Privacy Policy

1. Scope

This policy explains how Mudroom handles information when you visit the website, connect a Gmail account, review classifications, enable Gmail filing, restore mail, or correct a decision. It applies to the Mudroom service and its supporting infrastructure. It does not govern Google, TypeSafe AI, Anthropic, Neon, Vercel, Stripe, or other services under their own terms and policies.

2. Information Mudroom accesses

Google account and authorization data

Mudroom receives your Gmail address, the permissions Google actually granted, and OAuth tokens needed to keep the connection working. The refresh token is encrypted at rest with AES-256-GCM. Access tokens are short-lived and held only in a small in-process cache. Tokens are never intentionally written to application logs.

Gmail metadata

Mudroom stores limited message metadata needed for synchronization and classification: Google message and thread identifiers, sender name and address, subject, message date, Gmail label identifiers, whether bulk-mail headers were present, and classification results. A scan of Sent mail records relationship facts such as whether you previously emailed a sender and which threads you participated in; it does not store sent message bodies.

Message content

Deterministic classification does not fetch a message body. Only an ambiguous message that reaches the model layer may be fetched in full. Mudroom converts the content to text, removes hidden content, caps the excerpt, classifies it in memory, and discards it. There is no message-body column, body cache, or body log.

Information you provide

Mudroom stores explicit correction clicks and, if you choose to provide it, a short classification-context statement about the kinds of email that would be expensive for you to miss. Mudroom does not learn from scrolling, dwell time, opens, unread state, or ignored rows.

Billing information

If you start a membership, Stripe collects your card and billing details directly. Mudroom stores Stripe customer, subscription, price, and checkout identifiers, subscription status, trial eligibility, and billing period dates. Mudroom does not store your card number or security code. If you pay before connecting a mailbox, a temporary internal account and a secure billing cookie keep track of your purchase. The purchase is linked only after you authorize your mailbox provider, not by matching the email entered during payment.

3. How information is used

Mudroom uses this information only to:

• connect and authenticate your Gmail account;
• synchronize the minimum message metadata needed for the service;
• produce and explain hold or surface decisions;
• apply your explicit, account-specific corrections;
• after you explicitly activate Gmail filing, label HOLD decisions and archive them by removing INBOX;
• restore individually corrected or bulk-restored messages to Inbox;
• secure, troubleshoot, and operate Mudroom; and
• manage membership, payment status, and access to ongoing sorting;
• revoke access and delete your Mudroom data when you disconnect.

Separately from filing, Mudroom can move junk to your Gmail Trash: mail Gmail has already put in Spam, and mail Mudroom filed as promotional, newsletter, notification, social, bulk, or scam that then sat untouched for thirty days. Trashed mail stays in Trash, where you can restore it, until Gmail deletes it thirty days later. Mudroom never permanently deletes mail and, holding only gmail.modify, technically cannot. It never bins a message that is starred, marked important, from anyone you have emailed, in a thread you took part in, or that you corrected: and never a receipt or a piece of cold outreach. You can turn this off on the account page, and turning it off takes effect immediately.

Gmail filing is off by default for every account. If you separately turn it on after reviewing the dry run, Mudroom creates or reuses theMudroom/Held label, applies it to classified HOLD messages, and archives those messages by removing INBOX. Archived messages remain in All Mail and searchable. Mudroom does not compose or send mail. It requests only the single gmail.modify scope.

4. Google user data and Limited Use

Mudroom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Mudroom does not sell Google user data, use it for advertising, build advertising profiles, determine creditworthiness, or transfer it to data brokers. Mudroom does not use Google Workspace data to develop, improve, or train generalized or non-personalized AI or machine-learning models. Data is not pooled across users for training or recommendations.

