AgentInbox Privacy Policy

Who is responsible

I am Umberto Giacobbi, the developer of AgentInbox. For privacy questions or requests about information you send me, contact hello@umbertogiacobbi.biz.

This policy covers the AgentInbox Windows setup app, Python engine and local MCP connection. I do not operate an AgentInbox mailbox server. Browsing this website is a separate activity, covered by the website privacy notice.

What AgentInbox reads and why

You supply an account name, email address, incoming protocol, server, port, transport security and username. Password or app password is the default authentication method. If you enable sending, you also supply SMTP settings. Your provider must allow the selected connection.

You may explicitly choose Microsoft OAuth2 for a Microsoft account and supply a public client ID and tenant from your app registration. Device-code sign-in contacts Microsoft; its page opens only when you press the browser button. Microsoft processes sign-in and consent, and AgentInbox receives tokens for the requested mail access. There is no Google OAuth flow or automatic authentication switch.

Mail reads can return subjects, senders, recipients, timestamps, message text and attachment metadata. IMAP also exposes selected server folders and read status. POP3 has only INBOX, without unread flags or server folders; it searches headers and uses the email Date header. Protocol requests go to your configured mail server.

Connections require TLS or required STARTTLS with certificate and hostname checks. There is no plaintext mode or custom-CA setting. Connection checks contact the configured server and authenticate. An optional reading check attempts a bounded read. The Windows configuration app does not send messages; sending is requested through the connected assistant.

Optional SMTP sending through your assistant

Sending is disabled until you enable it for an account in Windows configuration. The connected assistant can then submit email immediately through the send_email MCP tool. Give it the intended account, recipients including CC and BCC, message and attachments before asking it to send.

AgentInbox does not open a second confirmation window. The connected client is responsible for following your instruction; the engine checks that sending is enabled and that the request ID has not already been used. It builds the message and reads selected attachment files in memory, without saving an outgoing message queue.

SMTP transmits the requested message to your configured server. That server and the recipients can retain copies. Server acceptance does not prove delivery to the recipient. An uncertain submission is not retried automatically.

Your assistant and other recipients

AgentInbox returns requested mail results to the local MCP client connected to it. These results can include account names, email addresses and message text. Passwords, Microsoft tokens and device-sign-in codes are not returned as MCP tool results.

A client such as Claude, Codex or Visual Studio Code may forward results to its configured AI service and retain them in a conversation, logs or other storage. That processing may happen outside your country. AgentInbox does not call an AI model itself, but a local connection does not make the whole workflow offline.

Check the client and provider terms, retention and training settings before sharing mail. AgentInbox cannot enforce an external service’s retention settings or delete copies it has already received.

Your mail provider receives the authentication, reading and sending requests needed to provide its services. I do not receive app telemetry or automatically uploaded diagnostic logs. If you send me a support request, I receive the contact details and material you choose to include. Do not send passwords or complete mailboxes.

What stays on your device

Schema 3 account configuration is stored locally as JSON metadata, including protocol, server settings, account labels, access permissions and the authentication choice. Microsoft client IDs and tenant settings are public registration metadata. These settings are separate from secrets and are not encrypted by AgentInbox.

Windows Credential Manager stores passwords and Microsoft refresh tokens. Current-user DPAPI protects temporary sign-in blobs. The source uses native Keychain on macOS and Secret Service on Linux; these paths remain untested. Missing secure storage stops the operation. This does not encrypt the whole data folder.

The data directory can be selected with AGENTINBOX_DATA_DIR. AgentInbox does not create an on-disk archive of messages read from your mailbox. Your operating system, backups and connected assistant may retain their own copies.

A local SQLite ledger records request and account identifiers, timestamps, submission status and an optional safe error code. It contains no subjects, recipients, message bodies, attachments or passwords. Diagnostics are not saved to a local log by default. Bounded, redacted server errors can be shown in Windows configuration; they are omitted from MCP errors.

How long data is kept

Account records and protected credentials remain until you remove the account or clear the relevant local data and credential entries. Temporary Microsoft sign-in flows expire or are cancelled through local setup. Settings or diagnostic state can remain after an account is removed.

Submission metadata remains until you remove the relevant local profile. It lets you look up an unresolved result without sending again. Retired credentials and consumed sign-in state are queued for deletion; if cleanup fails, the app reports it separately and protected data can remain until cleanup succeeds. This is not secure erasure of disk remnants or backups.

If you contact me, I use what you send to answer your request. I keep that correspondence while needed for the request and any resulting agreement or applicable record-keeping obligation. You can ask me to delete it; I will explain if a legal obligation requires keeping part of it.

Stop access and delete data

Disable sending to block subsequent SMTP submissions for an account. Removing an account removes its active configuration and queues deletion of its protected credentials. Complete any pending cleanup before treating credential deletion as finished. This does not delete the mailbox or recall messages already submitted.

You can revoke app passwords or Microsoft consent using your provider’s controls. Removing local credentials does not revoke a provider password, token or consent. A credential used by other applications may stop working there too.

For a full local cleanup, remove connected accounts and complete any pending credential cleanup before closing the setup app and stopping every AgentInbox process started by your assistants. Deleting the profile first can remove references needed to retry cleanup. Remove the AgentInbox data directory and its MCP connection from each assistant. Uninstalling alone should not be relied on to remove every copy.

Local deletion is not secure erasure of disk remnants or backups. Separately delete conversations, exports or other copies retained by assistants and external services using their controls. I cannot remotely delete data stored only on your device or in an account with another provider.

How I use information you share with me

I do not sell your mailbox data or use it for advertising, credit decisions, surveillance or training general-purpose AI models. I do not routinely receive or read your mail.

If support requires a specific sample, share only what is needed and expressly authorize its review. Necessary security investigations or legal obligations may also require limited handling.

Your requests and policy changes

For information you send me directly, you can request access, correction or deletion and, where applicable, restriction, objection or portability. You can also contact the competent data-protection authority. Email hello@umbertogiacobbi.biz and identify AgentInbox and the information concerned.

I will update this notice when data handling changes. If a change requires notice or consent, I will address that before it applies. The date at the top identifies this version.