Privacy Policy

InboxAxe is operated by ZagAIrot Technologies LLC.

Last updated: September 21, 2026

Information we process

We process account information, hosted-mailbox messages and attachments, product settings, approval records, usage events, and support communications needed to provide InboxAxe. Stripe processes payment-card information; InboxAxe does not store full card numbers.

How we use information

We use information to provide and secure your mailbox, classify and organize messages, prepare user-requested drafts and marketing work, enforce approvals and usage limits, process subscriptions, troubleshoot the service, and respond to support requests.

Email and AI processing

InboxAxe processes mailbox content to provide the features you request. Email content is treated as untrusted data and cannot grant itself permission to send, publish, charge, or change account controls. We do not sell customer data or use private mailbox content to train public AI models without explicit permission.

Sharing

We disclose information only to service providers needed to operate InboxAxe, when you direct us to do so, or when legally required. Providers are limited to the information needed for their role. We do not sell personal information or share it for behavioral advertising.

Security and isolation

InboxAxe uses encrypted transport, access controls, tenant-scoped data access, encrypted mailbox credentials, signed delivery events, rate limits, and approval controls. No online service can guarantee absolute security.

Connected accounts (Google/YouTube, TikTok, X, LinkedIn, Meta)

InboxAxe can publish on your behalf to social accounts you connect. Connecting is always optional, always started by you, and always revocable. We never connect an account for you, never post without an explicit approval recorded in your account, and never use a connected account to read or collect data about anyone other than you and your own channel.

For every connected platform, InboxAxe stores only: the access and refresh tokens issued to your account (encrypted at rest, scoped to your user ID), your own account/channel identifier and display name, and the record of what was posted and when. We do not copy your followers, your audience lists, your private messages, or other users' personal data from any platform. Tokens are used solely to perform the action you approved.

Google and YouTube

If you connect a YouTube channel, InboxAxe uses YouTube API Services through Google OAuth. We request these scopes and use them only as described:

Limited Use. InboxAxe's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it except as required to provide the feature you requested or where the law requires, and do not allow humans to read it except with your explicit consent, for security or abuse investigation, to comply with law, or on data that has been aggregated and de-identified. Google user data is not used to train generalized or public AI/ML models.

By using InboxAxe's YouTube features you are also agreeing to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

You can revoke InboxAxe's access to your Google account at any time from the Google security settings page, myaccount.google.com/permissions (also reachable at security.google.com/settings/security/permissions). Revoking there stops all InboxAxe access immediately. To have the stored tokens and cached channel data (channel title, ID, counts, cached comment text) erased from our systems as well, email sam@inboxaxe.com; we delete the tokens on receipt and the cached data within 30 days. They are also erased automatically when you delete your InboxAxe account.

TikTok

If you connect a TikTok account, InboxAxe requests the scopes user.info.basic (your own display name and open ID, so the desk can show which account is connected) and video.publish (to upload a video you asked InboxAxe to publish). InboxAxe does not read your TikTok inbox, your followers, your analytics, or anyone else's content. Nothing is published without an approval you record in InboxAxe. While InboxAxe's TikTok integration is pending TikTok's content-posting audit, every video it uploads is created with the privacy level SELF_ONLY — visible only to you inside your own TikTok account — and InboxAxe cannot make it public. We retain only your TikTok open ID, display name, tokens, and a record of what was posted. Revoke access in the TikTok app under Settings and privacy → Security and permissions → Manage app permissions. To have the stored tokens and cached profile data erased from our systems, email sam@inboxaxe.com; we delete the tokens on receipt and the cached data within 30 days. TikTok's own handling of your data is described in the TikTok Privacy Policy.

X, LinkedIn and Meta (Facebook / Instagram)

If you connect these accounts, InboxAxe requests only publishing and identity permissions: X — tweet.read, tweet.write, users.read, offline.access; LinkedIn — openid, profile, w_member_social; Meta — public_profile, pages_show_list, pages_manage_posts, pages_read_engagement, business_management, instagram_basic, instagram_content_publish. These are used to identify the account you connected, to list the Pages or Instagram accounts you own so you can pick one, and to publish the specific post you approved. We do not read your direct messages, harvest your followers, or use these permissions for advertising. Revoke access at any time in each platform's own app-permissions settings; to have the stored tokens and cached profile data erased from our systems as well, email sam@inboxaxe.com.

