InboxFold Privacy Policy

Effective date: October 21, 2026

InboxFold is an Android app for parents. It reads your school emails in Gmail and turns them into a short list of things to do and dates to remember.

This policy explains what InboxFold reads, what it keeps, who helps us run it, how long we keep things, and how you delete everything.

Who we are

InboxFold is made by Four Sprouts LLC, 9059 Foxhunter Ln, Cincinnati, OH 45242-4631, United States ("we", "us").

Questions or requests: support@inboxfold.app

The short version

• InboxFold asks Google for read-only access to your Gmail. It cannot send, change, move or delete your email.
• Our server and Google's Gemini AI read your school emails to make your list. We keep what the AI found, plus each email's sender, subject and date. We do not keep copies of your emails.
• During first-time setup, email text is stored for a short time and deleted when setup ends.
• No ads. No third-party analytics or advertising tools. We do not sell your data.
• Optional: if you say yes to "Help improve InboxFold?", the developer may read a few usage numbers for your account (never what your cards or emails say), using an AI coding assistant (Anthropic's Claude). You can change this in Settings > Account & privacy.
• We do not use your Gmail data to train AI models.
• You can delete your account and data in the app at any time, or by email.
• Removing the app from your phone does not delete your data or stop email checks. Checks continue for up to 14 days. Use Delete account instead.

What InboxFold does with your Gmail

During first-time setup, InboxFold searches the last 90 days of your Gmail for three kinds of emails:

1. emails from about 30 known school services, such as ParentSquare, Canvas, PowerSchool and ClassDojo;
2. emails with school or activity words, such as "school", "PTA", "field trip", "coach" or "recital". This search skips Gmail's Promotions and Social tabs and emails you sent;
3. emails from the schools' own email addresses that InboxFold finds in the first two (for example, every address ending in your school district's name).

These searches also look in Trash. They never look in Spam. The school-word search takes only the newest 100 matching emails. From all three searches, InboxFold reads the newest emails, up to a set limit, to find your children's schools, teachers and activities. It does not read the other emails in your mailbox. Some matches may turn out not to be about school, for example an email that mentions a coach.

After setup, InboxFold checks only for new emails from the senders and words listed in the app under Settings > Scanning > Email sources. You can see and change this list. These checks do not look in Trash or Spam. They run on our server, even when the app is closed. By default this happens every hour. You can pick another schedule, or Manual Only, under Settings > Scanning > Check for new emails. You can also tap Check Now at any time.

When you open an email in the app, our server fetches it from Gmail at that moment and sends it to your phone. It is not stored on our server. Pictures in the email load on your phone straight from the sender's web addresses, as in any email app. An attachment you open is saved on your phone for a short time and handed to the app you choose to open it with.

When you tap Calendar on a card and choose a calendar, the card's title, date, place, school, details, child names and links are passed to Google Calendar or to the calendar app you choose. They then follow that app's rules, and deleting your InboxFold account does not remove them.

For each email it reads, InboxFold may also read:

• its attachments (PDFs, pictures and calendar invites);
• pictures shown inside the email, downloaded from the web addresses in the email (like opening the email, this can tell the sender's picture host that the email was read);
• Google Docs, Sheets, Slides and Drive files that the email links to, only if anyone with the link can open them. InboxFold never signs in to read a linked file.

Google data we access, and why

Google shows this read-only access on its permission screen as "View your email messages and settings". That is Google's standard wording for this permission.

What we keep, and why

Your InboxFold account

• Your sign-in record from Google: email address, name and profile photo link.
• Your family details: children's names, grades, schools, teachers (names and email addresses), classes and activities. The AI finds these in your emails, and you can edit them.
• Your email sources, settings and time zone.
• The last time you opened the app (used for the 14-day pause below); how many visits you made on each of your most recent 60 days of using the app; when you handled, muted or edited a card; and when you last changed each setting. These are dates and counts only, and stay until you delete your account.
• Your answer to "Help improve InboxFold?" (yes or no), which version of the question you answered, when you answered, and when you first said yes and to which version.

What the AI found

• Your cards: title, details, dates, place, school, the child it is about, and links from the email.
• What you did with them: marked handled, edited, muted, reminders you set.

A list of the emails InboxFold read

• For each email: sender name and address, subject, date, and which cards it made. Not the email's text.
• Gmail's ID for each email already read, or waiting to be read again, so none is read twice.

Your Gmail access key

• The Gmail access key Google gives us so our server can read your Gmail (Google calls it a "refresh token"). It is stored only on our server, never on your phone.

