Privacy policy

Effective November 9, 2026

mail-api.io is operated by Sean Sullivan, an individual developer in Delray Beach, Florida, USA (“we”). It provides an API that connects your mailbox to software you choose, such as an AI agent. This policy explains what we access, use, store, and share. Questions go to sean@lmsystems.ai.

Signing in

You sign in with Google, or with a 6-digit code that we send to your email address. If you use Google, we ask only for the openid and email scopes, which give us your email address and your Google account ID. Signing in gives us no access to your mail.

What we access in your mailbox

Gmail. You connect Gmail in a separate step, on Google's consent screen, and approve the permission https://www.googleapis.com/auth/gmail.modify. We use it only to do what you or your API key ask, and to detect new mail. That means we:

list your labels, and search and read your messages and attachments;
send messages and replies, and save drafts;
mark messages as read or starred, apply labels, and move messages to Trash;
watch your inbox so that we can notify you of new mail.

This permission does not allow permanent deletion, and we do not offer that action.

Yahoo, iCloud, AOL, Fastmail, Zoho, and Namecheap Private Email. You give us an app password or mailbox password. We use it to connect over IMAP and SMTP with TLS, for the same actions.

What we store

We do not store the bodies of your messages, your attachments, or the content of mail you send. We fetch or pass through that content when you ask for it. We store only the items below.

Your account: Your email address, your Google account ID if you use Google sign-in, and the dates you joined and last signed in.; Kept until you ask us to delete your account.
API keys: A hash of each key, its name, its first 12 characters, and the dates you created and last used it.; Kept until you revoke the key.
Sessions: A hash of the token in your sign-in cookie.; Kept for up to 30 days, or until you sign out.
Sign-in codes: A keyed hash of the latest code for your address, its number of attempts, and when we sent it.; Kept for up to 70 minutes.
Mailbox details: Your address, provider, display name, the ID you give the mailbox (if any), connection dates, and sync position and errors.; Kept until you disconnect the mailbox.
Credentials: Your Google refresh token or mailbox password, encrypted with AES-256-GCM.; Kept until you disconnect the mailbox.
New-mail records: For each new inbox message: message and thread IDs, folder, subject, sender and recipient names and addresses, date, read and starred status, and size. For Gmail, the record also holds the short text preview that Google provides.; Kept for up to 90 days, or until you disconnect the mailbox.
Connection records: Each time a mailbox connects: the mailbox's address, provider, account ID, the ID you give it (if any), and the time.; Kept for up to 90 days, or until you disconnect the mailbox.
Webhook settings: The URLs you register and their signing secrets, encrypted with AES-256-GCM.; Kept until you delete the webhook or disconnect its mailbox.
Webhook delivery records: Status, number of attempts, and the last response code or error for each delivery.; Kept for up to 90 days, or until you disconnect the mailbox.
Send records: A hash of your idempotency key and request, the send status, the message ID, and the addresses that the mail provider accepted or rejected. We use these to prevent duplicate sends.; Kept until you disconnect the mailbox.
Sign-in state: An encrypted temporary value that secures Google sign-in and the Gmail connection.; Kept for 10 minutes.
Server logs: Request method, path, IP address, time, and error codes. Paths can contain account and message IDs. Logs do not contain mail content, search terms, or API keys.; Kept for a limited time, for security and to operate the service.

How we use this data

We use your data only to provide the features you set up: your account, API access to your mailbox, new-mail notifications, webhooks, duplicate-send protection, and security. We do not use it for any other purpose.

Who receives your data

You and the systems you choose. Anyone with your API key can act on your connected mailboxes, and we send webhooks to the URLs you register. This includes any AI agent or AI provider you connect. Those systems follow their own terms, so choose them with care and keep your API key secret.
Your mail provider. We send your requests to Google or your IMAP and SMTP provider.
Our service providers. MongoDB Atlas hosts our database, Cloudflare serves this website, Postmark sends our sign-in emails, and Google Cloud runs the API. Postmark receives your email address and the sign-in code. These providers process data for us, under contract.
Authorities, when required. We disclose data if the law requires it, or if we need to investigate abuse or protect the security of the service.

We do not sell your data. We do not transfer it to advertising platforms, data brokers, or information resellers. We do not use it to serve ads or to decide if someone is creditworthy.

Google user data

mail-api.io's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data also follows the Google Workspace API User Data and Developer Policy. This section describes all Google user data that mail-api.io accesses, uses, stores, and shares.

