Privacy Policy

InboxAI — Outlook Add-in  Privacy-first

Last updated: 29 March 2026

1. Overview

InboxAI is an Outlook add-in that provides AI-powered email analysis, summarization, and writing assistance. We are committed to protecting your privacy. This policy explains what data is (and is not) collected.

2. Data We Do NOT Collect

• We do not store, transmit, or log any email content on our servers.
• We do not collect personal information such as your name, email address, or contacts.
• We do not use analytics or tracking cookies.
• We do not sell any data to third parties.

3. How AI Processing Works

InboxAI supports three modes:

• Local AI (Ollama): All processing happens entirely on your own machine. Email content never leaves your device. This is the most private option.
• InboxAI Cloud ☁️: Email content is sent over an encrypted (HTTPS) connection to InboxAI's own server, which routes it to an AI provider and returns the result. We never store, log, or retain your email content. It is processed in memory and discarded immediately after the AI responds. It is never used for training, never shared with third parties, and no human ever reads it. Only the license key and usage counter are stored.
• Third-party Cloud AI (Claude, OpenAI, Mistral): If you choose a cloud provider and enter your own API key, email content is sent directly from your browser to that provider's API. InboxAI's servers are not involved. You are subject to that provider's privacy policy.

A privacy notice is shown in the add-in whenever a cloud mode is selected.

4. License Key Validation

When you activate InboxAI with a license key, the key is sent to our license validation server to verify its authenticity.

A licence is tied to your Outlook account rather than to a particular computer, so that it keeps working when you reinstall, clear Outlook's cache, or use both Outlook on the desktop and Outlook on the web. To do that without holding your email address, the add-in takes a one-way SHA-256 hash of your mailbox address on your own device and sends only that hash. Your email address itself is never transmitted to or stored by us, and the hash cannot be reversed back into it. We use it for nothing except telling one licensed account apart from another.

Alongside it we store the licence key and the number of accounts it has been activated on. No name, address or contact details are associated with a licence.

5. Local Storage

InboxAI stores the following data locally in your browser (never on our servers):

• Your selected AI provider and model preferences
• Your API keys for cloud providers, stored in your browser's local storage on your own device. They are never transmitted to InboxAI's servers, and are sent only to the provider you chose (Claude, OpenAI or Mistral) when you make a request. You can remove them at any time with the "Clear API key" button in Settings.
• Your license key activation status
• Your PIN (hashed, if set)

6. Children's Privacy

InboxAI is not directed at children under 13. We do not knowingly collect data from children.

7. Changes to This Policy

We may update this policy occasionally. Changes will be posted on this page with an updated date.

8. Contact

Questions? Contact us at support@ex-tr-ap.com

InboxAI is a trading name of Gül Yüce, who is the data controller responsible for the processing described in this policy.