Privacy Policy

1. Introduction

Better Email Notifications ("we", "our", "Service") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email notification service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Google account email, name, and profile picture from OAuth authentication
• Contact Information: Phone number for SMS notifications (if enabled)
• Preferences: Notification settings and monitored email threads

2.2 Information from Gmail API

• Email Metadata: Thread IDs, message IDs, timestamps
• Email Snippets: Sender information, subject lines, message snippets (limited to first 200 characters for SMS notifications only)
• Thread Information: Participants and reply status

Important: We do NOT store email content. Email snippets are only temporarily processed to generate SMS notifications and are immediately discarded after sending.

2.3 Automatically Collected Information

• Usage Data: Service access times, features used
• Technical Data: IP address (for security and compliance)
• Notification Logs: SMS delivery status and timestamps

3. How We Use Your Information

We use your information solely to:

• Provide SMS notifications for email replies
• Authenticate and maintain your account
• Monitor and improve service performance
• Prevent fraud and ensure security
• Comply with legal obligations
• Communicate service updates and respond to support requests

4. Google API Services User Data Policy

Our use of Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements:

• We only access the minimum Gmail data necessary for notifications
• We do not sell, share, or transfer your Google data to third parties except as necessary to provide the Service
• We do not use Google data for advertising or marketing
• We do NOT store email content - snippets are only temporarily held in memory during SMS generation and immediately discarded
• We only store minimal metadata (thread IDs, message IDs) required for deduplication

5. Data Storage and Security

5.1 Security Measures

• Encryption: OAuth tokens encrypted with AES-256-GCM
• Transmission: All data transmitted via HTTPS/TLS
• Access Control: Limited access on need-to-know basis
• Infrastructure: Secure cloud hosting with regular security updates

5.2 Data Retention

• Account Data: Retained while account is active
• Email Metadata: History IDs stored for deduplication, deleted after 30 days
• Email Content: NEVER stored - only processed in memory and immediately discarded
• SMS Logs: Retained for troubleshooting (contains only delivery status, not message content)
• Deleted Accounts: All data permanently deleted within 30 days

6. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share information only:

• With Service Providers: Twilio for SMS delivery, cloud infrastructure providers
• For Legal Compliance: When required by law or valid legal process
• For Safety: To protect rights, property, or safety of our Service and users
• With Consent: When you explicitly authorize sharing

7. Third-Party Services

7.1 Service Providers

• Google: OAuth authentication and Gmail API access
• Twilio: SMS message delivery (phone numbers encrypted before sharing)
• Vercel: Application hosting
• Neon: Database hosting
• Google Cloud Platform: Cloud Functions for notification processing

7.2 Third-Party Policies

These services have their own privacy policies. We encourage you to review them.

8. Your Rights and Choices

8.1 Access and Control

• View Data: Access your account information in dashboard
• Update Information: Modify phone number and preferences
• Delete Account: Permanently delete account and all data
• Export Data: Request copy of your data (contact support)

8.2 Notification Choices

• SMS Opt-Out: Reply STOP or disable in dashboard
• Selective Monitoring: Choose which email threads to monitor
• Frequency Limits: Automatic rate limiting (10 SMS/hour)

8.3 OAuth Permissions

You can revoke Gmail access at any time through your Google Account settings.

9. Data Protection Rights (GDPR/CCPA)

Depending on your location, you may have additional rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of data use
• Right to Data Portability: Receive data in machine-readable format
• Right to Object: Object to certain processing activities
• Right to Non-Discrimination: Not be discriminated against for exercising rights

To exercise these rights, contact: help@betteremailnotifications.com

10. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect information from children. If we discover we have collected information from a child, we will delete it immediately.

11. International Data Transfers

Your information may be processed in the United States. By using our Service, you consent to the transfer of information to countries outside your residence country, which may have different data protection rules.

12. California Privacy Rights

California residents have additional rights under CCPA:

• Right to know about personal information collected, used, and disclosed
• Right to delete personal information
• Right to opt-out of sale (we do not sell personal information)
• Right to non-discrimination

13. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you via email within 72 hours of discovery and take immediate steps to secure your data.

14. Cookies and Tracking

We use minimal cookies for:

• Authentication: Session cookies to keep you logged in
• Security: CSRF tokens for form submissions
• Preferences: Remember your settings

We do not use tracking cookies or analytics that identify individuals.

15. Changes to Privacy Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or Service notification. Continued use after changes constitutes acceptance.

16. Contact Information

For privacy concerns or to exercise your rights, contact us at:

17. Legal Basis for Processing (GDPR)

We process personal data based on:

• Consent: Your explicit consent for SMS notifications
• Contract: Necessary to provide the Service you requested
• Legitimate Interests: Security, fraud prevention, service improvement
• Legal Obligations: Compliance with applicable laws