Understanding Privacy in InboxZebra

We built InboxZebra with privacy as the foundation, not an afterthought. This guide explains how we handle your data in plain English.

For the formal legal Privacy Policy, visit inboxzebra.com/privacy.

The Privacy Promise

Your emails are yours. They stay on your Mac, processed locally by AI running on your own computer. We never send your email content to cloud servers, we don’t train AI models on your data, and we send zero telemetry or analytics.

Think of InboxZebra as a power tool for your emails that respects your privacy. It’s like having a personal assistant who works in your office and never leaves with your papers.

What “Local Processing” Really Means

Your Email Content Never Leaves Your Mac

When InboxZebra categorizes your emails, here’s what actually happens:

You click “Process Emails”
InboxZebra fetches emails from Gmail/Office 365 (using official APIs, just like the official apps)
Ollama analyzes emails locally on your Mac (the AI model runs entirely on your computer)
Categories are applied back to Gmail/Office 365 (so you see them everywhere)
Data is stored locally in an encrypted database on your Mac

At no point does email content go to our servers. We don’t even have servers to store email data.

What About Cloud AI (Business Feature)?

If you enable Cloud AI with your own Google Gemini API key:

Email content is sent to Google’s Gemini API
You control this with your own API key
You can see exactly what’s sent (subject, sender, snippet)
This is opt-in only and clearly labeled in settings

What Data We Store (And Where)

On Your Mac (All Users)

Everything is stored locally on your computer:

Email Database (Core Data):

Email subjects, senders, dates
Category assignments
Email bodies (encrypted with AES-256-GCM)
Location: ~/Library/Application Support/InboxZebra/

Account Credentials (Keychain):

OAuth tokens for Gmail and Office 365
Protected by macOS security
Location: macOS Keychain (system-managed, encrypted)

App Settings (UserDefaults):

Your categories and descriptions
Learning examples (sanitized emails that help improve accuracy)
Preferences and settings
Location: ~/Library/Preferences/com.inboxzebra.app.plist

In Our Systems (Subscribers Only)

If you purchase a Pro or Business subscription, we process minimal data through trusted payment and licensing services:

What we need:

Your email address (for license delivery and subscription management)
Hardware UUID (to enforce the 2-device limit per subscription)
License key (to validate your subscription)

Where it goes:

Paddle: Payment processing (they handle your credit card, not us)
Keygen: License validation (checks if your license is active)
Resend: Email delivery (sends your license key after purchase)

Important: Your email content never touches these services. Only subscription metadata (email address, license status) flows through this system.

The Learning System: How It Works

One of InboxZebra’s best features is that it learns from your corrections and gets better over time. Here’s how:

What Gets Stored

When you manually categorize an email (or correct a wrong category), InboxZebra saves:

Email subject
Sender name
A short snippet (first 100 characters of the email body)
The category you chose

What Doesn’t Get Stored

Full email bodies
Attachments
Sensitive content
Personally identifiable information beyond sender/subject

Why This Matters

These “learning examples” help InboxZebra understand your preferences. For example, if you always put emails from “newsletter@company.com” in “Newsletters”, it learns this pattern.

Critical point: This learning is local only. Your examples stay on your Mac and improve your results only. We don’t aggregate data across users or train our models using your emails.

Your Data, Your Control

You Can Always:

Export Everything:

Settings → Data Management → Export All Data
Gets: Categories, learning examples, account metadata
Format: JSON file you can open and read

Delete Specific Data:

Clear emails from specific categories
Remove learning examples
Reset category descriptions

Delete Everything:

Settings → Data Management → Clear All Emails
Deletes: All stored emails, categories, learning data
Keeps: Account connections (OAuth tokens)

Remove Accounts:

Settings → Accounts → Remove Account
Deletes: OAuth tokens, account settings
Result: InboxZebra can no longer access that account

Delete the App:

Drag InboxZebra.app to Trash
Result: All data is deleted (it’s all local)

Common Privacy Questions

”Does InboxZebra send my emails to the cloud?”

