Open Mailroom
Privacy · Draft
Privacy policy
This policy explains what didntask.ai processes, why, for how long and what you can do about it. It covers the website, the Mailroom app, connected mailboxes, Postage and postage links.
1. Who is responsible
The controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], registered in [COUNTRY] under [REGISTRATION NUMBER]. Contact: [privacy@didntask.ai]. [EU REPRESENTATIVE OR DATA PROTECTION OFFICER, IF REQUIRED.]
2. What we process
| Category | What | Why |
|---|---|---|
| Account | Email address, password hash, session records, security events. | To give you an account and keep it secure. |
| Mailbox connection | Provider, mailbox address, encrypted access tokens or app passwords, folder identifiers. | To read and move mail when you start protection. |
| Message content | Subject and text of eligible messages, read when needed. | To classify a message, to show a preview you open, and to title a Postage reply. Content is processed in memory. It is not written to our database or application logs. |
| Message records | Message identifiers, dates, outcomes, folder changes and reasons. No sender address, subject or body. | To show your activity, to undo actions and to avoid processing a message twice. |
| Your settings | Always-allow entries, sender rules, labels, Postage price and display name. | To apply your choices. |
| Postage requests | A keyed pseudonym of the sender address (not the address), price, fee, status, dates, Stripe payment identifiers, and a fingerprint of the sender's link. | To run payment, delivery, refunds, limits and opt-outs. |
| Letters through a postage link | The sender's name, email address, subject and message, encrypted until delivery. A keyed pseudonym of the sender address. A fingerprint of the confirmation code. | To confirm the sender's address, take payment and deliver the letter to the link owner. |
| Payments | Stripe processes card details. We receive payment identifiers, amount, currency and status. | To take payments, refund and handle disputes. |
| Website visits | IP address and request details, processed by our server. Rate limits store a keyed pseudonym, not the address. | To deliver pages and stop abuse. The website has no analytics or advertising scripts. |
Our classification model runs on infrastructure we control. We do not send your mail to an external AI service.
3. Data from Google and other mail providers
didntask.ai's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same rules apply to data from Microsoft, Fastmail, Zoho and IMAP mailboxes.
- We use mailbox data only to provide the features you see in the app: classify new Inbox mail, move it to the AI Slop folder and back, show previews, and prepare or send the Postage replies you turned on.
- We send email from your mailbox only if you turn on automatic postage requests. Then Gmail sends one reply to each held first-contact sender, 10 minutes after the message is held, unless you cancel it. Before it sends, we search your Sent folder for earlier mail to that address; the search returns message identifiers only. Other mailboxes get a reply draft. Without that setting, we save a reply draft when you ask, and you decide whether to send it.
- We do not use mailbox data for advertising. We do not sell it. We do not give it to data brokers.
- We do not use mailbox data to develop, improve or train generalized AI or machine-learning models.
- People at didntask.ai do not read your mail, unless you ask us to look at a specific message, it is necessary for security, or the law requires it.
- You can disconnect at any time in the app. Disconnect stops access and asks the provider to revoke our grant. You can also remove access in your Google or Microsoft account settings.
4. If someone asked you for postage, or you wrote a letter
A didntask.ai user can ask the sender of a first-contact message to pay postage. The request is a reply from that user's mailbox, sent by the user or, if the user turned it on, automatically. We keep a keyed pseudonym of your address, not the address. You can stop all postage requests to your address on the request page.
If you write a letter through a postage link, we keep your name, address, subject and message encrypted until delivery. We delete the content when the letter is delivered, when it expires after 48 hours unpaid, or when a refund completes. The recipient receives your name, address and message. Stripe receives your payment details as an independent controller under its own privacy policy.
5. Legal bases (EU and UK)
- Contract: your account, mailbox protection, Postage and letters you pay for.
- Legitimate interests: security, abuse prevention, rate limits, sender opt-outs and dispute handling.
- Legal obligation: tax, accounting and lawful requests.
- Consent: where we ask for it, for example before you turn on Postage. You can withdraw it in the app.
6. Who receives data
| Recipient | Purpose | Location |
|---|---|---|
| [HOSTING PROVIDER] | Servers, storage and encrypted backups. | [REGION] |
| Stripe | Card payments, refunds and disputes. | [STRIPE ENTITY AND REGION] |
| [MAIL RELAY PROVIDER] | Confirmation codes and delivery of paid letters. | [REGION] |
| [IDENTITY PROVIDER, IF USED] | Sign-in. | [REGION] |
| Your mail provider | The provider you connect receives our API requests. | Provider's region |
[INTERNATIONAL TRANSFERS: NAME THE SAFEGUARD, FOR EXAMPLE EU STANDARD CONTRACTUAL CLAUSES OR THE EU–US DATA PRIVACY FRAMEWORK.]
7. How long we keep it
| Data | Kept for |
|---|---|
| Message content | Not stored. Processed in memory only. |
| Activity records and security events | 90 days. |
| Postage requests and letter records | 90 days after the last change. Paid items stay until delivery, refund or dispute ends. |
| Letter content | Until delivery, refund or 48 hours unpaid. |
| Confirmation codes | 15 minutes, as a fingerprint. |
| Encrypted backups | 30 days. |
| Account and settings | Until you delete the account. |
| Payment records | Stripe and [COMPANY] keep them as long as tax and accounting law requires. [CONFIRM PERIOD WITH COUNSEL.] |
8. Your rights
You can ask for access, correction, deletion, restriction, portability and objection. In the app, you can export your data and delete your account. To use other rights, write to [privacy@didntask.ai]. We answer within one month. You can complain to your data protection authority. In California and other US states, you have similar rights; we do not sell or share personal information for cross-context advertising.
9. Security
Mailbox credentials and letter content are encrypted at rest. Connections use TLS. Link tokens and codes are stored as fingerprints. Sessions expire after 30 minutes without activity. No system is perfectly secure; we will tell you about a breach as the law requires.
10. Children and changes
didntask.ai is not for people under 16. We will announce material changes in the app and on this page before they take effect.