Reddit and Hacker News: public content only, no account connection

InboxAxe holds no Reddit or Hacker News account, login, password or OAuth token, and never asks you for one. It cannot post to either service as you, and it never posts to either on its own.

To find people publicly asking for the kind of help you sell, InboxAxe reads public feeds from those sites — Reddit's public search feed (reddit.com/search.rss, optionally narrowed to subreddits you choose) and Hacker News. The crawler identifies itself with the User-Agent InboxAxe-LeadSignals/1.0 and links back to this section as its contact URL, spaces its requests out, rate-limits itself and backs off on HTTP 429. It reads only those public search feeds — it does not spider or crawl the rest of a site.

From a matching public post it stores only what the author already published: the title, a short excerpt, the public permalink, the public author handle and the timestamp — so the post can appear on your desk as a warm lead. It does not read private messages, does not collect email addresses or phone numbers from these sources, and does not build profiles of the people who posted. Replies are always drafts: a human sends them by hand from their own account, because automated promotional replies break Reddit's rules. We do not sell this data and we do not share one customer's leads with another.

If you wrote a public post and want it removed from our index, or you operate a site and want the crawler to stop, email sam@inboxaxe.com and we will remove it and block the source.

InboxAxe Messages (Android app)

InboxAxe Messages is an optional Android app that can act as your phone's default SMS/MMS app. When you install it and sign in, it reads the text messages and pictures already on your phone and the names in your contacts (contacts are used on the device only and are not uploaded) so it can show your conversations sorted and let your InboxAxe intelligence draft replies. The text and pictures of your own conversations are sent over an encrypted connection to your InboxAxe account so the same threads appear on your InboxAxe desk. Nothing is sent from your phone unless you tap Send, or you approve a specific reply on your desk. We never sell or share your messages, never use them for advertising, and never share them with other users. Messages stay in your phone's own SMS store, so you can switch back to any other texting app at any time without losing anything. Mirrored messages are deleted when you delete your InboxAxe account, or on request to sam@inboxaxe.com.

Retention and deletion — how to delete your data

We retain information while your account is active and as needed for security, legal, billing, and operational obligations. You may request access, correction, export, or deletion at any time.

To delete your account and your data: email sam@inboxaxe.com from the address on the account, with the subject Delete my account. No other information is required, and there is no charge. We confirm receipt and delete your data by hand, usually within 30 days. Automatic deletion is not built yet.

What is deleted: your profile and login, mailbox messages and attachments held by InboxAxe, mirrored SMS/MMS from InboxAxe Messages, leads and contacts you imported, drafts, approval records, connected-account tokens, and cached third-party profile data (including any Google/YouTube, TikTok, X, LinkedIn and Meta data). Connected-account tokens are revoked on request. Copies held in backups and older copies of our database can persist after deletion until we remove them by hand; we do not yet keep a fixed backup schedule.

What may be kept, and why: billing and tax records required by law (retained up to 7 years), and security/abuse and server logs needed to protect the service. We do not yet delete logs on a fixed schedule. These are kept separately from product data and are not used for any other purpose.

Our audit log: we keep a tamper-evident, append-only audit log. Entries in it cannot be edited or removed without breaking the chain, so we do not delete them. They hold identifiers and short excerpts of conversations with the assistant.

Deleting one connection instead of the account: revoke InboxAxe in that platform's own app-permissions settings (links above), then email sam@inboxaxe.com naming the platform. We delete that platform's stored tokens on receipt and its cached profile data by hand, usually within 30 days. The rest of your account is untouched. To remove a connected mailbox, email sam@inboxaxe.com naming the mailbox: we delete its stored credentials on receipt and its cached messages by hand, usually within 30 days.

We confirm every deletion request by email.

Cookies

InboxAxe uses essential browser storage and cookies for authentication and product operation. We do not use third-party behavioral-advertising cookies.

Contact

Email sam@inboxaxe.com for privacy requests or questions.