InboxCabin

INBOXCABIN · LEGAL

Privacy Policy

Effective October 13, 2026 · Version 2026-10-13.2

Inbox Cabin (“we”), operates the InboxCabin website, blog, Windows app, account portal, licensing service and referral program. This policy explains what we process, why, and the choices you have.

Our account and licensing backend is not a mailbox host. It does not receive your mailbox contents, attachments or webmail session cookies through the backup feature. Optional cloud backup stores an encrypted copy of logins you manually save in InboxCabin, as described below. Gmail and Microsoft still process your email when their websites run inside the app.

1. Data we process

Encrypted cloud backup

When available, you can connect the desktop app to your verified website account and set up encrypted backup. The backup preference starts enabled, but no backup is uploaded until you connect your account and save a recovery key. Backup includes mailbox names, email labels, order, appearance preferences and logins manually saved through InboxCabin. Browser-saved passwords, cookies, active Gmail/Outlook sessions, messages, attachments and profile photos are not included. Restoring on another computer may still require provider sign-in and MFA.

The app encrypts the backup on your computer before upload using a randomly generated recovery key. Our server stores the encrypted copy, its revision and update time; it does not receive that recovery key. You need the same recovery key to restore on another computer. Email authentication alone cannot decrypt your backup, and we cannot recover a lost key. Connected-device records include the device label, account association and authorization dates. Desktop authorization expires after 90 days unless revoked earlier.

You can turn backup off in Global Settings. This pauses uploads on that computer; it does not delete an existing encrypted cloud copy or data already restored elsewhere. You can revoke connected computers on the website. Contact support to request deletion of the cloud copy. Primary-email changes require verification of both addresses and revoke existing website and desktop account sessions; mailbox-provider sessions are separate.

Referral program

If you choose to participate, we store your referral code, consented attribution, first-purchase identifiers, rewards, credit choices, fulfillment references and audit history. Optional referral cookies last 30 days and use first-touch attribution. If a new account is attributed during that window, the account association can remain for its later first paid purchase; the reward review period is separate from the cookie lifetime. We honor Do Not Track and Global Privacy Control for new attribution. Expired attribution tokens are removed by scheduled maintenance; aggregate click totals remain. Reward and accounting records are retained for fraud review, support and legal accounting obligations under our retention policy. We do not collect message contents, recipient lists or email-open tracking for referrals. A gift-card claim shares your verified delivery email with the gift-card provider only for fulfillment. We do not store gift-card redemption codes.

Referral records can include visit and signup timestamps, the referred account’s identifier, first-payment and reversal status, reward eligibility and review decisions, the chosen reward, acceptance version and claim time, wallet adjustments and fulfillment references. We use account, device and payment relationships to investigate self-referral and duplicate or fraudulent awards. Referrers see their own referral totals and reward status, not access to the referred customer’s private mailbox, card details or account controls. Necessary reward and fraud records do not depend on consent to optional Analytics.

Read the referral rules in our Terms of Use.

Agreement records and blog

The app records the accepted agreement version, document hash and acceptance time in protected local settings. Website checkout and referral claims record the applicable terms version and account action time for contract administration and dispute handling. Acceptance of an agreement is not consent to optional analytics or marketing.

The blog is part of this website and uses WordPress. Visiting blog pages can generate normal hosting and security logs; searching the blog sends your search to our site. WordPress administrator sign-in uses its own necessary authentication cookies, separate from customer-account sign-in. Do not enter private mailbox information into public search fields. The same privacy choices and contact rights below apply to the blog.

2. Why we use it

We use information to provide accounts, deliver sign-in links, process purchases, manage subscriptions, activate licenses, prevent trial abuse and fraud, serve downloads and updates, respond to support, maintain security and meet legal obligations. Optional analytics helps us understand website use. Where data-protection law requires a legal basis, these purposes rely on performance of our contract, legal obligations, legitimate interests in operating and securing the service, and consent for optional analytics. We do not bundle marketing consent into account creation.

3. Service providers and third-party services

We share information only as needed for these purposes with providers including Google Cloud (hosting, database, logs, backups and secrets), Stripe (payments, billing and its Link payment option when offered), Resend (transactional sign-in email), Microsoft 365 (support email), and Google Analytics (optional website measurement). These providers process information under their own applicable terms and privacy practices. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use mailbox contents to train advertising or AI models.

