Privacy Policy

Who we are

Mailloop helps job seekers send personalized, individual emails through their own Gmail account. Czar16 operates Mailloop. For privacy requests or support, contact czar16dev@proton.me.

Information we handle

Google sign-in supplies your Google account identifier, email address, and name. We store your account profile, preferred job roles, reminder preference, and an encrypted Google authorization refresh token. Session cookies keep you signed in. We do not receive your Google password.

We store the contacts you enter or import, templates, campaign history, recipient and message snapshots, delivery outcomes, Gmail message and thread identifiers, and reply-check timestamps. Editing or archiving a contact or template does not erase historical message snapshots. Uploaded resume PDFs are kept in private storage and attached only when you choose to include them.

How Gmail access is used

We use Gmail sending permission to send each approved message individually from your account. Gmail read access checks tracked thread metadata for replies and searches sent-message metadata to resolve uncertain delivery. Reply detection reads sender headers, timestamps, labels, and message identifiers; it does not store incoming reply bodies. The readonly permission is broader than these checks, but Mailloop uses it for these features. Reminders never send email automatically.

Mailloop’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and Google Workspace API user data policy, including their Limited Use requirements. Google user data is not sold, used for advertising, or used to train generalized AI or machine learning models. Human access is limited to circumstances allowed by those policies, such as your specific consent for support, security investigations, or legal requirements.

Processing and sharing

Hosting and PostgreSQL database providers process application data to operate the service. Private Vercel Blob storage processes uploaded PDFs in production; local development uses local files. Inngest processes account and send identifiers and background job outcomes for delivery, reply checks, and maintenance. Google processes emails, recipients, and attachments when sent through Gmail. Recipients receive the message and any attached PDF. These providers process data under their applicable terms. We may disclose data when required by law or to address abuse and protect the service.

Server-side handling, encrypted authorization tokens, private PDF storage, and account-scoped access help protect your data. No system can guarantee absolute security.

Your controls and retention

Settings lets you download a JSON export of your profile, preferences, contacts, templates, message history, minimal delivery receipts, and attachment metadata. It excludes credentials and private storage locations. Your current resume can be downloaded separately. You can revoke Mailloop’s Google access through Google account connections; revocation does not delete your Mailloop data.

Delete history in Settings permanently removes completed message rows and their follow-up reminders. Queued and unresolved deliveries remain, and Gmail emails are unchanged. We retain minimal delivery receipts containing your account ID, recipient address, original creation time, and successful-send time until account deletion. These preserve sending limits and warnings for previously emailed addresses. Empty campaign records retain submission keys to prevent duplicate sends.

Account deletion disables access immediately and cancels emails that have not begun delivery. Already sending or uncertain deliveries cannot be recalled. The deletion request cannot be undone. You cannot sign in or create another Mailloop account with the same Google account while deletion is pending. After 90 days from the original request, background maintenance attempts Google authorization revocation and permanently removes owned PDFs and database records. Outages or cleanup failures may delay completion; failures are retried while the account remains disabled. Deleting Mailloop does not remove emails from Gmail or recipients’ inboxes. Provider-managed logs and backups follow the relevant provider’s retention practices; this policy does not promise a particular backup deletion deadline.

We retain account data while your account exists. Older PDFs can be removed once replaced or removed from Settings and no pending or uncertain delivery needs them. Historical attachment metadata may remain until account deletion. Contact us for access, correction, or privacy questions.

Changes

We will update this page when our practices change. Material changes to Google data use require appropriate notice and consent before that new use.