Legal

Privacy Policy

Last updated: 6 October 2026

1. Introduction

This Privacy Policy explains how HealthInbox processes personal data when you use the HealthInbox browser extension and the healthinbox.site website. It is written to comply with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and with the Google API Services User Data Policy.

HealthInbox finds the online accounts and paid subscriptions tied to your Gmail address. It works on one principle: your email data never leaves your device. Reading, analysis, classification and storage all happen locally in your browser. The only thing our server ever learns is the Gmail address you use, so it can tell whether that address has a Pro licence.

2. Data Controller

The data controller is HealthInbox, a French sole trader (entrepreneur individuel) registered under SIREN [TO COMPLETE: SIREN]. For any question about your personal data, or to exercise your rights, write to contact@healthinbox.site. Full publisher details are in our legal notice.

3. Data We Process

This is an exhaustive list.

3.1 On your device only

  • Email headers: the From, Subject, Date, List-Unsubscribe, X-Mailer, Precedence, List-Id and Content-Type headers of your messages, with each message's id, labels and size. They are read through the official Gmail API and stored in your browser's extension storage.
  • What HealthInbox derives from them: the list of services you have an account with, your recurring payments and subscriptions, the category of each sender, your inbox health score, and the decisions you record for each account (keep, deleted, secured, ignored).
  • Your Google profile: your Gmail address, display name and profile picture link, shown in the extension so you know which account is connected.
  • Preferences: theme, scan progress and similar settings.

None of this is ever sent to us or to anyone else. HealthInbox never requests the body of your emails or their attachments.

3.2 On our server

  • Licence check: when the extension checks your licence or opens the subscription portal, it sends the Google-signed identity token issued at sign-in. Our server verifies Google's signature, reads the Gmail address it contains and looks it up in our licence table. The token itself is not stored.
  • Licence records (only if you buy Pro): your purchase email address, your Stripe customer id and your licence expiry date.
  • Abuse protection: a truncated, one-way hash of your IP address, with a request counter, used to limit licence checks to 60 per hour. The raw IP address is not stored.

3.3 At Stripe

Payment details are handled entirely by Stripe, our payment provider. HealthInbox never sees your card number or bank details.

4. Legal Basis for Processing

  • Email headers and the account inventory: legitimate interest (Art. 6(1)(f) GDPR). You connect your own mailbox to see which accounts and subscriptions exist in it. The processing is local, limited to headers, and stops when you disconnect.
  • Licence check and licence records: performance of a contract (Art. 6(1)(b) GDPR). We need your address to deliver the Pro subscription you bought.
  • Abuse protection: legitimate interest (Art. 6(1)(f) GDPR) in keeping the licence service available.
  • Invoices: legal obligation (Art. 6(1)(c) GDPR) under French accounting law.

5. Gmail API Access and Google User Data

HealthInbox asks Google for the gmail.readonly scope, plus openid, email and profile. The gmail.readonly scope gives read-only access to your mailbox. Google does not offer a narrower scope that still allows searching, which HealthInbox needs to find account emails across your whole history, so the scope would technically allow reading full messages. HealthInbox does not do so: every request uses the Gmail API's metadata format with the header list above, so message bodies and attachments are never downloaded. HealthInbox cannot send, delete, label or modify anything in your mailbox.

The Gmail access token is held in the extension's memory and sent only to Google's APIs. It is never sent to our server.

HealthInbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Google user data is used only to show you your accounts, subscriptions and inbox insights;
  • it is not transferred to anyone, and never leaves your device;
  • it is not used for advertising, sold, or used to build profiles;
  • no person reads it, ourselves included;
  • it is not used to train AI or machine learning models. The classification model runs locally and learns nothing from your data.

6. Local AI Model

To sort senders into categories, the extension downloads a small open-source language model from Hugging Face the first time it is needed. It then runs entirely in your browser. The download is an ordinary file request: no email data is sent to Hugging Face.

7. Processors and Recipients

We rely on the following processors under Article 28 of the GDPR. None of them receives any email data.

  • Cloudflare, Inc.: hosting of the website and of the licence API.
  • Supabase, Inc.: storage of licence records and rate-limit counters.
  • Stripe Payments Europe, Ltd.: payments, invoices and the subscription portal.

Google (sign-in and the Gmail API) and Hugging Face (model download) are services your browser contacts directly; they are not our processors and receive nothing from us.

8. International Transfers

Cloudflare, Supabase and Stripe may process licence data outside the European Union, in particular in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Chapter V GDPR). Email data is never transferred, since it never leaves your device.

9. Data Retention

  • Local data stays on your device until you delete it. "Disconnect Gmail" in the extension Settings revokes Gmail access and permanently deletes every scanned header, the account inventory and your recorded decisions. Uninstalling the extension also deletes it. Your Pro licence is kept and works again when you reconnect.
  • Licence records are kept while your subscription is active and deleted within 12 months after it ends.
  • Invoices are kept by Stripe for 10 years, as French accounting law requires.
  • Rate-limit counters are overwritten every hour and hold no raw IP address.

10. Your Rights

Under Articles 15 to 22 of the GDPR you have the following rights.

  • Access and portability (Art. 15 and 20): "Export my data" in the extension Settings downloads your local data as JSON.
  • Erasure and objection (Art. 17 and 21): "Disconnect Gmail" erases all local data and stops processing. You can also revoke HealthInbox's access at any time from your Google Account.
  • Rectification (Art. 16): HealthInbox only reads your mailbox, so there is nothing it could rectify there. For your licence record, write to us.

For data held on our server, write to contact@healthinbox.site. We answer within one month (Art. 12 GDPR).

11. No Profiling or Automated Decisions

HealthInbox does no profiling and makes no automated decision with legal or similarly significant effects (Art. 22 GDPR). The local classification and the accounts list are tools for you; they have no effect outside your browser.

12. Cookies and Tracking

The website sets no cookies and uses no analytics or tracking. The extension does not monitor your browsing.

13. Right to Lodge a Complaint

You can complain to a data protection authority, in particular in the EU country where you live. In France this is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.

14. Changes to This Policy

We will update the date above whenever this policy changes. If a change affects how your Google user data is used, the extension will ask for your consent again first.

15. Contact

contact@healthinbox.site