For notifications

• For each phone: its notification address, a random device ID, the app version and its notification settings.
• Reminders you set, and the notifications we send. A notification shows a card's title on your phone.

Problem reports

• When you send a report from the app: your account email address, your account ID, what you typed, your Android version and app version.
• With "Include diagnostics & logs" (on by default; you can turn it off): the app's last 30 log lines. These are technical steps and error messages. They are built to leave out email text and passwords.
• Automatic reports: if the app or an email check fails, a short report is sent to us on its own. It includes your account email address, the error type and technical details. It does not include the text of your emails. A report about an email check can list Gmail's IDs for the emails involved; these stay in our database.
• Reports are also emailed to our team through Resend (see "Who helps us run InboxFold") and kept in our team inbox, which Google hosts. For a report you send, that email includes your account ID and your email address so we can reply. For an automatic report, it includes your account ID but not your email address, and no Gmail IDs.

On your phone

• A copy of your lists and settings, so the app works offline. Signing out on a phone, or deleting your account in the app on it, clears that phone's copy. Other phones keep theirs until you sign out or remove the app there.
• A note that someone has signed in on this phone before, and which tips you have already seen. These hold no personal details and stay after sign-out.
• If the app crashes, its report can wait on the phone and be sent the next time the app opens with an account signed in. A report saved while one account was signed in is never sent under another account.

Server logs

• Technical lines with your account ID, device ID and counts. They are designed to leave out email addresses and email content, and our checks of the logs have found none.

How we use your data

We use your data only to:

• run InboxFold for you: find school emails, make and update your cards, send the notifications and reminders you asked for, and show you the emails behind a card;
• keep the service working and secure: fix problems, stop abuse and limit how often the service can be called;
• answer you when you contact us;
• see, in numbers, how the app is used, so we can improve it. These dates and counts are stored in your account; they are not shared with any analytics service or advertiser. The developer reads them for your account, using an AI coding assistant (Anthropic's Claude), only if you said yes to "Help improve InboxFold?".

We use your school email content only to provide InboxFold's features.

We do not use your data for advertising. We do not sell it. InboxFold has no third-party analytics or advertising tools and does not use your phone's advertising ID.

How the AI works with your emails

InboxFold uses Google's Gemini API (Gemini Developer API, paid tier) to read your emails.

• During setup and for each check, our server sends Gemini only the emails found as described in "What InboxFold does with your Gmail": each email's sender, subject, date and text, its attachments, the pictures inside it, and the linked files InboxFold could open. During setup, this can include matches that turn out not to be about school, and matches in Trash.
• With them, Gemini gets: your name and Gmail address (so it can tell your own emails apart), your family details and email sources (so it can tell which child an email is about), and your existing cards and muted topics (so it updates cards instead of repeating them).
• Email text is cut to a set length and cleaned before it is sent. Gemini is told to ignore any instructions written inside emails.
• Gemini sends back the cards and any new family details (such as a new teacher or activity). We store those.

Under Google's terms for the paid Gemini API, Google does not use what we send or what Gemini returns to improve its products. Google keeps it for a limited time only to detect and prevent misuse of its service, or when the law requires it.

We do not train AI or machine-learning models with your data, ours or anyone else's.

AI can make mistakes. A card can be wrong or miss something. Always check the original email for anything important. Each card links to the emails it came from.

Google API Services: Limited Use

InboxFold's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

InboxFold also follows the Google Workspace API User Data and Developer Policy, which covers Gmail.

In plain words, for the data we get from your Gmail:

• We use it only to provide InboxFold's features that you see in the app, or, for the usage numbers you agreed to share, to improve those features.
• We do not transfer it to anyone, except to provide those features (the Gemini API and Google Cloud run InboxFold for us; Calendar passes a card to your calendar when you tap it), to improve those features with your agreement (Anthropic's AI coding assistant, which the developer uses to read the usage numbers you agreed to share; see "Who helps us run InboxFold"), for security (for example, investigating abuse), or to comply with the law.
• We do not use it for ads, and we never sell it.
• No person reads it, unless you ask us to (for example, to look into a card you reported) or you agree to it (for example, to let us read the dates and counts of how you use the app), it is needed for security (for example, investigating a bug or abuse), or the law requires it.
• We do not use it to train AI or machine-learning models.

Who helps us run InboxFold

These companies process data for us, under their terms, to run or improve the service.

Apart from the companies above, we share data with others only if the law requires it, or to protect the safety and security of our users or the service. If Four Sprouts LLC is merged or sold, we will ask for your consent before your Gmail data moves to the new owner.