No. All email processing happens locally on your Mac using Ollama. The only cloud communication is with Gmail and Office 365 APIs to fetch and categorize emails (just like using Gmail’s official app).

If you enable Cloud AI (Business feature) with your own API key, email content is sent to Google Gemini, but this is opt-in and clearly labeled.

”Can you see my email content?”

No. We don’t have access to your emails. Everything is stored locally on your Mac, and we don’t have servers that collect email data.

”What if I use Cloud AI?”

If you enable Cloud AI with your own Google Gemini API key:

Email content is sent to Google (not to us)
You control the API key and can revoke it anytime
You can see exactly what’s sent in the logs
This is completely optional

”Do you track how I use the app?”

No. InboxZebra sends zero telemetry. We don’t track:

How many emails you process
Which features you use
When you open the app
What categories you create
Any usage patterns

The app is completely private and offline (except for connecting to Gmail/Office 365).

”What about the website?”

Our website (inboxzebra.com) uses privacy-focused Umami Analytics:

No cookies
No personal data collection
Anonymized page views only
EU-hosted
GDPR-compliant

We only see aggregate stats like “how many people visited the pricing page” not “who visited and when."

"What happens to my data if I cancel my subscription?”

Your local data stays on your Mac. Canceling a subscription doesn’t delete anything locally. You can continue using the Free tier with 1 account.

Subscription data:

License keys: Remain in Keygen for 90 days (for reactivation)
Payment data: Retained by Paddle per legal requirements (typically 7 years for tax compliance)
You can request deletion by emailing support@inboxzebra.com

How We Compare to Other Email Tools

Many email organization tools work differently. Here’s how InboxZebra stacks up:

Typical Cloud-Based Email Tools

How they work:

You grant access to your emails
Your emails are copied to their cloud servers
Their AI processes emails on their servers
Results are synced back to your inbox

Privacy concerns:

Your email content lives on their servers
They may train AI models on your data
Subject to their data retention policies
Potential for data breaches

InboxZebra’s Approach

How we work:

You grant access to your emails
Emails are fetched temporarily to your Mac
Ollama (local AI) processes emails on your Mac
Categories are applied back to Gmail/Office 365
Encrypted metadata stays on your Mac only

Privacy benefits:

Your email content never leaves your Mac
We never train on your data
No cloud storage of your emails
No external AI services (unless you opt in to Cloud AI)
No data breach risk from us (we don’t store your emails)

Security Measures We Take

Encryption

Email Bodies:

AES-256-GCM encryption at rest
Only decrypted when you view them in the app
Encryption key stored securely in macOS Keychain

OAuth Tokens:

Stored in macOS Keychain (system-level encryption)
Protected by macOS security features
Never exposed in logs or UI

Network Communication:

HTTPS/TLS for all API calls
OAuth 2.0 for authentication
Certificate pinning for license validation

Local Storage Protection

Touch ID/Password:

Required for viewing email bodies
Required for bulk actions
Required for accessing sensitive settings

File Permissions:

Core Data database protected by macOS file permissions
Only InboxZebra can read/write to its data directory
Standard macOS sandboxing applies

When You Buy a Subscription

What Happens When You Purchase

Here’s the exact flow of data when you buy a Pro or Business subscription:

You visit the pricing page and click “Subscribe”
Paddle’s secure checkout opens (not our site)
You enter payment info on Paddle’s system (we never see your card details)
Paddle processes payment and creates your subscription
Paddle sends us a webhook with: your email address, subscription tier, subscription ID
Our webhook creates a license in Keygen (license key generation service)
Resend sends you an email with your license key
You enter the license key in InboxZebra
InboxZebra validates the license with Keygen (public API, no secrets exposed)
Your subscription is activated

What Data Flows Where

Paddle (Payment Processor):

