Privacy policy

Effective 1 November 2026.

This policy explains how Innova Apps ("we") collects, uses, stores, shares and deletes information when you use InboxCrew Shared Inbox ("InboxCrew"), a Gmail™ add-on with a team workspace in your browser.

Who we are

InboxCrew is published by Innova Apps, Tove Maës vej 1, 1 TH, 2500 Valby, Denmark (CVR 45291154), innovaapps.ai. We are responsible for the personal data processed by InboxCrew as described here. Contact us at support@innovaapps.ai.

Information we receive from Google

When you use InboxCrew in Gmail™, Google sends us a signed identity token for your Google account. From it we use:

• your Google account ID, which identifies you as a member;
• your email address, and whether Google has verified it;
• your organization's hosted domain (for example example.com), which places you in your organization's team workspace. Accounts without a hosted domain, such as personal Gmail™ accounts, cannot use InboxCrew.

When you click Track this message, and only then, InboxCrew uses a temporary access token that Gmail™ provides for that one message to request it from the Gmail API in metadata format. We request only these headers: Message-ID, Subject, From, To, Cc, Date, References and In-Reply-To. The internal Gmail™ message ID is used to fetch that message and to confirm it is the one open in your sidebar.

From those headers we keep the subject, the sender's name and address, the date and the Message-ID with your team's conversation record, together with the shared inbox address the message was sent to. To and Cc are used to find that shared inbox and, if none matches, to offer an admin the recipient addresses to add. References and In-Reply-To are used to attach a reply to a conversation your team already tracks. Other header values are not kept in readable form: we store SHA-256 hashes of tracked Message-IDs, and a SHA-256 fingerprint of the subject, sender, date and recipients, so that copies of the same email in teammates' mailboxes match one record.

InboxCrew never reads message bodies or attachments, never reads or changes labels, never lists or searches your mailbox, and never sends, moves or deletes email. We do not store OAuth access tokens or Gmail™ access tokens: the temporary token is used for that single request and then discarded.

Information you and your team give us

• Your display name, which you can change in the team workspace, and your role (admin or member).
• Your team workspace's name and domain, and requests to join it (Google account ID, name, email address and request time).
• Shared inbox addresses that an admin adds, with who added them and when.
• What your team does with each conversation: its status (Open, Waiting or Done), who it is assigned to and when it was claimed, internal notes, and an activity history of claims, assignments, status changes and notes, each with the teammate's name, Google account ID and the time.

Internal notes are free text. Please do not put passwords, payment card numbers, health information or other sensitive personal data in them.

Information created when you use the service

• Sign-in sessions for the team workspace, one-use links from Gmail™ to the team workspace, and short-lived sidebar contexts that tie an action to your account and the message you have open. We store the tokens that identify them only as one-way hashes.
• A strictly necessary cookie named __session. It keeps you signed in to the team workspace and protects its forms. It holds a random value, lasts at most 7 days (one hour for visitors who are not signed in) and is not used for analytics, advertising or tracking.
• Counts of requests per network address and per Google account in one-minute windows, kept only in server memory under a keyed hash and deleted within about a minute after each window ends, to prevent abuse.
• A count of the new conversation records your workspace creates while it is on Free in each calendar month (UTC), used for the Free plan's monthly limit and shown on the InboxCrew home card. It holds only the workspace's domain, the month and the number.
• Technical logs of errors and of billing events: the time and a short description and, for billing events, your workspace's domain and plan status, the Stripe event, customer or subscription identifiers involved, the number of billed members and the result. They never contain message headers, notes, payment card details or credentials.

Billing information

For each team workspace we keep a billing record: the workspace's domain (as google:<domain>), its plan status, the start and end of its Pro trial, the Stripe customer and subscription identifiers, monthly or annual billing, the number of billed members, the end of the current billing period, whether a cancellation is scheduled, when a payment first failed, the time of the last Stripe event applied, and the open checkout session with its billing interval and number of members. We also keep the identifier, type and result of each Stripe event we process, with the workspace's domain, so that no event is applied twice.

