Privacy Policy

Updated October 16, 2026.

1. Who operates SuperMailbox

SuperMailbox is operated by HARD TAB LLC, a Wyoming limited liability company (“we,” “us,” or “SuperMailbox”). Our public registered-agent correspondence address is 30 N Gould St Ste N, Sheridan, WY 82801, United States. Customer support is available at support@hardtab.com. For privacy requests, contact abalchunas@hardtab.com.

2. Information the service uses

Depending on the features you use, SuperMailbox processes:

• Account information such as your email address, display name, verification state, and account status.
• Session and security information, including session token hashes, sign-in timestamps, browser user-agent information, and IP addresses associated with sessions.
• Connected-mailbox details such as the mailbox address, provider, display label, server settings, sign-in name, connection status, and health timestamps.
• Mailbox credentials, encrypted before they are stored, so the private mail worker can connect to a mailbox you authorized.
• AI-app details such as the client name and identifier, requested scopes, approval or revocation state, and token-expiration metadata.
• Billing identifiers, subscription status, selected plan, connected mailbox count, and plan limit. Stripe handles payment card details; SuperMailbox does not store full card numbers.
• Operational records such as event type, result, timestamps, opaque account or mailbox identifiers, and request-correlation identifiers.
• When product analytics is configured and enabled, basic usage events linked to an opaque account ID or, for anonymous website visits, a random browser ID and session ID. Page views include the page path but not URL query strings. Events do not contain email addresses, message content or identifiers, search terms, mailbox names, OAuth secrets, or raw MCP arguments. You can turn off account analytics in Account settings and anonymous page views on this browser below. We honor browser Do Not Track and Global Privacy Control signals.

3. Email content, Gmail and AI apps

When you use the browser inbox or ask an authorized AI app to search for or open email, SuperMailbox retrieves information from your selected provider. To show mail quickly, the private worker stores an encrypted cache of message lists and opened or prefetched message bodies in the application database. Active server cache entries expire 24 hours after their last use in the app and are bounded to 20 MiB per SuperMailbox account. Search caches retain up to 200 message summaries per search scope. Attachment bytes are fetched on demand and are not stored in this cache.

Cached mail is returned only after checking account access and subscription eligibility. The worker refreshes active mail views in the background; results include when they were checked and whether another check is in progress. Disconnecting a mailbox or deleting an account invalidates its active cache. A background worker checks recently used inbox lists about once an hour; this does not extend their retention or preload attachment bytes. Expired cache records are removed by periodic cleanup. Encrypted database backups have a separate retention period described below.

The browser stores message lists, opened or prefetched bodies, folder summaries and sender identities in account-scoped IndexedDB for up to 24 hours, with a 20 MiB limit per account. This storage can survive a page reload, a new tab and a browser restart. A smaller sessionStorage cache and memory cache provide fallback when persistent storage is unavailable. Signing out, an unauthorized response or a detected account or connection change clears cached mail. Mailbox credentials, session tokens and attachment bytes are not stored in the browser mail cache. Browser mail activity is not sent to an AI app unless you separately use that authorized app.

When you connect Gmail, you sign in through Google and grant SuperMailbox access to the Gmail features you choose to use. The service uses Gmail message metadata, message content and attachments to display and search your mail, and to carry out requested actions such as marking mail read, starring it, managing labels, archiving or moving mail to Trash, managing drafts, and sending, replying to or forwarding mail. Gmail OAuth access and refresh tokens are encrypted in the private service database and used by the private mail worker to maintain that connection; they are not sent to your browser or returned by mail tools. Gmail messages and attachments are fetched when needed. Message lists and opened or prefetched message bodies may be kept in the active encrypted mail cache described above; the service does not otherwise keep a full Gmail archive in its application database.

