Privacy Policy

Last updated: September 26, 2026

Inboxsteer is an app made by Arlith Technologies ("we", "us") of Brampton, Ontario, Canada. This policy explains what data Inboxsteer accesses, how it is used, where it goes, and the choices you have. We wrote it to be read, not skimmed past.

1. Who we are and how to reach us

Arlith Technologies, Brampton, Ontario, Canada. Privacy contact (our privacy officer under Canada's PIPEDA): bokharij+inboxsteersupport@gmail.com, subject "Privacy".

2. What Inboxsteer accesses

When you connect your Gmail account, you give Inboxsteer permission (the Google scope gmail.modify) to read your messages, labels and drafts, to organize them (labels, archive, read/unread, move to Trash), to create drafts, and to send a draft only after you review it and confirm. Inboxsteer accesses your email only to carry out a request you make in the app, for example "show me the emails from movers" or "reply to 1 and 3". It never deletes email permanently and never sends anything without your confirmation.

3. How your data is used, stored and shared

• Your Gmail sign-in (the access token Google issues) is stored only on your device: in the Windows credential store, or in the app's private storage on Android. It is never sent to our servers.
• Email lists and actions go directly between your device and Google over an encrypted connection.
• AI processing. To understand your request, the app sends your typed request (not your emails) to the AI. When a request needs the content of emails, for example a summary or a reply draft, the text of only the emails involved is sent over an encrypted connection (TLS) to the Inboxsteer AI service operated by us, which passes it to OpenAI to produce the result and returns the result to your device. Our AI service does not store the text of your emails or the AI's answers, and does not log them. It records only usage figures (time, number of AI units used, your account identifier) for billing and limits. We ask OpenAI not to store requests; OpenAI does not use API data to train its models, and may keep requests for a limited time for abuse monitoring under its own terms.
• If you choose to use your own AI in the app's settings (your own OpenAI key or your own AI server), email text goes to that service instead, under its terms, and not to our AI service.
• On your device, the app keeps a local activity log of the changes it made (email subjects, dates, action) and a local encrypted cache. Neither leaves your device unless you export them.
• Billing. If you subscribe, our payment processor (Stripe) handles your payment details; we receive your name, email address and subscription status, never your full card number.
• We do not sell your data, do not use it for advertising, and do not share it with anyone except the processors named here, to provide the service.

4. Google API Services User Data Policy

Inboxsteer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use Google user data only to provide the features you use in Inboxsteer; we do not transfer it except as needed to provide those features (the AI processing described above), for security, or to comply with the law; we do not use it for advertising; we do not allow humans to read it unless you give us permission for a specific message (for example when you send us a support request), it is needed for security, or the law requires it; and we do not use it to develop, improve or train generalized AI or machine-learning models.

5. Where data is processed

Our AI service runs on a server in Canada. OpenAI processes AI requests in the United States. Using the Inboxsteer AI service therefore involves a transfer of the email text needed for a request to the United States, where it may be subject to U.S. law.

6. Security

All connections are encrypted (HTTPS/TLS). Secrets such as your sign-in and access code are kept in your device's secure storage, never in plain settings files. Our server stores no email content, is firewalled, and receives automatic security updates. If a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires.

7. Retention and your choices

• Disconnect Gmail in the app at any time; you can also remove Inboxsteer's access at myaccount.google.com/permissions.
• You can clear the local activity log in the app, or uninstall the app to remove all local data.
• We keep account and billing records (name, email, subscription, usage figures) while you are a customer and as long as tax law requires afterwards. Ask us to see, correct or delete what we hold.
• Support messages you send us are kept only as long as needed to help you.

8. Children

Inboxsteer is a business tool and is not intended for children under 16.

9. Changes and complaints

We will post changes here and tell you in the app when they are significant. If you have a concern, contact us first; you can also contact the Office of the Privacy Commissioner of Canada.