Receives: Email, credit card, billing address, subscription choice
Stores: Payment history, billing info
Purpose: Process payments, handle refunds, manage billing

Keygen (License Manager):

Receives: Email address, license key, hardware UUID
Stores: License status, activation dates, device count
Purpose: Validate subscriptions, enforce 2-device limit

Resend (Email Delivery):

Receives: Email address, license key (in email content)
Stores: Delivery logs (30 days)
Purpose: Send license key email after purchase

Our Webhook (Vercel):

Processes: Subscription events from Paddle
Stores: Server logs (7 days, then auto-deleted)
Purpose: Connect Paddle payments to Keygen licenses

Important Clarifications

We never receive:

Your credit card number
Your billing address
Your payment history

Paddle handles all payment data. We only get notified that “user@example.com purchased Pro subscription” so we can create a license.

You can request deletion of your subscription data by emailing support@inboxzebra.com. This removes your data from Keygen (though Paddle retains payment records per legal requirements).

Privacy in Different Scenarios

Using InboxZebra at Work

Good for: Personal Gmail or Office 365 accounts
Note: If your work email is managed by your employer, they may have visibility into your email access patterns through their admin console. InboxZebra doesn’t change this. It’s the same as using the official Gmail/Outlook apps.

We recommend: Check your company’s IT policy before connecting work email accounts to third-party apps.

Shared Mailboxes (Business Feature)

Privacy note: Shared mailboxes (like team@company.com) are typically managed by your organization. Multiple people may have access to these mailboxes. InboxZebra treats them like any other account, all processing is still local, no data is sent to us.

Multiple Devices

Important: InboxZebra does NOT sync between devices. Each installation is completely independent. This is by design for privacy.

If you use InboxZebra on 2 Macs:

Each Mac has its own local database
Learning examples don’t sync
Categories and settings don’t sync
You’ll need to set up accounts on each Mac

Why? Syncing would require cloud storage, which compromises privacy. We chose privacy over convenience.

Family Members

Recommendation: Each person should use their own Mac user account. InboxZebra data is tied to the Mac user account and stored in that user’s Library folder.

If multiple people share one Mac user account, they’ll share InboxZebra data (emails, categories, settings).

Legal Stuff (Simplified)

If you’re in the EU, you have these rights:

Access: See what data we have about you
Rectify: Fix incorrect data
Erase: Delete your data (“right to be forgotten”)
Port: Export your data
Object: Object to certain processing

For InboxZebra data: Use the in-app export and delete features
For subscription data: Email support@inboxzebra.com
For payment data: Contact Paddle via their customer portal

CCPA (California)

If you’re in California, you have similar rights:

Right to Know: What data we collect and how we use it
Right to Delete: Request deletion
Right to Opt-Out: Opt-out of data sales (we never sell your data)

To exercise rights: Email support@inboxzebra.com

Children

InboxZebra is not intended for children under 13. We don’t knowingly collect data from children.

Summary: Why InboxZebra is Private

What makes us different:

All email processing is local (Ollama on your Mac)
Zero telemetry or usage tracking
Email content never leaves your device (unless you opt in to Cloud AI)
Encrypted local storage
OAuth tokens in secure Keychain
No cloud servers for email data
No training on your data

What we share (only if you subscribe):

Email address → Payment processor (Paddle) → License manager (Keygen)
Hardware UUID → License manager (for device limit enforcement)
We never share your email content or metadata

Your control:

Export all data anytime
Delete data anytime
Cancel subscription anytime
Request deletion of subscription data

Have Questions?

General privacy questions: support@inboxzebra.com
Formal Privacy Policy: inboxzebra.com/privacy (legal document)
Data protection requests: support@inboxzebra.com (subject: “Data Protection Request”)

Response time: Within 3 business days

Last updated: January 2026

This is a friendly guide to help you understand our privacy practices. For the legally binding Privacy Policy, please visit inboxzebra.com/privacy.