Atzro Privacy Policy

1. Who we are and what Atzro does

Atzro (https://www.atzro.com) is a Gmail sorting service operated by Nucar, run by Chris Dagesse. You can reach us at chris@nucar.com.

Atzro connects to a Gmail account you choose, reads each new email, and files it into labels in that same Gmail account: automated mail leaves the inbox, mail from people and anything that asks you for something stays. It shows you every decision it made and why, lets you correct it, and helps you find large emails you may want to move to Trash. Your mail stays in Gmail; Atzro does not run a mailbox of its own.

2. Google user data we access

Gmail is connected through Google's sign-in (OAuth 2.0). Atzro never sees your Google password. When you connect a Gmail account, Google asks you to grant Atzro these scopes, and Atzro uses each one only as described:

• https://www.googleapis.com/auth/gmail.readonly — Read your email messages and settings. Atzro reads the headers (sender, recipients, subject, date, list and calendar headers) and the text of each new email to decide where it belongs, shows you a message when you open it in Atzro's reader, lists your Gmail labels, and reads the size and attachment file names of large messages for the Storage page.
• https://www.googleapis.com/auth/gmail.modify — Add or remove labels on messages, and move messages to Trash or Spam. Atzro adds and removes labels (its folders), removes a sorted message from the inbox and puts it back, stars a message a person is asking you about, and moves a message to Trash or Spam only when you or a member you invited asks for it. Atzro never deletes a message permanently and never sends, replies to or forwards mail.
• https://www.googleapis.com/auth/gmail.labels — Create and manage labels. Atzro creates one Gmail label per folder you set up in Atzro and lists your labels so it can show them as folders.
• Basic profile (email address, name, picture) — So Atzro knows which Google account signed in or was connected, can show it in the account switcher, and can match an invitation to a shared mailbox to the right person.

Atzro also asks Gmail to notify it when new mail arrives (Gmail's push notifications) so sorting can start within seconds. The notification carries only your email address and a history position, not message content.

3. How we use Google user data

Atzro uses the data it reads from Gmail for these purposes only:

• To decide where each email belongs and to apply that decision in your Gmail.
• To show you your own decisions: the Review queue, the Why? panel, the Dashboard (who is waiting on a reply, volume, top senders, where mail went), History and the Storage page.
• To improve your own sorting rules from your corrections and confirmations. Your corrections are used for your mailbox only; they never train anything shared with other users.

We do not use Google user data for advertising, we do not sell it, and we do not build profiles of you for third parties. No person at Atzro reads your email. The only humans who see your mail inside Atzro are you and the people you invite to a mailbox. If you ask us for support that requires looking at a specific decision, we will ask for your explicit consent first and look only at what you point us to.

Atzro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. What we store

Atzro keeps a database of its own decisions so it can show you what it did and apply your rules. For each email it sorts, it stores:

• The Gmail message id and thread id, the sender (name and address), the recipients (To and Cc, how many there were, and whether you were only Bcc'd), the subject and the date.
• A short snippet of the message text: at most 300 characters, kept as evidence for the Why? panel.
• The decision: the folder (Gmail label) it chose and how confident it was, the probabilities it gave each of your folders, whether the sender read as a person or an automated system, who the reply appeared to be for, whether it was a calendar invite, update or cancellation, whether the email said "do not reply", which of your rules decided (if one did), and whether it stayed in the inbox and why.
• Facts it saw: whether you have written to the sender before and roughly how many emails they have sent you (also cached per sender address for a week), whether the message had an unsubscribe header, where earlier messages in the same thread were filed, and the folder description that matched at the time.
• Your corrections and confirmations: the message, sender, subject and the folders involved.
• Your Dashboard task marks ("done" or "ignored" on an email that was waiting on you) and any note you added.
• For the Storage page, for large emails found by a scan: size, date, sender, subject (up to 200 characters), Gmail label ids and up to ten attachment file names. A tally of what you moved to Trash (count, bytes, when, who).

Atzro also stores your account: your name, email address and profile picture (when Google provides one), the sessions you open (when, from which IP address and browser), the Gmail address of each connected account, the labels and settings you create (folder names and descriptions, the senders and domains you keep in the inbox or block, subject patterns, calendar and sharing preferences), and the people you have shared a mailbox with and their roles.

