Privacy policy

Last updated 14 October 2026

What Inbox Watcher does

Inbox Watcher monitors a Gmail account you connect and notifies you by text message or phone call when an email arrives from a sender or domain you have placed on your watch list.

What we access

We request the Gmail metadata scope only. This lets us read message headers (sender, subject, date) and labels. It does not permit us to read, download or store the body or attachments of any message, and the application is technically incapable of doing so.

What we store

Your Google account email address and name. An encrypted OAuth refresh token so we can keep checking your inbox. Your watch list. The deadlines you add (title, due time, reminder settings). For each matched message: the sender address and name, the subject line, the time received, and a log of the notifications we sent. We store a daily count of how many messages we examined. We do not store message bodies, attachments, or any header from messages that did not match your watch list.

How we use it

Solely to deliver the notifications you configured. We do not sell data, share it with advertisers, or use it to train machine learning models. Inbox Watcher's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Phone numbers and text messages

We use your phone number only to call and text you about emails from senders on your watch list. Texts are sent only if you opt in by ticking "Text me alerts" in your account. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the carriers and messaging providers required to deliver the messages. Reply STOP to any text to opt out. See Text alerts for details.

Who can see it

Only you, through your account. Our infrastructure providers (Cloudflare for hosting and storage, Twilio for calls and texts) process data on our behalf under their own security commitments. We do not give any human access to your data except to resolve a support request you initiate.

Retention and deletion

Disconnecting your Gmail account deletes the refresh token immediately and stops all monitoring. Deleting your account removes all stored data within 30 days. You can also revoke access at any time from your Google Account permissions.

Security

Refresh tokens are encrypted at rest with AES-256-GCM. All traffic is over TLS. Sessions use signed, HttpOnly cookies. Webhook requests from Twilio are signature-verified.

Who we are

Inbox Watcher is operated by Remedy Center LLC, 125 S 2nd St, Boonville, IN 47601, USA.

Contact

privacy@inboxwatcher.com