Privacy Policy

ALTRBox (“ALTRBox”, “we”, “us”) is a product of ALTREX Labs. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using ALTRBox you agree to this policy.

Who we are

ALTREX Labs operates ALTRBox at altrbox.altrexlabs.com. For privacy questions, contact us at rashid@altrexlabs.com.

Information we collect

• Account info from Google. When you sign in with Google we receive your name, email address, Google account ID, and profile picture.
• Gmail data. With your explicit consent (Gmailreadonly scope), we read message metadata (sender, subject, snippet, labels, dates) and message bodies from your inbox so the app can triage them.
• Usage data. Basic logs (timestamps, errors, request counts) needed to operate and secure the service.

How we use your data

• To authenticate you and maintain your session.
• To fetch your inbox and run AI-assisted triage that classifies, summarizes, and prioritizes messages for you in the app.
• To operate, debug, and improve the service.

We do not sell your data, and we do not use your Gmail content for advertising.

Google API Services User Data Policy

ALTRBox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Gmail data to provide user-facing features in ALTRBox.
• We do not transfer Gmail data to third parties for ads, resale, or analytics.
• We do not use Gmail data to train generalized AI/ML models.
• Humans do not read your Gmail data except (a) with your explicit consent, (b) for security/abuse investigations, (c) to comply with law, or (d) for aggregated, anonymized internal operations.

AI processing

To triage messages, ALTRBox sends the minimum necessary email content to our AI provider (Lovable AI Gateway, which routes to model providers such as Google and OpenAI). These providers process the content only to return a response and are contractually prohibited from using it to train their models.

Data storage and retention

Account records and OAuth tokens are stored in our managed backend (Lovable Cloud, powered by Supabase). You can disconnect and delete your account at any time by emailing us; we will remove your stored tokens and account data within 30 days.

Revoking access

You can revoke ALTRBox’s access to your Google account at any time at myaccount.google.com/permissions.

Security

Data is encrypted in transit (HTTPS) and at rest. Access is limited to authorized personnel. No service can guarantee absolute security, but we follow industry-standard practices.

Changes

We may update this policy. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions? Email rashid@altrexlabs.com.