You are handing us access to your email. You should know exactly what we do with it. This page is written to be read, not to be survived.
Who-Mail ("we", "us") operates who-mail.com and the Who-Mail application. This policy explains what data we access, what we keep, and who else ever sees it. Questions? Use the contact form.
When you sign in we receive your email address, name and profile picture from Google. We keep these to identify your account.
Who-Mail reads your Gmail through Google's API in order to show it to you and to organize it by sender. Being precise about what is kept versus what is merely passed through:
This is the actual Who-Mail database: your sender list and their categories, display names you edit, tags, groups and feeds, rules, Reply-Later flags, todos, notes, watchlist entries and settings. It is yours; we use it only to run the Service for you.
If you enable contact sync, we read your Google Contacts to power address autocomplete and store names and email addresses for that purpose only.
To check your mail in the background — the thing that makes text alerts work with nothing open — we store a Google refresh token on our server. It is encrypted at rest, never sent to your browser, and never shared. Revoking Who-Mail in your Google account settings makes it useless immediately.
Only if you turn on text alerts. We store it to send you those texts, and for nothing else.
Our servers keep short-lived operational logs (timestamps, error messages, request metadata) for debugging and abuse prevention. We avoid logging message content.
If you ask for beta access we keep the email address and the answers you typed, so we can decide and get back to you.
Who-Mail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely: we use Google user data only to provide and improve the features you can see in Who-Mail; we do not transfer it to others except as needed to provide those features, for security, or to comply with law; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, for security purposes, or where required by law.
We process your data on the basis of your consent (granted at Google sign-in, withdrawable at any time) and to perform our agreement with you — you asked us to organize your mail, and this is what that takes.
We keep the list short on purpose:
We may also disclose data if legally compelled, or to protect the safety and rights of our users. If Who-Mail is ever acquired, your data may transfer as part of that — and we will tell you before it does.
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to people who need it. That said — see the Terms — Who-Mail is beta software and no service can promise perfect security. Do not connect a mailbox whose exposure you could not tolerate.
Depending on where you live you may have additional rights to access, correct, export, delete or object to processing of your personal data. Ask, and we'll honor them.
Who-Mail is not for anyone under 18, and we do not knowingly collect data from children.
If we change this policy materially we will update the date above and make a reasonable effort to tell you by email or in the app before the change takes effect.
Use the contact form — it reaches a real person, and we reply to the address you give us. We don't publish a mailbox address here because scrapers read this page.