Accumulated mail search

SuperMailbox's accumulated mail index and semantic search are currently enabled at service level for all active accounts. This index is separate from the 20 MiB, 24-hour active cache described above. It uses only messages returned during normal inbox, message, or provider search activity and bounded background checks of eligible connected inboxes. These background checks can also prefetch a limited number of unread Inbox message bodies before you open them. Prefetched plain text can enter the search index and the Gemini embedding processing described below. The service does not backfill every folder. Mailbox credentials and OAuth tokens will not be indexed. Indexed data may include message metadata, subject text, plain-text content already loaded by the service, and search vectors. The logical quota is 1 GiB per user across metadata, text, and vectors; it is not a physical disk limit or a complete mail archive, and older indexed items may be evicted when the quota is reached. Attachments are not automatically downloaded or indexed. Images, audio, video, and remote images are not sent for embeddings; OCR is not enabled.

With this feature currently enabled for all active accounts, SuperMailbox sends a message's subject and already-loaded plain text to Google's paid Gemini API for batch embeddings, and sends the text of a semantic-search query for an interactive query embedding. No attachment or image is included. The MongoDB staging payload is encrypted with AES-256-GCM. OpenSearch stores the searchable message fields and vectors used for this feature; this is distinct from the encrypted staging copy. This processing is performed by SuperMailbox to provide search and is separate from the email information returned to an AI app you authorize. Google's paid Gemini terms currently say prompts and responses are not used to improve Google products, but may be logged for a limited time for safety and legal purposes and stored or cached in any country where Google or its agents maintain facilities. See the Gemini API Additional Terms.

If you create an automatic mail rule, SuperMailbox checks for new mail in the mailbox so it can match your saved conditions and apply the action you selected. Rules continue to operate while enabled and the mailbox remains connected. Gmail messages moved to Trash are handled by Google’s Trash; SuperMailbox does not use an immediate permanent-delete action. You can disconnect a mailbox in SuperMailbox or review and revoke the connection in your Google Account. Disconnecting clears the credential stored for that connection. A backup created before the disconnect or account deletion may retain its encrypted copy until the backup expires.

Information returned by a tool is delivered to the AI app you chose and authorized. Connecting Gmail by itself does not send your email to an AI app. If you separately authorize mail scopes on the MCP consent screen, the selected client can request email content and attachments from connected mailboxes. When you use its mail tools, SuperMailbox returns the requested information to that client. The client and your mailbox provider handle information they receive under their own terms, privacy, retention and model-use practices. Disconnecting SuperMailbox does not delete information already received by another provider.

4. Mailbox credentials

For iCloud Mail, use an Apple app-specific password; never provide your primary Apple Account password. Credentials are protected with envelope encryption using AES-256-GCM. The wrapping keys are held in Yandex Lockbox and supplied only to the private mail worker, which decrypts credentials for authorized mailbox operations. Credentials stay in the private worker; the browser receives authorized mail results after the service checks your current session, subscription and mailbox access. Disconnecting a mailbox clears its stored credential and stops future access through that connection.

5. How information is used

We use information to create and secure accounts, send sign-in links, connect the mailboxes you select, carry out the mail operations you request, maintain AI-app authorizations, manage subscriptions, protect the service, respond to support requests, and meet legal obligations. We use information only for the service, security, support, and legal purposes described here. Where a separate choice or consent is required for optional processing, we will ask for it separately. Reading this policy is not consent. We do not sell mailbox contents or use them to serve advertising. SuperMailbox itself does not use Gmail data to build, train or improve generalized AI or machine-learning models. Google publishes its current requirements in the Google Workspace User Data and Developer Policy and the Google API Services User Data Policy. A separately authorized AI app is an independent recipient whose own privacy, retention and model-use practices apply.

6. Service providers and sharing

We use Yandex Cloud for the application infrastructure and encrypted database backups; Google for Gmail OAuth and as the provider for user-connected Gmail mailboxes; and, if the semantic-search feature is enabled, Google Gemini API to create text embeddings. Gemini processing is separate from both Gmail mailbox access and any AI app you authorize. We also use Apple iCloud Mail to send one-time sign-in links; Hetzner to route encrypted outbound mail connections through a shared network gateway; Cloudflare for authoritative DNS; Stripe for subscription billing when live billing is enabled; and PostHog for basic product usage analytics when configured. Current processing details are listed on the Subprocessors page.