Payment card numbers and other payment details are entered only on Stripe's pages. InboxCrew never receives or stores them. Members of the workspace can see its plan, trial and billing period dates, billing interval and number of billed members; only admins can open checkout or Manage billing.

How we use information

We use this information only to provide InboxCrew: to identify you and your organization, keep each organization's team workspace separate, show your team its shared conversation records, carry out the actions you and your teammates take, produce CSV exports and digest previews, run Pro trials and subscriptions, apply the Free plan's limits, keep the service secure and answer support requests. We process it to provide the service your organization chose to use and, for Pro, to perform the subscription and meet our accounting obligations, and in our legitimate interest in keeping that service secure and supported and in giving each organization only one free trial.

No sale, no advertising

We do not sell personal data or Google user data, share it with data brokers, use it for advertising or use it to build profiles of people. We use no third-party analytics, advertising or error-tracking services.

Who can see your information

Only approved members of the same team workspace can see its conversation records, internal notes, activity history, member list and shared inbox addresses. Each organization's workspace is separate, so people from other organizations cannot see it. Admins also see requests to join. Before an admin approves them, people from your organization's domain who open InboxCrew see only the workspace name and its admins' display names. The senders of tracked emails never see InboxCrew records or notes, because InboxCrew sends no email.

A CSV export contains every conversation record in the workspace's current shared inboxes, including internal notes and the names of their authors. Treat exported files with the same care as the team workspace.

Service providers and where data is stored

• Google Cloud hosts InboxCrew. The app and its database run on a Compute Engine server with a persistent disk in the europe-west1 region (Belgium), and the database's backups and disk snapshots are stored in the same region. Requests reach it through a Cloud Run gateway in europe-west1 and through Firebase Hosting, which runs on Google's global edge network, so a request can pass through Google servers outside the EU on its way to Belgium.
• Google provides Gmail™ and Google sign-in under your organization's agreement with Google.
• Stripe processes Pro subscription payments for Innova Apps. When an admin chooses Upgrade to Pro, Stripe receives the workspace's domain tag (google:<domain>) and an InboxCrew product tag, which link the subscription to the right workspace; the admin's email address, filled in on the checkout page when the workspace has no Stripe customer yet; and the chosen plan and number of billed members, which InboxCrew updates when members join or leave. Stripe also receives the billing details an admin enters on Stripe's checkout and Manage billing pages, such as name, email address, billing address, tax ID and payment card details. Conversation records, notes, shared inbox addresses, Gmail™ data and the names and email addresses of other members are never sent to Stripe. Stripe handles this information under its own privacy policy and may process it outside the EU.

Google Cloud processes this data for us under its Cloud Data Processing Addendum. Apart from Stripe for billing, we do not send InboxCrew data to any other service provider. Support emails are handled in our business email system.

How we protect information

• Connections to InboxCrew use HTTPS. Every request from Gmail™ carries tokens signed by Google, which we verify before acting on it.
• Workspace, member, join-request, shared inbox and conversation data, including notes and activity, is encrypted with AES-256-GCM before it is written to the database, with a key held in a separate file on the server. A few values that the database uses to look records up are stored without this encryption: your organization's domain (as the workspace key), the Google account IDs of members and of people asking to join, each conversation's status, last-update time and assignee's Google account ID, random record IDs, and the times used to expire join requests, sign-ins and inactive workspaces. Shared inbox addresses and Message-IDs appear in lookup columns only as SHA-256 hashes. Billing records, the Stripe event identifiers and the monthly conversation counts hold no conversation data and are stored without this encryption. Google Cloud also encrypts the disk and its snapshots at rest.
• Session, link and context tokens are stored only as one-way hashes. The random value that protects a session's forms is stored in plain text. Links from Gmail™ to the team workspace work once and expire after 5 minutes.
• The database server is not reachable directly from the internet. Requests reach it only through our gateway, over Google Cloud's private network.
• Every action is checked against the member's current role and the workspace the record belongs to.