Google's OAuth access and refresh tokens for each connected Gmail account are stored encrypted at rest and are used only on Atzro's servers to call Gmail for that account.

For billing, Atzro stores the id of your Stripe customer record, your subscription's id, status, seat count and period end, and the ids of the Stripe events it has processed. Your card number goes to Stripe directly and is never seen or stored by Atzro.

What Atzro does not store: full message bodies and attachments. They are read from Gmail when a decision is made or when you open a message in Atzro's reader, and are not retained beyond the 300-character snippet described above. Atzro keeps no copy of your mailbox.

5. Automated processing

To decide where an email belongs, Atzro sends the message's headers (sender, recipients, subject, date), a bounded portion of its text, a few facts (such as whether you have written to the sender before) and your own folder descriptions and recent corrections to an automated classification provider working on Atzro's behalf. The provider processes that data only to return the classification and is contractually bound to the same Limited Use restrictions. Many emails never reach it: senders you block, and senders, subjects, domains or group addresses your rules already cover, are decided by those rules alone on Atzro's servers.

Sub-processors: hosting (Vercel), database (Neon), payments (Stripe), and the automated classification provider described above. Each processes data only to provide its part of the service.

6. Sharing

• With the people you invite to a mailbox. An owner can share a mailbox as editor (can tune folders and rules, clear Review, run clean-ups) or viewer (can look, change nothing). Members see that mailbox's mail, decisions and settings in Atzro; they never see your Google tokens. You can revoke a member at any time.
• With the sub-processors listed above, to run the service.
• Never sold, and never shared with advertisers or data brokers.
• If the law requires it: we may disclose data to comply with a valid legal request, and will tell you unless the law prevents it.

7. Retention and deletion

• Data is kept while your Gmail account is connected to Atzro and your Atzro account exists, so your history, rules and Dashboard keep working.
• Disconnect Gmail (Settings, or the Accounts page) at any time. Atzro stops Gmail's notifications, revokes its access with Google, and erases the stored access and refresh tokens. Sorting stops immediately. The mailbox's decisions, rules and settings remain in Atzro so you can reconnect later without losing them.
• Delete the mailbox (Accounts page, owner only) and every record about it — decisions, corrections, settings, task marks, storage scans and tallies, and member access — is deleted at once.
• Delete your account: email chris@nucar.com from the address you signed up with. We delete your account and everything under it within 30 days and confirm by email.
• You can also revoke Atzro's access from your Google account at https://myaccount.google.com/permissions. Atzro can then no longer read or change anything in your Gmail.
• Labels Atzro created in your Gmail stay in Gmail until you remove them there; nothing in your mailbox is changed by leaving Atzro.
• Operational logs are kept by our hosting provider for a short period for debugging and security and then expire.

8. Security

• Gmail access uses OAuth 2.0; Atzro never handles your Google password.
• Google tokens are encrypted at rest in the database. All traffic between your browser, Atzro's servers, Google and Stripe travels over TLS.
• Sessions expire 24 hours after sign-in and are not silently extended.
• Every request is checked on the server against your membership of the mailbox it concerns; only the mailbox's owner and the members they invited can read it, and only owners can connect, disconnect, share or delete it.
• Atzro's own administration view shows sign-ups, activity and connection health as counts and dates only. It shows no subjects, senders, folders, messages or tokens.

9. Cookies

Atzro sets two cookies: a session cookie that keeps you signed in for up to 24 hours, and a cookie that remembers which of your mailboxes you were looking at. Your theme choice (light or dark) is kept in your browser's local storage. Atzro uses no advertising or cross-site tracking cookies.

10. Children

Atzro is not intended for, and may not be used by, anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, tell us and we will delete it.

11. Changes to this policy

If this policy changes in a way that matters, the date at the top changes and we will say so in the app before the change takes effect. Continuing to use Atzro after that means you accept the updated policy.

12. Contact

Questions, requests to see or delete your data, or anything else about privacy: chris@nucar.com.