Privacy Policy
Last updated: November 8, 2026
In short: SwipeMail shows your unread Gmail as swipeable cards and changes an email's read, starred or archived status when you swipe. It does not store your emails, does not sell or share your data, and does not use it for advertising or to train AI models. You can remove its access at any time.
Who we are
SwipeMail ("SwipeMail", "the app", "we") is a personal software project by an independent developer. You can reach the developer at xgimbang@gmail.com.
What we access in your Google account
When you choose “Continue with Google” you are asked to approve the following:
- Your basic profile: your name, email address and profile picture, used to show who is signed in and to keep different accounts separate.
- Your Gmail messages and labels (the
gmail.modifypermission): used to list your unread inbox emails, to show their sender, subject, date and text on a card, and to change a message's labels when you swipe (remove “unread”, add “starred”, or remove “inbox” to archive). Google describes this permission broadly, and it also covers composing and sending. SwipeMail does not do any of that. It only reads messages and changes those labels.
How we use that information
- To display your emails to you inside the app, including short summaries that are generated by simple text rules on our server (no AI service is used).
- To carry out the actions you choose: mark read, star, unstar, archive and undo.
- To show the right sender picture, as described under “Other services” below.
We do not use your data for advertising, profiling, selling, or building any other product, and we do not use it to train AI or machine-learning models.
What we store, and where
| Information | Where it lives | How long |
|---|---|---|
| Email content (sender, subject, text) | Fetched from Gmail when needed and sent to your browser. The server keeps a copy in memory only, to avoid asking Gmail again. | Treated as expired after 10 minutes. Never written to a database, a file or the logs. |
| Your sign-in (Google access and refresh tokens) | An encrypted, httpOnly cookie in your browser. It is not readable by the page's scripts. | Until you sign out or the cookie expires. |
| Your settings (theme, shortcuts, emails per batch), snoozed email IDs with their wake-up time, and whether you have seen the tour | Your own browser's local storage, on your device only. We never receive it. | Until you clear your browser data. |
SwipeMail has no database and no user accounts of its own. Your sign-in comes from Google.
Other services that receive limited information
- Google (sign-in and the Gmail API) receives your requests to read and update your mail, because that is the service you are using.
- Vercel, our hosting provider, processes the requests the app receives. Like any host it keeps standard technical logs (such as time, address and status of a request). We do not put email content in those logs.
- Picture lookups. To show a picture next to each sender, our server asks Gravatar for a photo using a one-way hash of the sender's email address (not the address itself), and asks Google's and DuckDuckGo's icon services for the website logo of the sender's domain (for example, “stripe.com”). Your browser does not contact these services directly. No message content is sent.
We do not sell your data and do not share it with anyone else, except as required by law.
Google API Services User Data Policy
SwipeMail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we only use Gmail data to provide the features described above, no person at SwipeMail reads your emails unless you ask for help with a specific problem or it is needed for security or to follow the law, and we do not allow others to.
Your choices and how to remove access
- Sign out from the Settings menu. This removes the sign-in cookie.
- Revoke SwipeMail's access at any time in your Google Account at myaccount.google.com/permissions. After that, SwipeMail can no longer reach your Gmail.
- Delete local data by clearing this site's data in your browser. Because we keep no copy of your emails or settings on our servers, there is nothing for us to delete, but you can write to us at xgimbang@gmail.com with any question.
Changes you made to your emails in Gmail (read, starred, archived) stay in Gmail. You can reverse them there.
Security
Connections use HTTPS. The sign-in cookie is encrypted and not readable by scripts on the page. Emails are shown as plain, filtered text and images in emails are blocked, so a message cannot run code or track when you open it in SwipeMail. No system is perfectly secure, so please keep your Google account protected as well.
Children
SwipeMail is not directed at children under 13, and we do not knowingly collect information from them.
Changes to this policy
If this policy changes, we will update the date at the top of this page. If a change affects how your Google data is used, we will tell you in the app first.
Contact
Questions about this policy or your data: xgimbang@gmail.com.