Google/Gmail, Microsoft/Outlook and other websites you access inside or from the app independently process your sign-ins, messages and browsing under their own policies. Microsoft WebView2 and Windows may also process diagnostic or security data under your Microsoft settings. These provider activities are separate from our account backend. See Google’s Privacy Policy, Microsoft’s Privacy Statement, Stripe’s Privacy Policy and Resend’s Privacy Policy.

We may disclose data when legally required, to protect rights and security, or in a business transfer subject to applicable notice and legal protections. We will not silently use a business transfer to remove previously promised privacy protections.

4. Cookies and your analytics choice

The website uses a necessary secure session cookie named __Host-inboxcabin to keep you signed in, normally for up to seven days. It is not readable by website JavaScript. Your analytics choice is stored locally in your browser as inboxcabin.analytics. If you allow analytics, Google may set its own measurement cookies; we configure advertising personalization and Google signals off.

You can change your optional analytics choice below. Declining stops future Analytics loading in this browser and clears accessible first-party Analytics cookies; it does not delete previously collected data from Google. Your choice does not affect account sign-in, payments or app licensing. Browser privacy controls can clear other cookies and storage.

Optional website analytics

Checking this browser’s choice…

5. Storage, retention and security

Our primary service infrastructure is hosted in the United States; providers may process information elsewhere. We use encrypted connections, restricted backend permissions, protected secrets and access controls. No storage or transmission method is guaranteed secure.

We retain account and license records while needed to provide and support access. Trial eligibility records may be retained after uninstalling or closing an account to prevent trial resets. Billing, fraud-prevention and audit records may be retained after account closure where reasonably needed for legal, accounting, dispute or security purposes. Expired login links and sessions cease to authorize access at expiry and are eligible for cleanup. Backups and provider logs can retain records after removal from the active service until their retention cycles expire. Contact us for information about a particular record rather than assuming uninstalling deletes server data.

Local mailbox profiles are not deleted by removing a computer from the website. Uninstalling may preserve local data to support reinstalling. Use app/Windows controls to remove local data when disposing of a device, and revoke provider sessions separately if needed.

6. Your choices and requests

You can manage billing and computers in My account, download an account overview, and sign out website sessions. To request access to, correction of, deletion of, or a portable copy of personal information, or to exercise objection/restriction or other applicable privacy rights, contact support@inboxcabin.com. We verify requests proportionately and explain any lawful retention or other limitations. Account closure is separate from canceling an annual subscription; we can help with both. We do not discriminate for exercising applicable rights. Depending on your location, you may also complain to your data-protection authority.

The product is intended for adults and business users, not children under 13. We do not knowingly collect children’s personal information. Contact us if you believe a child provided it. If you use InboxCabin for your employer, its policies and administrative access may also apply.

7. Changes and contact

We update the effective date when revising this policy and provide additional notice or obtain consent for material changes where required. Contact Inbox Cabin, Colorado, United States, at support@inboxcabin.com for privacy questions or to request a mailing address for formal correspondence.

Previous Privacy Policy.

Business transitions and your information

If the business is organized as an LLC, renamed, sold, or transferred to a successor, necessary account, licensing, billing-reference, support, referral and encrypted-backup records may transfer as part of that business transition, subject to applicable law. The successor must honor the privacy commitments applicable when the information was collected. We will identify the new operator and provide any required notice and choices. Materially different use of existing personal information requires any consent required by law. A business transfer does not give us or the successor your backup recovery key, decrypt your encrypted backup, or authorize a new subscription charge.

App installation and activity counts

While the app is running and has valid access, it periodically reports its existing product-specific device identifier, app version, and a signed access credential to InboxCabin. We record first and most recent check-in times to count registered and recently active computers. This report contains no email contents, mailbox passwords, or browsing history. Download counts measure completed file responses and may include repeat downloads.

Clipboard use in webmail

InboxCabin allows clipboard access on its supported Microsoft Outlook and Gmail webmail origins to make pasting work without repeated prompts. The provider may process pasted information under its own privacy policy. InboxCabin does not collect or upload clipboard contents to its own backend for this feature. Other websites do not receive this automatic permission.