ChatMail Privacy Policy

When you sign in with Google, you allow ChatMail to:

• read your Gmail messages, threads, labels and attachments, so they can be shown as conversations and searched;
• change labels, for example to archive a thread or mark it read, and create a "ChatMail/Notes" label for your notes. ChatMail never deletes or trashes mail;
• send mail as you when you tap Send, and send a secure-conversation code from your address when someone you invited asks for one;
• read your Gmail "Send mail as" settings, so replies go out from the right address;
• see your Google account's email address and account ID, so we know which ChatMail account is yours.

• Account: your Google email address, Google account ID, display name, and when you joined.
• Mail details: for each synced message, its sender, recipients, subject, date, labels, Gmail's short preview and Gmail identifiers; for each thread, its participants.
• Message text: the readable part of each message, plus the signature, quoted text and disclaimers separated from it, so you can still open them.
• Attachment details: names, types and sizes. Attachment files are fetched from Gmail when you open them and are not stored on our servers.
• Settings and history: your Gmail "Send mail as" addresses and names, and which of your addresses you have used with each contact.
• What you create: businesses, colors, logos (including images copied from your business's website), signatures, drafts, notes and secure conversations. Drafts are saved in ChatMail, not in Gmail.
• Secure conversations: messages and files that you, or the people you invite, put in them, encrypted at rest; members' names and email addresses, sign-in codes, remembered devices and access records.
• Sign-in data: an encrypted Google refresh token, passkey public keys with a device label such as "iPhone · Safari" (never your face or fingerprint), notification subscriptions with your browser type, and the time of your last "Sign out everywhere".
• Mail health results: public DNS records for your domains.
• Technical logs: error and event logs kept by our hosting provider. They may include your email address and the web addresses you visit in ChatMail.
• On your device: your browser keeps some data for ChatMail, such as recent searches and images you have opened. Clearing your browser's site data removes it.

ChatMail does not store the raw original of your emails, their HTML, or attachment files, except files put into secure conversations.

Only to provide ChatMail to you: showing, searching, sending and organizing your mail; sending you sign-in codes and notifications; keeping the service secure; and fixing problems. We do not sell your data, use it for advertising, or build profiles of you. People at LAGR, Inc. do not read your mail, except with your permission (for example, when you ask for help with a specific message), where needed for security, or where the law requires it.

ChatMail uses Groq, Inc., an AI provider, in two ways. To separate signatures, quoted text and disclaimers, it sends Groq the message text. To answer a search, it sends Groq your question, your addresses, business names and contacts' names and addresses, and the matching emails (sender, recipients, date, subject and text). Groq returns the result to ChatMail. ChatMail has Groq set not to keep this data, and Groq does not use it to train models. ChatMail does not use your data to train AI models.

ChatMail shares data only with providers that run the service for us, each limited to what its job needs:

• Google (Gmail API): your mail stays in your Google account. Mail ChatMail sends, including secure-conversation notices and codes, goes out from your own Gmail.
• Supabase: database and file storage.
• Vercel: hosting and logs.
• Groq: AI processing, as described above.
• Resend: sending you sign-in codes and account notices, such as a reminder to reconnect a mailbox.
• Push services (Apple, Google, Mozilla or Microsoft, depending on your browser): delivering notifications to your devices. Notification contents are encrypted on the way to your device. A notification shows the sender's name and a short preview; notifications for secure conversations never include their content.
• DNS lookup services (Cloudflare and Google): your business domains' names, to read their public DNS records for Mail health.
• Your business's website: when you add a business, ChatMail requests its logo from that website.

We may also disclose data if the law requires it, or to protect the rights or safety of users or others. If LAGR, Inc. is acquired or merged, this policy continues to apply to your data, and we will tell you before anything changes.

ChatMail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail is used only to provide and improve ChatMail's user-facing features. It is not used for advertising, is not sold, and is not used to develop, improve or train generalized AI or machine-learning models.

• While your account is open, ChatMail keeps what it needs to run.
• A secure conversation ends 30 days after the last message or file sent into it, unless you extend it. Its messages, files and file names are then deleted. A record of it (its members, and when items were sent and opened, with their sizes and types) stays until you delete your data. You can revoke a conversation at any time.
• Sign-in codes expire within 15 minutes.
• When you delete your data (Settings › Account › Delete my ChatMail data), everything ChatMail stores for your account is deleted immediately and ChatMail's Google access is revoked. Copies in our backups are gone within 30 days.
• Deleting your ChatMail data never deletes anything in your Gmail.

• Delete everything: Settings › Account › Delete my ChatMail data.
• Disconnect a mailbox: Settings › Accounts. This removes ChatMail's copy; to also revoke Google access, use the link below.
• Revoke ChatMail's Google access at any time at myaccount.google.com/permissions.
• Turn notifications off in your device settings.
• Ask for a copy of your data, or a correction: colin@iftech.ai.

Connections use HTTPS. Google refresh tokens and secure-conversation contents are encrypted at rest. Secure conversations are not end-to-end encrypted: ChatMail's servers decrypt them to show them to you and your members. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you without undue delay.

ChatMail is for adults, for themselves or their business. It is not intended for anyone under 18.

ChatMail is not an archiving or books-and-records system. Mail you send through ChatMail goes through your own Gmail, so your existing Gmail archiving keeps working, but secure-conversation contents live only in ChatMail and expire. If your business has recordkeeping obligations, you are responsible for meeting them.

If we change this policy, we will post the new version here with a new effective date, and tell you in the app or by email before a material change takes effect.

LAGR, Inc., New York · colin@iftech.ai