Privacy Policy

Last updated: 2025

1. Data Controller

The data controller for InboxZebra is Be Specific Consulting Ltd.

Registered Address:
7 Bell Yard, WC2A 2JR
London, United Kingdom

For privacy inquiries, please contact us at the above address.

2. Our Commitment to Privacy

InboxZebra is designed with privacy as a core principle. All email processing happens locally on your Mac. Your email content is never sent to external servers except for necessary API calls to Gmail and Office 365 for fetching and updating emails.

3. Data We Collect

InboxZebra collects minimal data necessary to provide the service:

3.1 Authentication Data

  • OAuth tokens: Access and refresh tokens for Gmail and Office 365 accounts, stored encrypted in macOS Keychain
  • Account metadata: Email addresses, account names, and provider types (Gmail/Office 365)

3.2 Email Data

  • Email metadata: Subject, sender, date, and email IDs
  • Email bodies: Encrypted with AES-256-GCM and stored locally in Core Data
  • Categories and labels: Your custom categories, labels, and categorisation preferences

3.3 Learning Data

  • Category examples: Emails you've manually categorised to improve AI accuracy
  • Custom instructions: Per-account and global customisation rules you've created

3.4 App Settings

  • Ollama model preferences
  • Processing preferences (max emails, date ranges)
  • UI preferences

4. How We Use Your Data

We use your data solely to provide the InboxZebra service:

  • To authenticate with Gmail and Office 365 APIs
  • To fetch and display your emails
  • To categorise emails using local AI processing
  • To learn from your manual corrections and improve accuracy
  • To apply categories and labels back to your email accounts

We do not:

  • Send your email content to external AI services
  • Share your data with third parties
  • Use your data for advertising or marketing
  • Collect telemetry or analytics

5. Data Storage

5.1 Local Storage

All data is stored locally on your Mac:

  • macOS Keychain: OAuth access and refresh tokens (encrypted by macOS)
  • Core Data: Email metadata and encrypted email bodies (AES-256-GCM encryption)
  • UserDefaults: Categories, learning examples, account metadata, and app settings

5.2 Data Encryption

Email bodies are encrypted using AES-256-GCM encryption before being stored in Core Data. OAuth tokens are stored in macOS Keychain, which provides additional encryption and access controls.

5.3 No Cloud Storage

We do not store your data on any cloud servers. Everything remains on your local device.

6. Third-Party Services

InboxZebra integrates with the following third-party services:

  • Gmail API: For fetching and updating emails in Gmail accounts
  • Microsoft Graph API: For fetching and updating emails in Office 365 accounts
  • Ollama: Local LLM server running on your Mac for email categorisation

All API interactions are direct between your Mac and these services. We do not act as an intermediary or store data from these services on our servers.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

7.1 Right of Access

You can access all your data stored by InboxZebra through the app's export feature (Settings → Data → Export Data).

7.2 Right to Rectification

You can update your account information, categories, and settings at any time through the app.

7.3 Right to Erasure

You can delete your account and all associated data at any time by removing accounts in Settings. This will delete all stored emails, categories, and learning data.

7.4 Right to Data Portability

You can export your categories, learning examples, and account metadata using the export feature. Email bodies are not included in exports for privacy reasons.

7.5 Right to Object

You can stop using InboxZebra at any time and delete the application. All data is stored locally and will be removed when you delete the app.

8. Cookies

InboxZebra is a desktop application and does not use cookies. The website (inboxzebra.com) may use essential cookies for functionality, but no tracking or analytics cookies are used.

9. Data Retention

We retain your data only as long as you use InboxZebra. When you delete an account or remove the application, all associated data is deleted. There is no data retention after account deletion.

10. Children's Privacy

InboxZebra is not intended for users under the age of 13. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the application or via email. The "Last updated" date at the top indicates when changes were made.

12. Contact for Privacy Inquiries

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Be Specific Consulting Ltd
7 Bell Yard, WC2A 2JR
London, United Kingdom