Privacy Notice

Last updated: 29 September 2026

The application sends me a small amount of information about itself, described in section 4. You can switch it off in the application's settings. It never includes your mail, your contacts, or your credentials.

1. Data controller

The controller is E-1 Przemysław Alexander Kamiński, Aleja Solidarności 117, 00-140 Warsaw, Poland. For privacy questions or requests, email hello@inboxctl.com.

2. Website visits

The website is hosted through Cloudflare. Serving and protecting the site requires processing connection information such as your IP address, requested URL, browser information, and request time. Cloudflare describes its processing in its Privacy Policy.

I use Cloudflare Web Analytics to measure website visits and page performance. It uses no cookies, local storage, or fingerprinting to identify visitors. Its reports provide aggregate traffic and performance information. See Cloudflare Web Analytics.

The site loads fonts from Google Fonts. Your browser connects to Google when the page loads, which sends Google your IP address and request information. See Google Fonts FAQs and Google's Privacy Policy.

The YouTube overview loads only when you press its play button. The player uses YouTube's privacy-enhanced mode at youtube-nocookie.com. Playing the video connects your browser to Google, which receives connection and player information under its privacy policy. Other recordings are served directly by this website.

The website stores ad-measurement preferences and, with your consent, campaign and checkout identifiers as described below. External services process data under their own policies.

Website delivery and security are based on the legitimate interest in operating and protecting the site (Article 6(1)(f) GDPR). The analytics help me understand website traffic and improve page performance.

Downloads from an ad

When you arrive from an ad, the website copies the ad's click identifier and campaign parameters from the address bar onto the download link. Nothing is saved in your browser. Cloudflare logs the download request with your IP address and those parameters.

My licence service reads those logs. For each download that carried an ad parameter it keeps the time, the click identifier and campaign, and a network key made from your IP address: the whole IPv4 address, or the first half of an IPv6 address. If inboxctl sends its first-run event from the same network within 24 hours, that download is linked to the installation identifier. The service then sends the advertising platform that issued the click identifier (Meta, Reddit or Google Ads) a FirstLaunch event with that click identifier, the time of the first run and a random event reference. Your IP address, browser details and installation identifier are not sent to the platform.

The network key is deleted 48 hours after the download. A first-run network key is deleted once matched, or after one hour. The linked download and first-run records are deleted after 90 days.

The legal basis is the legitimate interest in knowing which paid ads lead to installations (Article 6(1)(f) GDPR). You can object by writing to me, by downloading from a link without ad parameters, or by switching telemetry off, which stops the first-run event.

Optional analytics and ad measurement

The panel asks once for everything below. Nothing described in this section happens until you allow it.

Google's tag

If you allow it, the website loads Google's measurement script (gtag.js) from Google Ireland Limited. It reports to two accounts of mine, described below. Google Signals and ad personalisation are switched off, so your visit is not used to show you ads.

Google Analytics

If you allow it, the website loads Google Analytics 4 from Google Ireland Limited. It records the pages you view, the page you came from, your browser, device type, screen size and language, and your approximate city and country. Google uses your IP address to estimate the location and does not store it. The website sets two cookies, _ga and _ga_<ID>, which hold a random identifier so that several page views can be counted as one visit. They expire after 180 days.

The Google Analytics property is linked to my Google Ads account. If you arrived from a Google ad, Google Ads can see that your visit led to a download or a subscription, and I can see my ad costs next to the visit data. For this the website also sets a _gcl_au cookie, which expires after 90 days. The link is used only to measure ads. Google Signals and ad personalisation are switched off, so your visit is not used to show you ads. Google keeps the event data for 2 months and then deletes it. I see only aggregate reports.

Google Ads conversion measurement

If you allow it, the script also reports to my Google Ads account the pages you view, the thank-you page after a subscription included, together with your browser information, your IP address and any Google Ads click identifier from the address bar. Google Ads uses this to count which of its ads led to a visit or a subscription. For this the website sets a _gcl_au cookie, which expires after 90 days. Google Ads keeps conversion data under its advertising policies. I see only aggregate counts.

Ad measurement

If you allow ad measurement, the website saves campaign names and ad click identifiers in your browser for up to 30 days. The identifiers are issued by Meta, Reddit or Google. They let a later subscription bought in the same browser be connected to an earlier ad visit.

After you allow it, the website sends those identifiers and campaign details to my licence service on Cloudflare, together with your consent, your browser information and your IP address. A random reference connects that record to your Stripe checkout. When Stripe confirms the payment, the service sends the corresponding advertising platform a purchase event containing its own click identifier, the payment time, the transaction identifier, the amount and the currency. Meta and Reddit also receive the browser information and IP address, which is what they match on. Your name, email address, billing address and card details are not part of these events.