Google user data we access

Google sign-in (scopes openid and email): your email address and your Google account ID.
Gmail (scope https://www.googleapis.com/auth/gmail.modify): your labels; your messages, including their headers (subject, sender, recipients, dates, and message IDs), text and HTML bodies, and attachments; the read, starred, and label state of each message; the short text preview that Gmail provides; and your Gmail address and mailbox history ID.

How we use Google user data

We use Google user data only to provide these user-facing features of mail-api.io:

to sign you in to your mail-api.io account;
to carry out the requests that you make, or that software makes with your API key: search and read messages, download attachments, send messages and replies, save drafts, mark messages as read or starred, apply labels, and move messages to Trash;
to detect new mail in your inbox and send a notification to the webhook URLs that you register;
to keep the service secure, prevent abuse, and fix errors.

We do not use Google user data for advertising, we do not sell it, and we do not use it to decide if someone is creditworthy. We do not use Google user data, including Google Workspace API data, to develop, improve, or train generalized or non-personalized AI or ML models, and we do not transfer it to anyone for that purpose.

How we share Google user data

With you and the software you choose. Anyone who uses your API key receives the Gmail data that they request. The webhook URLs that you register receive a record of each new inbox message: its IDs, subject, sender and recipients, date, read and starred state, size, and Gmail's text preview. You decide which software gets your API key and which URLs you register.
With the providers that run our service. Google Cloud runs the API, so your Gmail data passes through it. MongoDB Atlas stores the records listed in the next part. They process the data only to run mail-api.io, under contract.
When the law requires it. We disclose data to comply with the law, to protect the security of the service, or as part of a merger or sale of assets after we get your explicit consent.

We do not sell or transfer Google user data to advertising platforms, data brokers, or information resellers.

How we store and protect Google user data

We do not store the bodies of your Gmail messages, your attachments, or the content of mail you send. That content passes through our servers only while we answer your request.
We store your Gmail refresh token encrypted with AES-256-GCM. We store your Google sign-in email address and account ID with your account.
We store the records described in "What we store": new-mail records with Gmail's text preview, connection records, and send records.
We use TLS for every connection to Google and to webhook URLs. MongoDB Atlas encrypts our stored data. We keep API keys and sign-in sessions only as hashes. Only the operator of mail-api.io can access our production systems.
Our staff do not read your Google user data unless you give explicit consent for specific messages, it is needed for security purposes, the law requires it, or the data is aggregated and anonymized for internal operations.

How long we keep Google user data, and how to delete it

Your Gmail refresh token and send records: until you disconnect the Gmail account.
New-mail records and connection records: up to 90 days, or until you disconnect the Gmail account.
Your Google sign-in email address and account ID: until you delete your mail-api.io account.
To delete this data, disconnect the Gmail account with DELETE /v1/accounts/:accountId, or email sean@lmsystems.ai. We answer within 30 days. You can also remove our access at any time at myaccount.google.com/permissions; after that, we cannot access your Gmail.
Deleted data can remain in database backups until those backups expire.

Security

We use TLS for connections to mail providers and for webhooks. We encrypt stored credentials and webhook secrets with AES-256-GCM, and we sign webhooks with HMAC-SHA256. No system is perfectly secure. If an incident affects your data, we will notify you and any other parties that the law or our providers require.

Your choices and deleting your data

Disconnect a mailbox. Send DELETE /v1/accounts/:accountId, or email us. This deletes the mailbox’s stored credentials, new-mail records, delivery records, send records, and webhooks tied to it. It does not delete any mail in your mailbox.
Remove Google access. Disconnecting does not cancel the access you gave in your Google Account. You can cancel it at myaccount.google.com/permissions.
Ask us. Email sean@lmsystems.ai to request a copy, correction, or deletion of your data, or to delete your account. We answer within 30 days.

Deleted data can remain in database backups until those backups expire.

This website

This website uses no analytics or third-party scripts. Cloudflare serves it and processes technical request data, such as IP addresses, to deliver and protect it. When you sign in, our API sets one cookie that keeps you signed in, and Google sign-in also uses a cookie that lasts 10 minutes and protects that step. We do not use cookies for ads or tracking.

Other policy details

Children. The service is not for anyone under 16, and we do not knowingly collect their data.

International processing. We and our service providers can process your data in the United States and other countries.

Changes. We will post any change on this page and update the effective date. If a change is significant, we will also tell you by email before it takes effect.