Privacy Policy

When you connect a Gmail or Google Workspace mailbox, you are sent to Google to grant access. MCSquared Mail requests:

• Your email address (openid, email) — used to know which mailbox you connected, so it can be registered as one of your addresses.
• Access to that mailbox (https://mail.google.com/) — used to read your mail into this app, file and organise it, and send from that address.

MCSquared Mail acts as your mail client for a connected account. It reads the messages in that mailbox so they can be shown, searched, triaged and replied to here, in the same way a desktop mail program does. Nothing in the mailbox is used for any purpose other than operating the service for you.

What is stored is your address, a refresh token encrypted at rest with AES-256-GCM, and the messages synced into the service. The token is exchanged for a short-lived credential when the service acts on your behalf, and is never displayed, exported, or shared.

MCSquared Mail's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google APIs is not used for advertising, is not sold, and is not used to train machine-learning models. It is transferred to third parties only where operating the service requires it: mail providers to deliver what you send, and the AI processing described below, which runs on your mail so the assistant can triage it and draft replies for you.

MCSquared Mail also hosts mailboxes on its own domains. Messages delivered to those addresses — including their content and attachments — are stored so the service can display, search, and act on them, exactly as for a connected mailbox.

Message content is sent to Anthropic's API to power triage, summaries, and drafted replies. This applies to all mail held in the service, including mail synced from a connected Google mailbox. It is used to operate those features for you and for nothing else — not for advertising, not for model training.

Attachments are stored in a private bucket and served only to the signed-in account they belong to. Each customer's data is isolated at the database level by row-level security.

Account records (your sign-in address), notification tokens for devices you have enabled push on, and ordinary server logs. Logs record request metadata, never credentials or message bodies.

Disconnecting a mailbox in Settings deletes the stored token immediately. You can also revoke access directly at myaccount.google.com/permissions, which takes effect regardless of anything on our side.

To delete an account and everything held for it, write to melody@mcsquaredmail.com.

MCSquared Consulting Group, North Carolina, USA — melody@mcsquaredmail.com