5. Service providers and disclosures

Mudroom does not sell personal information. It uses a small number of service providers to operate the service:

• Stripe processes membership payments, card verification, subscription renewals, and billing management. Mudroom sends an internal user identifier and plan information, not mailbox addresses, OAuth tokens, subjects, or message content. Stripe collects the billing information you enter in Checkout and processes it under its own privacy policy.
• Google provides Gmail and OAuth. Mudroom sends requests to Google only to provide the connected-Gmail feature you requested.
• Neon hosts the PostgreSQL database containing account, encrypted-token, message-metadata, decision, and correction records.
• Vercel hosts the web application and processes ordinary request and infrastructure data needed to deliver it. Mudroom routes application logging through redaction controls designed to exclude tokens, addresses, subjects, and message content.
• TypeSafe AI provides the current Layer 6 classifier, Jev, through Vercel AI Gateway. When deterministic rules cannot decide, Mudroom sends the sender address and name, subject, provider labels, and a sanitized body excerpt of up to about 2,000 characters. The model returns a constrained choice and probability, and Mudroom checks the result before acting. The gateway request disallows prompt training. Mudroom does not currently enforce zero data retention through the gateway. TypeSafe AI processes requests under its own terms and data processing addendum. Mudroom does not pool classification data across its users.
• Anthropic processed ambiguous messages classified before the move to Jev. Its commercial API terms prohibit training on customer content and describe retention of API inputs and outputs for up to 30 days, with longer retention for flagged policy violations.

Mudroom may also disclose information when required by law, to protect users or the service from fraud or abuse, or as part of a business transfer with notice and protections appropriate to the data involved.

6. Retention and deletion

Local billing records remain while your Mudroom account exists. When you disconnect your last mailbox, Mudroom first confirms cancellation of any membership, then deletes the local billing records with your account. Stripe keeps its own customer and transaction records under its retention requirements; deleting your Mudroom account does not delete those records from Stripe. If cancellation fails, Mudroom asks you to retry rather than reporting that account deletion succeeded. If you have paid but have not connected a mailbox, use Billing in the same browser to manage the subscription, or contact support to resolve the purchase and request deletion of the temporary account.

Account records and message metadata are retained while your Gmail connection exists so review, correction, synchronization, and explicitly enabled filing features work. Mudroom also stores whether filing is enabled, when it was first enabled, when a hold was applied, and the HTTP status associated with audited Gmail mutations. Mudroom does not claim an automatic retention schedule that the software does not yet enforce. When you use Disconnect, Mudroom attempts to revoke the Google token and then permanently deletes the user row and all linked account, token, message, sender, thread, decision, correction, summary, and audit records from its database. Database deletion proceeds even if Google's revoke endpoint is unavailable or the grant was already revoked.

Message content sent to the Layer 6 classifier is never stored by Mudroom. It is fetched, sanitized, classified in memory, and discarded. Mudroom's database holds only message metadata, the resulting decision, a reason code, confidence, and mailbox-action audit state. Provider handling of transient content is described in section 5.

Infrastructure providers may retain encrypted backups or security logs for limited periods under their own retention schedules. Google data is never intentionally placed in application logs.

7. Security

Mudroom uses PKCE and one-time state values for OAuth, encrypted refresh tokens, signed HTTP-only session cookies, same-origin checks on mutations, user-scoped database operations, and redacted logging. Model output is constrained to a fixed schema, untrusted email content is isolated from instructions, and every classifier failure defaults to surfacing the message. The public Data Use & AI Safety page explains these controls in plain language.

No online service can guarantee absolute security. If you believe your connection or data is at risk, disconnect Mudroom and contact support.

8. Your choices

• You can skip or clear the optional classification context.
• You can undo explicit classification corrections.
• Gmail filing is off until you explicitly activate it.
• You can turn off new holds or bulk-restore everything Mudroom archived; both restoration actions add INBOX and remove the Mudroom held label.
• You can disconnect at any time from Mudroom or revoke access from your Google Account permissions page.
• You may contact support to ask what information is associated with your account or request deletion if you cannot access the Disconnect action.

9. Children

Mudroom is not directed to children under 13 and is not intended to collect their personal information. Do not use the service if you cannot legally consent to these data practices in your jurisdiction.

10. Changes to this policy

Material changes will be posted here with a new effective date. If a change materially expands how Gmail data is used or shared, Mudroom will provide additional notice and obtain consent when required before the new use begins.