How we handle your inbox
Apex Inbox requires access to your Gmail to function. This page explains exactly what we access, why, and how we protect it. If you have questions, email support@apexdigi.org.
Google OAuth and Gmail Access
Apex Inbox connects to Gmail using Google's official OAuth 2.0 flow. You authorize access through Google's consent screen — Apex Inbox never sees or stores your Google password.
We store an OAuth access token and refresh token in our database, encrypted at rest, so the app can sync your inbox without requiring you to re-authorize every session. These tokens grant only the scopes you approved and can be revoked at any time from your Google Account's security settings at myaccount.google.com/permissions.
You can also disconnect Gmail from within Apex Inbox at any time. Go to Settings → Connected Accounts and click Disconnect.
Exact OAuth Scopes We Request
We request the minimum scopes required to deliver the product.
https://www.googleapis.com/auth/gmail.modifyA restricted Gmail scope that allows reading messages, composing and sending email, and modifying message labels (used for actions such as marking messages read and archiving). Apex Inbox uses this scope to sync your inbox, send replies you approve, and manage read/archive state. We do not delete messages or access Google Drive.
https://www.googleapis.com/auth/userinfo.emailIdentifies which Gmail account is being connected so we can associate inbox data with your Apex Inbox account.
https://www.googleapis.com/auth/userinfo.profileProvides your display name and profile photo for use in the app interface.
Email Data Storage and Processing
What we store
For each synced email we store: sender name, sender address, subject, message body text (stripped of invisible formatting characters), a snippet preview, the Gmail message ID, the AI category assigned, and the AI-generated summary. We do not store attachments.
What we send to AI
When classifying an email or generating a draft reply, we send the email subject and body text to Anthropic's Claude API. By default, Anthropic does not use commercial API inputs to train shared models, per their usage policies. We do not have a separately negotiated zero-data-retention agreement beyond Anthropic's standard commercial API terms. Your email content is sent only to generate your specific result — never shared with other users.
Archive and read-state
When you archive or mark an email as read in Apex Inbox, that action currently updates Apex's database only. The email's state in your Gmail inbox is not changed. Gmail synchronization for archive and read actions is planned for a future release.
What we do not do
- ✓We do not sell your email data to any third party
- ✓We do not use your emails to train any AI model
- ✓We do not access your Sent, Trash, or other folders beyond what you sync
- ✓We do not read emails stored before your first sync unless you trigger a sync
Encryption and Transport Security
- ✓All traffic between your browser and Apex Inbox is encrypted over HTTPS (TLS 1.2 or higher)
- ✓All traffic between Apex Inbox and Google's APIs is encrypted over HTTPS
- ✓OAuth tokens are stored as encrypted secrets and are never exposed in client-side code or logs
- ✓Database credentials and API keys are stored as environment secrets managed by Vercel — they are not committed to source code
- ✓Database storage is provided by Neon, which encrypts data at rest
Data Retention and Deletion
While your account is active
Synced email data is retained to power the inbox experience. Follow-up reminders and notes are retained until you delete them.
Disconnecting Gmail
Disconnecting your Gmail account from Settings removes your stored OAuth tokens. Synced email data stored in our database remains until you delete your account. We will add a "delete synced emails only" option in a future release.
Deleting your account
Deleting your account removes all your data — account record, synced emails, follow-ups, and OAuth tokens — from our database within 30 days. You can initiate account deletion from Settings → Danger Zone.
Subprocessors
| Service | Purpose | Location |
|---|---|---|
| Google (Gmail API, OAuth) | Email access and user authentication | United States |
| Anthropic (Claude API) | AI categorization, email summaries, draft reply generation, and Ask AI responses | United States |
| Neon | PostgreSQL database hosting — stores account data, email metadata, and body text | United States |
| Vercel | Application hosting, serverless functions, and CDN | United States |
Access Controls
- ✓All API routes are authenticated — unauthenticated requests return 401
- ✓All database queries are scoped to the authenticated user's ID — one user cannot read another's emails
- ✓Production environment variables are managed through Vercel and are never committed to source control
- ✓Apex Inbox does not yet hold a SOC 2 certification — we are an early-stage product. We are committed to transparent security practices while we grow
Security Contact
To report a security vulnerability or ask questions about how we handle your data, email support@apexdigi.org with the subject line Security Report. We will acknowledge your report within 48 hours.