How long we keep your data

Automatic deletions in our database use Google's automatic clean-up. Google says it usually removes expired data within 24 hours of the date shown below. Copies held by other companies, and the developer's chat history, follow the times in their own rows.

Deleting your data and removing access

Delete account in the app (Settings > Danger zone, at the bottom). This:

1. asks Google to remove InboxFold's access to your Gmail;
2. deletes your account (including its usage numbers and your answer to "Help improve InboxFold?"), family details, cards, email list, settings, reminders and phone registrations;
3. deletes setup's stored email text, if any;
4. deletes your sign-in record;
5. keeps your problem reports only as cleaned copies, for 6 months (see the table above);
6. does not remove usage numbers the developer already read, if you said yes to "Help improve InboxFold?". That copy is deleted within 30 days of being read (see the table above).

If Google does not confirm that it removed our access, we keep the Gmail access key for up to 7 days only to retry, then delete it. The app tells you if this happens, so you can also remove access yourself.

Your Gmail messages are not touched. Deleting your account cannot be undone.

Without the app: email support@inboxfold.app from the Gmail address you use with InboxFold, and ask us to delete your account. We reply to that address to check the request is yours, and delete your account once you confirm. See Delete your account.

Remove InboxFold's access in your Google Account: go to https://myaccount.google.com/permissions, choose InboxFold and remove access. Email checks then stop, and our stored Gmail access key no longer works. What InboxFold already saved, including that key, stays until you delete your account.

Email checks after you sign out or uninstall

Email checks run on our server, not on your phone. So:

• After you sign out, checks for that account keep running for up to 14 days, but that phone no longer gets notifications for it.
• After you remove the app, checks also keep running for up to 14 days. Your data and the Gmail access key stay.
• After 14 days without opening the app, checks pause. They start again when you open the app.

To stop everything, use Delete account, or remove InboxFold's access in your Google Account.

How we protect your data

• Data travels between the app, our server and Google over encrypted connections (HTTPS). The app does not allow unencrypted connections.
• Google encrypts our database and stored keys on its disks.
• Your Gmail access key stays on our server. The app cannot read it.
• Database rules let each signed-in person reach only their own account's data. Some data, such as the Gmail access key and phone registrations, only our server can read.
• Every request the app makes to our server code checks your sign-in, checks with Firebase App Check that the call comes from our app, and has a limit on how often it can be made.
• Setup's temporary email text is kept in a separate database that the app cannot reach.
• The app turns off Android backups and phone-to-phone transfer of its data.
• The tools we use to build and fix InboxFold, including AI coding assistants, are never given the text of your emails or cards, your family details or problem reports. They see only server logs, which leave out email content. If you agree, they may also see the numbers you agreed to share: visits each day, how many cards are active, handled or muted, and when you handled, muted or edited them, when you changed a setting, and your app version. They also see when you first said yes. They never see the text of your cards or emails.
• Only one person at Four Sprouts LLC has owner access to the server project.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you as the law requires.

Children

InboxFold is for parents and guardians aged 18 or over. It is not meant for children, and children should not use it.

Because InboxFold reads school emails, it handles information about your children: names, grades, schools, teachers, classes and activities, as they appear in your emails or as you enter them. We use this only to make your list. It is deleted with your account, except anything you typed into a problem report yourself (see "How long we keep your data"). We do not collect information directly from children.

Where your data is stored

InboxFold is offered only in the United States. Our main database is stored in Google Cloud in the United States. Google may process data in other countries where it has facilities.

Your choices

• See and change your family details, email sources and settings in the app.
• Turn off Include diagnostics & logs before sending a problem report.
• Turn notifications off in the app or in Android settings.
• Turn Share usage counts on or off in Settings > Account & privacy. It decides whether the developer may read your usage numbers: visits each day, how many cards are active, handled or muted, and when you handled, muted or edited them, when you change a setting, and your app version. The developer also sees when you first said yes. Turning it off stops future reading; numbers already read can't be taken back.
• Delete your account at any time.
• For any other request about your data, such as a copy of it or a correction, email support@inboxfold.app. We answer within 30 days.

Changes to this policy

If we change this policy, we will post the new version here and update the effective date. For important changes, we will also tell you in the app or by email before they take effect. If a change affects how we use your Gmail data, we will ask for your consent first.

Contact

Four Sprouts LLC
9059 Foxhunter Ln, Cincinnati, OH 45242-4631, United States
support@inboxfold.app