Privacy Policy
Inbox Sentinel ("Sentinel", "we") is a private email-assistant service operated by Blue Ocean Ventures Inc. for its principal, Harry Parmar. It watches a small set of mailboxes he owns or administers, uses AI to triage incoming email and propose replies, and sends a reply only after he explicitly approves it. It is not offered to the public, and only one person can sign in.
This policy explains what data Sentinel accesses, how it is used, where it is stored, who processes it, and how access can be revoked.
1. Who uses Sentinel
Sentinel has a single user: the mailbox owner. Dashboard sign-in is restricted to one Google account. The connected mailboxes are his own business and personal mailboxes, connected by him through Google's (or Microsoft's) standard consent screen.
2. Data Sentinel accesses
| Data | Source | Why |
|---|---|---|
| Google account name and email address | Google Sign-In (openid, email, profile) | To sign the owner in to the dashboard and refuse anyone else. |
| Email messages in the connected inbox: headers (sender, recipients, subject, date, thread and message IDs), body text, attachment names and sizes | Gmail API (gmail.readonly) or Microsoft Graph (Mail.Read) | To detect new mail, summarize it, judge urgency and draft a reply. |
| Permission to send a reply from the mailbox | Gmail API (gmail.send) or Microsoft Graph (Mail.Send) | To send a reply the owner has reviewed and approved, in the original thread, from the mailbox the email arrived in. |
| Browser push subscription | The owner's devices | To deliver urgent-mail alerts to his phone. |
Sentinel requests only these permissions. It does not request, and has no code to, label, move, archive or delete mail, change mailbox settings, or access contacts, calendars or files.
3. How the data is used
- Triage: each new message is categorized, given an urgency level and summarized in a short report.
- Alerts and digest: urgent items trigger a push notification to the owner's devices (summary and link only, never the email text), and a daily digest is shown in the dashboard.
- Draft replies: for messages that need an answer, Sentinel proposes a reply. The owner can edit, approve or discard it. An approved reply is held for 30 seconds so it can be undone, then sent. Drafts never commit the owner to money, dates, terms or legal positions unless he says so.
- Filtering: newsletters and automated notifications are recognised from their headers and skipped without being sent to an AI model.
Data is used only to provide these features to the mailbox owner. It is not used for advertising, profiling, resale, credit decisions or any purpose unrelated to these features.
4. What is stored, and what is not
Never stored: the body text of incoming email. It is held in server memory only while one message is being processed, and it is never written to the database or to logs.
Stored, in a database encrypted at rest:
- message metadata: sender and recipient addresses, subject, date, thread and message IDs, and whether attachments are present;
- AI reports: category, urgency, a short summary of at most 25 words, the action needed, any deadline, and the counterparty's name or organisation;
- draft replies, and their edits, approvals and send records;
- an append-only audit log of approvals, sends and settings changes;
- OAuth refresh tokens, kept in an encrypted secrets vault and never in plain database tables, logs or source code.
5. Where data is processed, and by whom
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, encrypted token vault, job queue, dashboard sign-in | Canada (ca-central-1) |
| Vercel | Hosts the dashboard and processing functions | Functions run in Montréal, Canada |
| Google Cloud Pub/Sub | Delivers "new mail" notifications from Gmail. The notification contains only the mailbox address and a change ID, never message content | Google Cloud |
| Anthropic (Claude API) | AI triage, summaries and draft replies. Email text is sent in the request and the result is returned | Anthropic's API infrastructure |
Under Anthropic's commercial terms, API inputs and outputs are not used to train models, and they are deleted within 30 days unless retained for a usage-policy or legal reason. Sentinel uses a dedicated API key and only the standard Messages API, not file-storage or batch features that retain data longer.
6. Google API Services: Limited Use
Inbox Sentinel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Gmail data is used only to provide the triage, alert, digest and approved-reply features described above to the mailbox owner.
- Gmail data is not transferred to anyone except as needed to provide those features (the processors listed in section 5), to comply with applicable law, or as part of a merger or acquisition with the owner's consent.
- Gmail data is not used for serving advertisements.
- No person other than the mailbox owner reads Gmail data, except with his affirmative agreement for specific messages, when necessary for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.
- Gmail data is not used to develop, improve or train generalised AI or machine-learning models.
7. Retention and deletion
Stored metadata, reports, drafts and audit records are kept while the service is in use for the connected mailbox, and deleted when the mailbox is disconnected and deletion is requested, or on request at any time. Encrypted backups maintained by the database provider expire on their normal schedule.
8. Revoking access
- Google: remove "Inbox Sentinel" at myaccount.google.com/permissions. Sentinel immediately loses access to that mailbox.
- Microsoft 365: a tenant administrator can remove the app's consent in Microsoft Entra ID.
To have stored data deleted, email harry@bov.ai.
9. Security
- Sign-in is restricted to a single allowlisted account, enforced by the database as well as the application.
- All tables enforce row-level security.
- Tokens are stored in an encrypted vault.
- All traffic uses HTTPS.
- Incoming notifications are cryptographically verified.
- Sending is isolated in a single component that runs only on an approval matching the exact reply being sent, and can be switched off entirely.
10. Children
Sentinel is a business tool for a single adult user and is not directed to children.
11. Changes
If this policy changes, the effective date above will be updated. Material changes affecting Google user data will be made before any new use of that data.
12. Contact
Blue Ocean Ventures Inc. · harry@bov.ai