How long we keep information

• Conversation records, with their notes and activity history: until an admin deletes the conversation or the workspace. A conversation's activity history keeps its newest 500 entries; older entries are deleted.
• Conversations from a shared inbox address that an admin removes are hidden but kept until the address is added again and they are deleted, or until the workspace is deleted.
• Member records: until the member leaves, an admin removes them or the workspace is deleted. Notes and activity a member wrote stay with the conversation, under their name and Google account ID, until the conversation is deleted.
• The workspace name and domain and its shared inbox addresses: until an admin removes them or deletes the workspace.
• Workspaces with no member activity for 12 months are deleted automatically, with all their records. A workspace whose Pro subscription is still open (active, or overdue with unpaid invoices) and not set to cancel is kept.
• Monthly counts of new conversation records: kept when the workspace is deleted, so that deleting the workspace and creating it again does not reset the month's count. They are deleted once they are more than two months old. Deleting a conversation record does not lower the count.
• Billing records: kept when the workspace is deleted, so that a workspace created again for the same domain does not get a second free trial, and for accounting. They are not deleted automatically in this edition, and records we must keep for accounting, tax or payment disputes are kept for as long as those obligations require.
• Identifiers of processed Stripe events: 31 days.
• Requests to join: until an admin answers them, and at most 30 days.
• Sessions expire after 7 days (1 hour for visitors who are not signed in). Links from Gmail™ to the team workspace expire after 5 minutes, and sidebar contexts after 2 hours.
• Technical logs: up to 30 days.

Expired records are removed automatically. Stripe keeps its own payment and invoice records under its own privacy policy and retention rules; a request to Innova Apps does not remove them.

Backups

Each day we copy the database to a backup on the same encrypted disk, replacing the previous copy, and Google Cloud takes a daily snapshot of that disk, stored in the europe-west1 region (Belgium) and deleted automatically after 7 days. Data you delete is removed from the live database at once and from backups within 10 days. We never bring back data that was deleted after a backup was made.

Your choices and rights

• Admins can delete a single conversation record, remove shared inbox addresses and members, or delete the whole workspace and all its records from the team workspace settings. While a Pro subscription is open (active, or overdue with unpaid invoices) and not set to cancel, an admin must cancel it with Manage billing before deleting the workspace. Deleting the workspace does not delete its billing record or its monthly conversation counts (see above).
• Admins can correct the billing name, email address, billing address and tax ID, and cancel Pro, with Manage billing in the team workspace.
• Members can change their display name or leave the workspace. The last admin must make another member an admin, or delete the workspace, before leaving.
• Uninstalling InboxCrew stops it running in your Gmail™ but does not delete your team's records. You can also remove its access in your Google Account's security settings.
• If you sent an email to a team that uses InboxCrew, that team decides what to keep. You can ask them, or contact us and we will help.
• You can ask us for access to your personal data, or ask us to correct, export, restrict or delete it, by contacting support@innovaapps.ai. We may confirm the request with an admin of your workspace. You can also complain to the Danish Data Protection Agency (Datatilsynet) or your local data protection authority.

Google API Services User Data Policy

InboxCrew's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use message headers from Gmail™ and your Google identity only to provide and improve the InboxCrew features you can see and use.
• We transfer this data to others only as necessary to provide or improve the InboxCrew features you use, and only with your consent; for security purposes (for example, investigating abuse); to comply with applicable law; or as part of a merger, acquisition or sale of assets of Innova Apps, and then only after obtaining your explicit prior consent.
• We do not use it for advertising and we do not sell it.
• We do not use information from Google Workspace APIs to develop, improve or train generalized AI or machine learning models.
• Innova Apps staff do not read your data unless you ask us to for support, it is necessary for security (for example, investigating a bug or abuse), or the law requires it.

Children

InboxCrew is a workplace tool for teams in Google Workspace™ organizations. It is not directed to children and should not be used by anyone under 16. If you believe we hold a child's personal data, contact support@innovaapps.ai and we will delete it.

Changes to this policy

We will post any change to this policy on this page, with a new effective date, before the change takes effect. If a change would let us use Google user data in a new way, we will ask for your consent first.

Contact

Questions about this policy or your data: support@innovaapps.ai, or write to Innova Apps, Tove Maës vej 1, 1 TH, 2500 Valby, Denmark (CVR 45291154).