← Outbox

Privacy Policy

Last updated: October 31, 2026

What Outbox does

Outbox is a personal outreach CRM operated by Boyd Labs LLC, a New York limited liability company (“we”, “us”). With your permission, it connects to your Gmail account to help you track your own conversations, remember commitments, and prepare follow-up drafts. You are Outbox's customer; your data is never the product.

Google user data: what we access and why

With your explicit consent via Google's OAuth screen, Outbox requests two permissions, and your account's email address:

  • Read, draft, send and organize (gmail.modify): to analyze your own email conversations and build your contact list, relationship summaries, commitment tracker, and follow-up queue; to save suggested drafts into your Gmail drafts folder for your review (drafting is the default everywhere in Outbox); to send a specific email only when you explicitly approve it, by clicking Send or confirming in the assistant; and to move a conversation to your Gmail Trash only when you click Trash on it. Outbox never sends, trashes or deletes anything without your explicit action on that email, and never deletes mail permanently. Two things it does write on its own: the thank-you drafts the morning digest prepares after a meeting, and its update drafts to someone who introduced you, saved to your Drafts folder, where you can edit or delete them (every other draft reaches Gmail only when you click); and a request to Gmail to tell Outbox when new mail arrives, so it can read it.
  • Calendar events (calendar.events): to read your upcoming meetings for prep and reminders, and to create calendar invites (e.g. coffee chats) that you explicitly schedule, on your primary calendar. Outbox never creates or modifies events on its own.
  • Your account's email address (openid, email): to label the connected mailbox and know which Google account you connected. Nothing else from your Google profile is read.

Limited Use disclosure

Outbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Gmail data is used only to provide the user-facing features described above; it is never sold; it is never used for advertising; it is never used to train generalized AI or machine-learning models; and no humans read your data except with your explicit consent for support, when required for security, or to comply with law.

Service providers that process your data

Outbox runs on a small set of service providers. Each receives only what its job requires:

  • Anthropic (directly or via the Vercel AI Gateway): processes message excerpts to generate summaries, commitment tracking, drafts, and news matching, under agreements that prohibit training on your data. Processing is per-request; your mailbox is never shared wholesale. When you add a firm, build a call prep brief or, on Superday, run deep Signals research, Outbox also runs a web search through Anthropic with search terms built from the firm's name, or from the person's name, title and company.
  • Vercel: hosts the application and routes AI requests when the gateway is used.
  • Neon: hosts the database where your synced data is stored.
  • Clerk: handles sign-in and account identity.
  • Stripe: processes payments for paid plans. Stripe collects your payment details directly; Outbox never sees your card number. Stripe receives your name and email address, and no mail or contact data.
  • Apollo, on the Superday plan only: when you look up people at a firm or build a call prep brief, the firm's domain or the contact's name, company, or email address is sent to Apollo to look up public professional details. Your own mail content is never sent to Apollo.
  • Signals' sources: the name of each firm you choose to watch, and for a person you watch their name with the company Outbox read from your mail, are sent as search terms to Google News, the SEC's EDGAR full-text search, the Greenhouse and Lever public job boards, and NewsAPI; the person's title goes only to the AI that filters the results. Nothing else about you goes with them.
  • Clearbit: the firm-name autocomplete queries Clearbit's public suggestion API from your browser with the letters you type. No mail or contact data is sent.
  • Resend: delivers Outbox's own emails to you (your morning digest and post-meeting debrief notes). These go only to your address.
  • Sentry: receives a report when something in Outbox breaks: the error and the page or step where it happened. Outbox removes email addresses from reports and does not attach your mail, contacts or account details.

What we store and for how long

We store: your account profile, contact records derived from your email (names, addresses, companies), message text (up to the first 20,000 characters of each message, cleaned of markup) and metadata, AI-generated summaries, drafts and prep briefs, the promises and follow-ups found in your mail, your Ask Outbox conversations and the notes it keeps from them, the firms, applications and Signals watches you add and the Signals found for them, the calendar meetings Outbox read or created for you, LinkedIn connection data you upload, your plan and payment-processor customer id, a log of the actions the AI took for you, and encrypted OAuth tokens (AES-256-GCM). When you connect Gmail, Outbox reads your newest 500 emails; on a paid plan you can choose your plan's larger number in Settings. After that it reads new mail as it arrives. Stored mail is kept until you delete your Outbox account, so summaries and search keep working; moving a conversation to Trash in Outbox also removes Outbox's stored copy of it. An Ask Outbox conversation is kept for 90 days after its last message, then deleted automatically; the notes Outbox kept from it stay. Disconnecting Gmail stops all reading and revokes Outbox's access, but does not delete what was already stored; deleting your account does. We never see your Google password: Google handles your Gmail sign-in, and Clerk handles your Outbox sign-in.

How we protect your data

Every connection to and from Outbox is encrypted (TLS). Your Google tokens are encrypted with AES-256-GCM before they are stored, and our database provider encrypts all stored data at rest. Only the operator can reach production systems. We read your data only with your permission for support, when needed for security, or when the law requires it.

Sharing between users

Nothing about your email, contacts or LinkedIn connections is ever visible to another Outbox user. Each account sees only its own data, and the database enforces that separation row by row.

Deletion and revoking access

Disconnecting Gmail in Settings deletes your stored OAuth token immediately. You can also revoke Outbox's access anytime at myaccount.google.com/permissions. Deleting your Outbox account removes every row Outbox holds for you automatically, as the deletion happens: your Gmail connection and its token, contacts, messages and conversations, summaries, drafts, promises and follow-ups, meetings and prep briefs, firms, their people and your applications, Signals watches and Signals, LinkedIn connections, Ask Outbox conversations and notes, the log of AI actions, AI status, rate-limit counters, usage records, your billing record, and any waitlist signup on your address. Copies can remain in our database provider's backups for up to 30 days and in our providers' logs for their standard retention periods, after which they are gone. You can also contact us and we will complete deletion within 30 days.

Contact

Questions about this policy: support@useoutbox.app.