Privacy Policy

Mailnook · Last updated 3 November 2026

Mailnook is run by Joshua Buxton, trading as Elevatic Studios, in Adelaide, South Australia ("we", "us"). It connects your email accounts to AI assistants: Claude (by Anthropic) and ChatGPT (by OpenAI). This policy explains what we collect, why, where it's kept, who else is involved and how to delete it. We aim to handle personal information in line with the Australian Privacy Principles.

The short version

• We don't store your emails. They're fetched live from your mail provider when you or your assistant ask, and passed to the assistant in that moment.
• We store what Mailnook needs to sign in for you: your mailbox password, or for Gmail connected with Google, a Google access key. Both are encrypted with a key unique to your account.
• We don't sell your data, use it for advertising, or use it to train AI.
• There are no analytics or advertising trackers on our pages.
• You can delete everything at any time from the control panel.

What we collect

• Your account: your email address. Sign-in is handled by Google Firebase Authentication; we never see your Google password or your Mailnook password.
• Your mailboxes: for each one, its email address, mail server settings, the label, sender name and signature you choose, and either its password or app password, or (for Gmail connected with Google) the access key Google gives Mailnook. Both are stored encrypted.
• Notes for your assistant: any instructions you write in the control panel for it to follow.
• Assistant sign-ins: records of the Claude or ChatGPT connections you approve, stored only as one-way hashes.
• Usage counts: how many recipients you've emailed today, to apply plan limits. Deleted automatically after about two days.
• Payments (paid plans only): handled by Stripe. We keep a Stripe customer ID and your subscription status, never your card details.
• Technical logs: basic request information (such as time, route and outcome) kept by our hosting provider for a limited period to run and secure the service. We don't log email content or passwords.

How your email is used

When you ask Claude or ChatGPT to do something with your mail (search, read, draft, send, move or mark messages), Mailnook signs in to your mail provider, performs that action and returns the result to the assistant. Email content passes through our servers only to complete that request and isn't saved by us. This includes messages other people have sent you, which are handled the same way.

Once content reaches your assistant, it's part of your conversation, and that company's own terms and privacy policy apply to it (Anthropic for Claude, OpenAI for ChatGPT).

Google user data

When you connect Gmail with Google, Mailnook asks Google for access to your Gmail (to read, organise, draft and send mail when you or your assistant ask) and your email address (to match the mailbox). Mailnook uses this only to provide those features to you. It doesn't store your emails, sell this data, use it for advertising, or let people read it, and it doesn't use it to train AI models. Mailnook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Mailnook's access at any time in your Google Account, under Security and your connections to third-party apps, or by removing the mailbox in Mailnook, which also asks Google to cancel the access.

Who else is involved

• Google Cloud / Firebase runs the service and stores the information above. The service runs in Google's Sydney region; the database is in Google's United States region. Encryption keys are held in Google Secret Manager.
• Anthropic (United States), if you use Claude, and OpenAI (United States), if you use ChatGPT, receive the results of the actions the assistant asks for, as part of your conversation.
• Stripe (United States and elsewhere) processes payments if you upgrade.
• Your mail providers (for example Google, Apple or Spaceship) receive Mailnook's sign-ins and actions on your behalf.

Because of this, your information is stored and processed outside Australia, mainly in the United States. We don't share your information with anyone else unless the law requires it.

Security

Mailbox passwords are encrypted with AES-256-GCM using a data key unique to your account, which is itself encrypted with a master key held in Google Secret Manager. All connections use TLS. Only your account can use your mailboxes, and our database can't be read directly from the internet. No system is perfectly secure; if a breach is likely to cause you serious harm, we'll tell you as soon as we can and explain what to do.

How long we keep it

Your account and mailboxes are kept until you remove them. Removing a mailbox deletes its saved password or Google access key immediately, and asks Google to cancel the access. Delete my account in the control panel removes your mailboxes, passwords, notes, assistant sign-ins and account, and cancels any subscription. Expired sign-in records and usage counts are deleted automatically. Stripe keeps payment records as the law requires.

Your choices

• See and change what's stored in the control panel.
• Sign your assistants out at any time (Sign out everywhere in the control panel), or disconnect Mailnook in Claude or ChatGPT.
• Revoke the app passwords you created with your mail provider at any time.
• Ask us for a copy of your information, or to correct or delete it.

Who can use Mailnook

Mailnook is for people aged 18 and over. We don't knowingly collect information from anyone younger.

Questions and complaints

Email contact@elevaticstudios.com. We'll reply within 30 days. If you're not satisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy in a way that matters, we'll update the date above and email account holders before the change takes effect.