A mailbox provider you select receives connection requests needed to carry out your instructions. An AI app you authorize receives the information returned by the tools you ask it to use. We do not sell mailbox contents. Google is the mailbox provider you select when you connect Gmail; that connection is separate from the infrastructure providers HARD TAB uses to operate SuperMailbox.

7. Processing locations

The primary application infrastructure, database, secrets, and backup storage run in Yandex Cloud’s ru-central1 region in Russia. The shared mail-network gateway is in Helsinki, Finland. Cloudflare provides authoritative DNS only; web traffic is not proxied through Cloudflare. Apple, Stripe, and other providers may process information in the countries where their services operate. Privacy laws may differ from those where you live.

8. Retention and deletion

We keep account and connection information while needed to provide the service. When account deletion completes, we cancel an eligible active subscription, revoke sessions and AI access, clear mailbox credentials and connection details, and replace the account email and mailbox addresses with non-deliverable identifiers. The account identifier remains so related records can be handled consistently.

• Encrypted database backups in Yandex Object Storage have a configured 30-day lifecycle. Deleting an account does not rewrite backups that already exist, so related data may remain in a backup until it expires.
• Active encrypted server mail caches expire 24 hours after their last use in the app; browser mail caches expire after 24 hours. Server cleanup removes expired cache records periodically; expiry prevents their further use even before cleanup. Database backups may retain encrypted cached mail until the separate 30-day lifecycle expires. Attachment bytes are not persisted in these mail caches.
• If accumulated mail search is enabled, disconnecting a mailbox or deleting an account will block the affected mailbox generation from new search results and queue physical index cleanup. Cleanup is retried until the search index confirms that the affected records are gone, so it may not be immediate. A minimal deletion journal with opaque identifiers and status, but no message body, is retained to prevent deleted data from being restored into search. MongoDB backups made before cleanup may retain encrypted staging data until their configured 30-day expiry; search-index contents are not part of those database backups. A restore must replay the deletion journal before serving indexed mail.
• Core service container logs are rotated by size and limited to three files of 10 MB per service. This is not a fixed time-based retention period. Private monitoring metrics have a configured 15-day and 2 GB limit.
• Billing, authorization and client-registration metadata, audit events, and mail-send operation records currently have no automatic purge period in the application database. Some records may therefore remain after account deletion.

These are current system settings, not a promise that every copy is erased immediately. Revoking an AI-app authorization stops that app's access but does not disconnect a mailbox or delete its cached mail; disconnect the mailbox or delete the SuperMailbox account to start mailbox cleanup. Stripe and other providers retain their own records under their policies and applicable law.

9. Security

Mailbox credentials are envelope-encrypted, the database is private to the application network, backups are separately encrypted, and the mail worker is separated from the public web and API components. These measures reduce risk but cannot guarantee that any internet service is completely secure. Current controls and the security contact are described on the Security page.

10. Cookies

The sign-in flow uses a strictly necessary session cookie. It is HttpOnly and SameSite=Lax, Secure in production, and expires within 30 days. Signing out clears the cookie; clearing it in your browser signs you out. The current web application does not configure advertising or analytics cookies. When configured, basic product usage events are sent from the server to PostHog without an analytics cookie; you can disable this in Account settings.

11. Your choices and privacy requests

You can revoke an AI-app authorization, disconnect a mailbox, manage a subscription, or delete your account from the service. Depending on applicable law, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. To make a request, email abalchunas@hardtab.com, preferably from the address associated with your account. We may ask for information reasonably needed to verify your request. Do not send passwords, sign-in links, or identity documents unless a verified process specifically requires them. We will handle requests under applicable law.

12. Children and policy changes

SuperMailbox is intended for people with the legal capacity to agree to these terms and is not directed to children. We will update this policy when our data practices materially change and provide additional notice where required by law.

13. Contact

Privacy and legal questions: abalchunas@hardtab.com. Customer support: support@hardtab.com. HARD TAB LLC’s public registered-agent correspondence address is 30 N Gould St Ste N, Sheridan, WY 82801, United States.

Template reference: adapted for SuperMailbox from the General Legal GDPR Privacy Policy and Cookie Notice templates, published under CC0 1.0. General Legal did not prepare or review this policy.