Privacy Policy

Mailnook · Last updated 4 November 2026

Mailnook is run by Joshua Buxton, trading as Elevatic Studios, in Adelaide, South Australia ("we", "us"). It connects your email accounts to AI assistants: Claude (by Anthropic) and ChatGPT (by OpenAI). This policy explains what we collect, why, where it's kept, who else is involved and how to delete it. We aim to handle personal information in line with the Australian Privacy Principles.

The short version

• We don't store your emails. They're fetched live from your mail provider when you or your assistant ask, and passed to the assistant in that moment.
• We store what Mailnook needs to sign in for you: your mailbox password, or for mailboxes connected with Google or Microsoft, an access key from that company. Both are encrypted with a key unique to your account.
• We don't sell your data, use it for advertising, or use it to train AI.
• There are no analytics or advertising trackers on our pages.
• You can delete everything at any time from the control panel.

What we collect

• Your account: your email address. Sign-in is handled by Google Firebase Authentication; we never see your Google password or your Mailnook password.
• Your mailboxes: for each one, its email address, mail server settings, the label, sender name and signature you choose, and either its password or app password, or (for Gmail connected with Google, or Outlook / Microsoft 365 connected with Microsoft) the access key that company gives Mailnook. Both are stored encrypted.
• Notes and permissions for your assistant: any instructions you write in the control panel for it to follow, overall or for one mailbox, and what you allow it to do in each mailbox.
• Activity: a list of what your assistants did (for example "Sent an email", "Moved 3 messages"), with the mailbox, time, number of messages or recipients, and whether it worked, plus when a new assistant connected and which one. It never includes email content, subjects, addresses or search terms. You can see it on your account page. Deleted automatically after 30 days.
• Assistant sign-ins: records of the Claude or ChatGPT connections you approve, stored only as one-way hashes. New connections also appear in your activity list.
• Usage counts: how many recipients you've emailed today, for a safety limit that stops runaway sending. Deleted automatically after about two days.
• Payments (paid plans only): handled by Stripe and its reseller Link ("Sold through Link"), which collects the billing name, address and payment details needed to charge you and work out tax. We keep a Stripe customer ID and your subscription status, never your card details.
• Technical logs: basic request information (such as time, route and outcome) kept by our hosting provider for a limited period to run and secure the service. We don't log email content or passwords.

How your email is used

When you ask Claude or ChatGPT to do something with your mail (search, read, open attachments, draft, send, forward, move or mark messages, or create folders), Mailnook signs in to your mail provider, performs that action and returns the result to the assistant. Email content, including attachments, passes through our servers only to complete that request and isn't saved by us. This includes messages other people have sent you, which are handled the same way.

Once content reaches your assistant, it's part of your conversation, and that company's own terms and privacy policy apply to it (Anthropic for Claude, OpenAI for ChatGPT).

Google user data

When you connect Gmail with Google, Mailnook asks Google for access to your Gmail (to read, organise, draft and send mail when you or your assistant ask) and your email address (to match the mailbox). Mailnook uses this only to provide those features to you. It doesn't store your emails, sell this data, use it for advertising, or let people read it, and it doesn't use it to train AI models. Mailnook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Mailnook's access at any time in your Google Account, under Security and your connections to third-party apps, or by removing the mailbox in Mailnook, which also asks Google to cancel the access.

Microsoft user data

When you connect an Outlook.com, Hotmail, Live or Microsoft 365 mailbox with Microsoft, Mailnook asks Microsoft for access to that mailbox over IMAP and SMTP (to read, organise, draft and send mail when you or your assistant ask), plus basic sign-in details. Mailnook uses this only to provide those features to you. It doesn't store your emails, sell this data, use it for advertising, or let people read it, and it doesn't use it to train AI models. Microsoft gives Mailnook a new access key each time it's used; Mailnook keeps only the latest one, encrypted. You can remove Mailnook's access at any time at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts), or by removing the mailbox in Mailnook, which deletes its access key.

Who else is involved

• Google Cloud / Firebase runs the service and stores the information above. The service and its database run in Google's Sydney region. A backup copy of the database from before 3 November 2026 is kept in Google's United States region. Encryption keys are held in Google Secret Manager.
• Anthropic (United States), if you use Claude, and OpenAI (United States), if you use ChatGPT, receive the results of the actions the assistant asks for, as part of your conversation.
• Stripe and Link (United States and elsewhere) process payments and act as the seller of paid plans if you upgrade, under their own privacy policies.
• Your mail providers (for example Google, Microsoft, Apple or Spaceship) receive Mailnook's sign-ins and actions on your behalf.

Your account and mailbox details are stored in Australia. Your assistant (Anthropic or OpenAI) and Stripe process information in the United States and elsewhere, under their own policies. We don't share your information with anyone else unless the law requires it.

Security

Mailbox passwords are encrypted with AES-256-GCM using a data key unique to your account, which is itself encrypted with a master key held in Google Secret Manager. All connections use TLS. Only your account can use your mailboxes, and our database can't be read directly from the internet. No system is perfectly secure; if a breach is likely to cause you serious harm, we'll tell you as soon as we can and explain what to do.

How long we keep it

Your account and mailboxes are kept until you remove them. Removing a mailbox deletes its saved password or access key immediately, and for Google asks Google to cancel the access. Delete my account in the control panel removes your mailboxes, passwords, notes, assistant sign-ins and account, and cancels any subscription. Expired sign-in records and usage counts are deleted automatically. If we remove an account for breaking our terms, we keep only its email address, so it can't be used to sign up again. Stripe keeps payment records as the law requires.

Your choices

• See and change what's stored in the control panel.
• Sign your assistants out at any time (Sign out everywhere in the control panel), or disconnect Mailnook in Claude or ChatGPT.
• Revoke the app passwords you created with your mail provider at any time.
• Ask us for a copy of your information, or to correct or delete it.

Who can use Mailnook

Mailnook is for people aged 18 and over. We don't knowingly collect information from anyone younger.

Questions and complaints

Email contact@elevaticstudios.com. We'll reply within 30 days. If you're not satisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy in a way that matters, we'll update the date above and email account holders before the change takes effect.