Privacy Policy

ClearMail is an inbox cleanup tool operated by FixedLayer Lab (“we”, “us”, “our”). It connects to your Gmail mailbox so you can see which senders consume the most space, unsubscribe from newsletters in bulk, and delete or archive mail you no longer want.

Doing that requires access to your Gmail account, so we hold ourselves to a simple rule: we only touch your mail to power features you can see and trigger yourself. We do not sell your data, we do not use it for advertising, and we do not train machine learning models on the contents of your mailbox. The sections below spell out exactly what that means.

When you sign in with Google, you are shown a consent screen listing the permissions ClearMail requests. We request the narrowest set of scopes that still lets the product work. Here is every scope we ask for and the feature it powers:

What we actually read. To build your sender breakdown and storage analytics, ClearMail reads message metadata — sender address and display name, subject line, date, size, labels, and the List-Unsubscribe header used to process one-click unsubscribes. We do not read, index, or store the body of your emails or your attachments, except for the narrow case of parsing an unsubscribe link out of a newsletter when you ask us to unsubscribe from it.

What we write. ClearMail only modifies your mailbox in response to an action you take in the app: archiving or deleting messages from a sender you selected, applying a label, or creating a Gmail filter after you unsubscribe. We never send email from your account, and we never delete anything you did not explicitly select.

In concrete terms, we commit that ClearMail will:

• Only use Google user data to provide and improve user-facing features that are prominent in the ClearMail interface.
• Never transfer Google user data to third parties, except as needed to provide those features with your consent, for security investigations, to comply with applicable law, or as part of a merger or acquisition after giving you notice.
• Never allow humans to read your Google user data, unless you give us specific affirmative permission (for example, when you ask our support team to investigate a problem with a particular message), it is necessary for security purposes such as investigating abuse, it is required by law, or the data is aggregated and anonymised for internal operations.
• Never sell Google user data, and never use it for advertising, retargeting, personalisation, credit-worthiness, or lending decisions.
• Never use Google user data to train generalised artificial intelligence or machine learning models.

You can read the full policy at Google API Services User Data Policy.

• Account information. Your name, email address, and profile picture from your Google account, used to create and identify your ClearMail account.
• Derived mailbox statistics. Aggregates computed from message metadata — per-sender message counts, estimated storage, and cleanup history — so the dashboard loads without re-scanning your mailbox each time.
• Product usage data. Basic logs about how the app is used (pages loaded, actions taken, errors encountered) to diagnose bugs and keep the service reliable.
• Authentication cookies. Session cookies set by our authentication provider that keep you signed in. We do not use advertising or cross-site tracking cookies.

We use the information described above only to:

• Show you which senders and newsletters are filling your mailbox.
• Carry out the cleanup actions you request — archive, delete, unsubscribe.
• Create Gmail filters that keep unsubscribed senders out of your inbox.
• Display your analytics, storage trends, and cleanup history.
• Keep your account secure and investigate abuse of the service.
• Respond to your support requests and send essential service notices.
• Comply with our legal obligations.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information only with infrastructure providers that process data on our behalf under contract, and only to the extent needed to run the service:

• Google LLC — the source of your mailbox data, accessed through the Gmail API under your authorisation.
• Supabase — our database and authentication provider, which stores your account record and derived mailbox statistics.
• Our hosting provider — serves the ClearMail application and processes requests in transit.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, safety, and property of our users or the public. If FixedLayer Lab is involved in a merger, acquisition, or sale of assets, we will give you notice before your Google user data becomes subject to a different privacy policy.

• OAuth tokens are stored encrypted at rest and are used only to call the Gmail API on your behalf.
• Message metadata and derived statistics are retained for as long as your account is active, so your dashboard stays fast. You can shorten this window from the Settings screen.
• Message bodies and attachments are never stored on our servers.
• On account deletion, we delete your account record, stored metadata, and OAuth tokens within 30 days, except where we must retain limited records to comply with a legal obligation. Backups are purged on their normal rotation.

All traffic between your browser, ClearMail, and the Gmail API is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure providers. Access to production systems is limited to personnel who need it, protected by multi-factor authentication, and database access is constrained by row-level security so one account cannot read another’s data.

No system is perfectly secure, but if we ever become aware of a breach affecting your data, we will notify you and the relevant authorities as required by applicable law.

Depending on where you live — including under the EU/UK GDPR, the California Consumer Privacy Act, and India’s Digital Personal Data Protection Act, 2023 — you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time.

You can exercise most of these rights directly in the app from the Settings screen, or by writing to contact@fixedlayer.com. We respond to verified requests within the timeframes required by applicable law. You also have the right to lodge a complaint with your local data protection authority.

You can disconnect ClearMail from your Google account at any time, and doing so immediately revokes our ability to access your mailbox:

• In ClearMail, open Settings → Disconnect Gmail.
• Or from Google directly at myaccount.google.com/permissions.

Revoking access stops all future syncing. To also erase the data we already hold, delete your account from the Settings screen or email us.

ClearMail is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the product evolves. If we change the way we use Google user data, we will notify you and obtain your consent before the new use takes effect. Material changes will be announced in the app or by email, and the “last updated” date above will always reflect the current version.

Questions about this policy or how we handle your data? We read every message.

• Privacy and data requests: contact@fixedlayer.com
• Product support: support@fixedlayer.com
• Operated by FixedLayer Lab