on your device, you control it entirely. Disconnecting an account inside Inbox OCD deletes its stored tokens. Uninstalling Inbox OCD and deleting its application-data folder (paths above) removes everything. You can also revoke Inbox OCD's access at any time from your Google Account permissions or Microsoft account permissions pages.

Security

All communication with Google and Microsoft uses HTTPS. Sign-in uses each provider's official OAuth flow in your own browser — Inbox OCD never sees or stores your password. Remote images in email are blocked by default to prevent tracking pixels.

Children

Inbox OCD is not directed at children under 13 and does not knowingly collect information from them.

Changes to this policy

If this policy changes materially, we will update this page and the date above.

Contact

Questions or requests: [email protected]