Privacy notice

InboxPurity is operated by Richscripts Inc., 198 Kennedy Street West, Aurora, ON L4G 2L7, Canada. Contact [email protected] for support, billing or privacy questions.

Last updated: November 1, 2026.

Information used to provide the service

The launch list stores the email address you submit and the signup time. Signing up does not connect your mailbox. Microsoft sign-in provides account identifiers, email address and, where available, a display name. Microsoft access tokens are held in a server-side token cache; the browser receives a token for the InboxPurity API.

Mailbox scanning processes message metadata, including senders, subjects, dates, folder and message identifiers, read and flag status, and unsubscribe headers. Short previews may be read during processing; full message bodies are not stored in the mailbox index. Cleanup rules, protection choices, operation records and original folder identifiers support the plan and recovery features.

Optional AI

AI processing is off until you give consent in Settings. When enabled, classification sends sender and subject metadata to OpenAI. Requested summaries or reply drafts also send thread excerpts. You can withdraw AI consent in Settings. A supplied OpenAI key is encrypted before storage. Data sent to a provider is also subject to that provider’s terms and retention practices; withdrawing consent does not recall data already processed.

Service providers

• Microsoft provides sign-in and Outlook mailbox access through Microsoft Graph.
• OpenAI processes the inputs described above only when AI processing is enabled and requested.
• Stripe hosts checkout and payment management. InboxPurity stores billing identifiers, payment amounts and refund/dispute state. Card numbers and security codes are not collected by InboxPurity.
• TaskCenter queues service notifications for delivery through Amazon SES. Email addresses and notification content are processed for delivery.

Our application and database store the account and mailbox records needed to operate the service. Providers may process information outside your country. This notice does not claim a particular data residency or certification.

Operational records and retention

Authentication session storage and a local theme preference support the app. Server logs and audit records may include network addresses, timestamps and action identifiers. We count successful plan responses and payments to evaluate the product. The launch pages do not include third-party advertising or analytics scripts.

Recovery journals expire after the displayed 30-day window. Scheduled retention removes finished job records after 90 days, processed Stripe event identifiers after 400 days, and audit records and older indexed mail after 730 days under the current defaults. Payment reconciliation records and launch-list entries are kept separately. Actual removal depends on the scheduled worker running.

Your controls

Protect senders, disable background refresh or withdraw AI consent in Settings. Account deletion removes the mailbox index, rules, credentials, usage and recovery records; audit and payment records are detached and retained for integrity and billing reconciliation. Active jobs or a paid subscription still on record can delay account deletion. Deleting the account does not undo moves in Outlook. Revoke app access in your Microsoft account to stop authorization.

To leave the launch list, ask about retained records or request access, correction or deletion, contact us using the address above. We will review the request and explain any billing or recordkeeping information that must remain. Service-provider records and backups may follow separate retention processes.