Privacy & your data

Updated September 8, 2026

What you authorize

Not Gmail uses Google sign-in to identify your email address and requests Gmail message management permission. This allows the app to display messages, message bodies, attachments, labels, and mailbox counts, search your mail, send messages you compose, and remove the unread label when you explicitly choose Mark all as read or Mark selected as read. This scope permits message management; the app does not offer permanent deletion.

How your data is used

When you browse or search your mailbox, requested Gmail data passes through our server to your browser. When you download an attachment, the requested file passes through our server to your device. HTML messages are displayed in an isolated frame with scripts and external images blocked.

When you click Send, your recipients, subject, and message pass through our server to the Gmail API to send the email from your account. Google processes and retains the sent message under its own policies. Your connected email address is displayed in the account menu.

Storage

Google access and refresh tokens and your email address are stored in an encrypted, HTTP-only session cookie with a lifetime of up to 30 days, renewed when a refreshed token is saved. Our server decrypts the cookie to make authorized Gmail requests. The app does not maintain a mailbox database.

Retrieved mailbox data is held in memory while the page is open and is served with no-store cache instructions. The app does not save retrieved messages to a database or browser storage. Drafts you save locally or carry through Google connection are stored in your browser's session storage until sent, discarded, signed out, or cleared. Downloaded attachments remain on your device until you delete them. Hosting infrastructure may process request metadata for service operation.

Sharing and limited use

Google user data is used to provide the mailbox, connection, and sending features. It is not sold, used for advertising, or used to train AI models. Not Gmail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting local data

Sign out in the account menu to remove the app's session cookie. To revoke Google's authorization, remove Not Gmail from your Google Account connections. Clear this site's browser data to remove any remaining local draft. These actions do not delete messages already sent through Gmail.