Privacy Policy
Last updated: 5 July 2026
1. Introduction
Mail Intelligence ("we", "us", or "our") is an independent project developed and operated by Thungong Chaitaychawantanapon. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service at mail.thatwhy.me. By using Mail Intelligence, you agree to the practices described in this policy.
2. Data we collect
Account information
When you sign in with Google, we receive your name, email address, and profile picture from your Google account. This is used solely to identify your account within Mail Intelligence.
Gmail data
With your explicit permission via Google OAuth, Mail Intelligence reads your Gmail messages to extract structured information such as transaction amounts, dates, vendor names, and action items. We access only the scopes you grant and only while your OAuth connection is active. Raw email bodies are processed in memory and are not stored permanently. We extract and persist only structured metadata (e.g., "Invoice from Acme — ฿1,200 — due 10 July 2026") in encrypted storage tied to your account.
Usage data
We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate, maintain, and improve the service. Logs are retained for 90 days.
3. How we use your data
- To provide and personalise the Mail Intelligence service for you.
- To answer natural-language questions about your inbox and surface actionable insights.
- To compose and send emails on your behalf when you explicitly request it.
- To maintain the security and integrity of your account.
- To communicate service updates, security notices, or support responses.
We do not use your Gmail data to train machine-learning models, serve advertisements, or for any purpose other than delivering the features you use.
4. Google API data disclosure
Mail Intelligence's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only request Gmail scopes necessary to deliver the features you use.
- We do not share Gmail data with any third parties except as required to operate the service (e.g., encrypted cloud storage providers under data-processing agreements).
- We do not use Gmail data for advertising, data broking, or credit assessment.
- Humans at Thatwhy do not read your email content unless you explicitly request support and grant temporary access for debugging.
5. Data sharing and third parties
We do not sell, rent, or trade your personal data. We share data only with:
- Infrastructure providers — Cloudflare (hosting, edge functions) and Cloudflare R2 (encrypted object storage), operating under strict data-processing agreements.
- Authentication — Clerk, which manages sign-in sessions. Clerk stores only your name and email address.
- Legal requirements — We may disclose data if required by applicable law, court order, or to protect the safety of our users.
6. Data retention and deletion
Extracted email metadata is retained as long as your account is active. You may delete individual items at any time from the dashboard. If you disconnect your Gmail account, we stop syncing new emails and all associated extracted data is purged within 7 days. If you delete your Mail Intelligence account entirely, all personal data is permanently removed within 30 days.
7. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). OAuth tokens are stored encrypted and never exposed in logs or client-side code. We follow industry-standard practices including least-privilege access, regular dependency audits, and automated vulnerability scanning.
8. Your rights
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and all associated data.
- Revoke Gmail OAuth access at any time via your Google Account permissions.
- Receive a copy of your data in a portable format upon request.
To exercise any of these rights, email us at [email protected].
9. Children's privacy
Mail Intelligence is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us immediately.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us: