Privacy policy

Who we are

Inbox Invaders is operated by Edan Edison, trading as Manx Digital, 8 Kirby Hill, Douglas, Isle of Man, IM2 1PA. Contact hello@manxdigital.com for privacy questions, requests or support.

This policy covers the Inbox Invaders macOS app and its public website. Manx Digital is the controller of website, support and business correspondence information that we receive. Your email provider separately controls its email and account services. Using Inbox Invaders does not move your mailbox to Manx Digital.

Your email stays between your Mac and your provider

The app connects directly to your email provider to receive and manage mail using IMAP and to send mail using SMTP. It processes message content on your Mac. Our marketing website and its Railway hosting do not receive your mailbox contents, email account passwords or OAuth tokens through the app.

The app accesses the accounts you choose to connect. Depending on your actions, this includes email addresses and display names; message headers, senders, recipients, subjects and bodies; folders, labels, read states and flags; drafts, sent messages and Outbox items; and attachments. This access enables reading, searching, composing, sending, filing, snoozing, local rules and other visible mail features. Commands such as moving mail or emptying a folder can change or permanently delete messages at your provider.

Local storage and device security

Inbox Invaders stores account settings, downloaded messages, search indexes, local drafts, Outbox items, rules, preferences and managed attachments in its application storage on your Mac. Inbox messages download in the background; other folders download message bodies when opened. Attachments are downloaded when needed. Locally saved mail can be read without an internet connection, but new mail, sending and server changes require one.

In signed builds, OAuth credentials and app passwords are stored in the macOS Keychain. Mail caches and attachments are separate local files; we do not claim that those files have application-level encryption. Your Mac's account security, disk encryption, backups and any organisation management policies also affect their protection. Local arcade progression records contain event type, date, account identifier and points, rather than email bodies.

Provider drafts are uploaded when you choose to save or sync them there. Sending a message transmits the content and attachments you selected to your provider and intended recipients. Files you save outside the app, and copies in device or provider backups, remain under your control and those services' policies.

Provider sign-in and permissions

Gmail and Outlook connections use provider-hosted OAuth sign-in. The app receives credentials from the provider and uses them directly on your Mac. Gmail requests the https://mail.google.com/ permission needed for its IMAP and SMTP mail features, including reading, composing, sending and managing messages. Microsoft permissions cover IMAP access, SMTP sending and maintaining authorised access. These permissions can be broad; review the provider's consent screen before approving access.

iCloud, Yahoo and Fastmail connections use provider-issued app passwords. Never send these credentials to support. Provider availability, account plans, organisation restrictions and consent requirements can affect whether a connection is allowed. Provider permission does not give Manx Digital a separate server-side copy of your mail.

Google user data and Limited Use

Inbox Invaders' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google account data is used only to provide the mail features you choose. We do not sell it, use it for advertising, credit decisions or data brokerage, or use email content to train artificial intelligence or machine learning models. The app does not send your mail to an AI service.

Manx Digital has no routine access to read your messages. If you voluntarily share specific content for support, we use it only for that request. Any access or disclosure of Google user data must stay within Google's permitted purposes, such as your explicit consent for the relevant feature, necessary security investigations or legal obligations.

Remote images, links and notifications

Remote images are blocked by default. If you enable them for a message or in settings, your Mac contacts the sender's image hosts. Those hosts may receive your IP address and request information and may infer that you opened the message. Opening an email link or external attachment also involves the destination's own privacy practices. Blocking images does not make links or attachments trustworthy.

The app uses macOS notifications if you allow them. Sender and subject previews are off by default, and message bodies are not included in notifications. You can change notification and preview settings in the app and macOS. Notifications require the app to remain running; there is no Manx Digital mail push service.

Website visits and support

Our public site provides product information, help, legal pages and articles. Hosting and security systems may process technical request information such as IP address, requested URL, time, browser details and error or security events to deliver and protect the site. Railway provides website hosting. Manx Digital's publishing services manage public article content; they do not receive email account access from the app.

We do not currently run advertising trackers or optional analytics on this site. Visiting it does not connect an email account. If you email us, we receive your email address, correspondence and anything you choose to include. Please remove private message content, credentials and unrelated personal information from support attachments.

We use correspondence to respond and provide support, technical information to operate and secure the site, and business records to meet legal obligations. The relevant lawful bases are performing our agreement or responding to your request, legitimate interests in reliable and secure services, consent where required, and legal obligations.

Sharing, location and retention

We share website or support information with hosting, email and other service providers only as needed to operate those services, with professional advisers where necessary, or when required by law. We do not sell personal information. Providers, recipients and external sites you interact with process information under their own terms and privacy notices.

Website and correspondence information may be processed outside the Isle of Man where our service providers operate. We use appropriate transfer safeguards where the law requires them. We keep information only as long as needed for its purpose, including answering support requests, investigating security issues and meeting record-keeping obligations; provider and backup retention may differ.

Local app information remains until removed through the app, your device controls or your own backup policies. We cannot remotely erase files on your Mac, your exports, your provider's mailbox or copies already delivered to other people.

Disconnecting and deleting information

Removing an account in Inbox Invaders deletes that account's local mail cache, drafts, Outbox items, managed attachments and stored credentials after confirmation. It does not close the provider account or delete its server mailbox. Save anything you need first, particularly unsent local drafts.

You can separately revoke Inbox Invaders' access through your Google or Microsoft account security settings, or revoke an app password through the provider that issued it. Revocation stops future authorised access but does not itself erase already downloaded local copies. To remove both access and local data, revoke access and remove the account from the app. Copies you exported or backed up need separate attention.

Your rights and choices

Under the Isle of Man Data Protection Act 2018 and the Applied GDPR, and other applicable laws, you may have rights to access, correct, erase or receive your information, restrict or object to processing, and withdraw consent. These rights are subject to legal limits. We do not use website or support information to make solely automated decisions with legal or similarly significant effects.

Contact hello@manxdigital.com to exercise rights over information we hold. We may need proportionate information to verify your request. For provider-held mail or account information, contact that provider as well. You may complain to the Isle of Man Information Commissioner or another competent authority where applicable.

Inbox Invaders is not directed at children. If you believe a child has supplied personal information to us in circumstances requiring parental consent, please contact us.

Changes to this policy

We may update this policy as the product, providers or law change. We will show the updated date here and give additional notice where a material change requires it. New uses of provider data that require consent will not begin before that consent is obtained.