Last updated: 2026-09-20
A personal, single-user tool that labels incoming mail in one Gmail account. It has no sign-up, no accounts, and no other users.
Through the Gmail API with the gmail.modify scope, it reads the
headers and text of messages that arrive in that one inbox and adds labels
to them. It never deletes mail, never removes a label, and never sends
mail.
For each incoming message, the subject, the sender's name/address/domain, a
few header-derived signals, and the message's plain-text body (truncated to
a fixed length) are sent to TypeSafe (api.typesafe.ai) to be
classified. TypeSafe states that it does not train on customer requests.
The Worker itself runs on Cloudflare, which hosts the code and its stored state (see "What is stored" below) as the infrastructure provider. No other third party receives message content.
In per-account Durable Object storage: a Gmail history cursor, the account's own email address, a cached OAuth access token and its expiry, the current Gmail watch's expiry, the ids of recently processed messages (kept about seven days), the ids of messages that failed classification and their retry count (also kept about seven days), and a cache of this app's label ids. Message subjects, senders, and bodies are not stored after a message is classified. Operational logs, which Cloudflare retains as part of running the Worker, carry Gmail message and history ids, the account address included in each push notification, and the labeling outcome (which labels were applied, and the classifier's model name, choice, and confidence) — never a subject, sender, or body.
The Gmail OAuth client secret, refresh token, and the TypeSafe API key are held as Cloudflare Worker secrets, not in application storage.
No analytics. Nothing is sold or used for advertising, and nothing is shared beyond the classification calls and hosting described above.
This app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The account owner can revoke this app's access at myaccount.google.com/permissions, which stops all access immediately.
This policy may change; the date above reflects the last update.