Declining and withdrawing

You can decline and still download inboxctl or subscribe. Analytics and ad settings in the footer reopens the choice. Withdrawing stops Google's script and deletes its cookies, _gcl_au included, clears what is stored in your browser and cancels pending reports for the checkout references saved there; a report an advertising platform has already accepted cannot be recalled by that control, and I can ask the platform to delete it if you write to me.

Your answer is remembered for 180 days. The checkout references that make withdrawal possible are kept in your browser for up to 90 days. Attribution and purchase records on my service are deleted after 90 days. Stripe and the advertising platforms retain records under their respective policies.

Legal basis: consent (Article 6(1)(a) GDPR).

3. Email correspondence

If you email me, I receive your address, your message, and any attachments you send. I use them to answer your question, handle a support request, and follow up on the same conversation. Email providers process messages to deliver and store them.

I also plan to use AI tools to help process support emails and draft replies. Relevant message content and any personal information it contains may be shared with the AI provider for that purpose. The provider and its retention and international transfer details will be added to this notice before that processing begins.

The legal basis is the legitimate interest in responding to enquiries (Article 6(1)(f) GDPR), or steps you request before entering a contract where applicable (Article 6(1)(b) GDPR).

4. The application

I never receive your mailbox contents, your account credentials, your contacts, or your search terms. inboxctl connects directly to your mail provider. There are no crash reports.

What inboxctl sends

inboxctl contacts one host of mine, api.inboxctl.com, and sends three things:

The installation identifier is a random value inboxctl generates for itself on your computer. It is not your name, your address, your mail account, or anything derived from your hardware. It is not the identifier the licence check uses, which is derived from your computer and is sent only by the licence calls described below.

If you hold a purchased licence, the daily check-in also carries that licence's identifier. That identifier names your licence record, so a check-in from a licensed copy can be connected to you. I use this to count how many purchased licences are in use. A trial copy and a copy with no licence hold no such identifier and send none, and their check-ins are not connected to any person.

These events are recorded in Cloudflare Analytics Engine as counts by version, operating system, and licence kind. The first-run event's IP address is also compared with recent downloads from ads, as described in Downloads from an ad; that match is the only per-installation record in a database of mine. No profile of your use of the application is built.

Switching it off

The first-run event and the check-in are controlled by [telemetry] enabled in the application's configuration file. Set it to false and neither is sent again, including the licence identifier in the check-in. The update check still runs so you learn about new releases; with the switch off it carries no identifier and no version.

The legal basis is the legitimate interest in knowing which versions and platforms are in use so that I can support and maintain the application (Article 6(1)(f) GDPR). You can object to this processing, and the switch above is the immediate way to do so.

Licence checks and purchases

Where you hold a licence, inboxctl contacts the same host to obtain and renew your licence token and to check whether the licence has been withdrawn. Those calls carry a licensing identifier derived from your computer, your licence key or token, and the application version. They are necessary to perform the licence agreement (Article 6(1)(b) GDPR) and cannot be switched off while a licence is in use.

Checkout is hosted by Link. I receive your name, email address, order and subscription identifiers, and payment status to issue and manage your licence. Card details are handled by Link. This processing is necessary to perform the licence agreement (Article 6(1)(b) GDPR). Link processes purchase information under its Privacy Policy.

5. Recipients and retention

Data is processed by the hosting, font, video, and email providers described above where needed for their services. Cloudflare also processes the application events and licence calls described in section 4, on its Workers and Analytics Engine platform. Cloudflare processes website analytics. Link processes purchases. The AI provider for support correspondence will be identified before use. Data may also be disclosed where required by law.

Cloudflare Web Analytics makes reports available for the previous six months, as described in its FAQs.

Application events, the licence identifier in a check-in included, are retained by Cloudflare Analytics Engine for three months. Licence records are kept for as long as the licence is valid and afterwards only where necessary to meet legal obligations.

Correspondence is kept for as long as needed to resolve and follow up on the enquiry, and longer only where necessary to meet legal obligations or establish, exercise, or defend legal claims. Provider-managed request data is retained under each provider's applicable policies.

Meta, Reddit and Google each receive the FirstLaunch events for downloads from their own ads described in section 2, and are independent controllers of them under their own policies.

Where you have allowed ad measurement, Meta, Reddit and Google each receive the purchase events described in section 2 and are independent controllers of them under their own policies. Google Ireland Limited also processes what Google's tag sends, as described in section 2; Google LLC, which may process it in the United States, is certified under the EU-US Data Privacy Framework.

Cloudflare and Google may process data outside the European Economic Area. Their policies describe the transfer safeguards they use and how to obtain further information about them.

6. Your rights

Where applicable under the GDPR, you can request access, correction, erasure, restriction of processing, or a portable copy of your data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent at any time.

Send requests to hello@inboxctl.com. I will normally respond within one month. If a lawful extension is needed, I will explain the reason within that month.

You may complain to a data protection authority, including the Polish Personal Data Protection Office, UODO. The European Commission explains your data protection rights.

7. Changes

The current notice is published on this page with its last-updated date.