Privacy Policy

Tahmora Mail Hub · Effective 10 October 2026

This policy explains how Tahmora Mail Hub ("the app"), operated by Tahmora Ventures ("we", "us"), accesses, uses, stores and protects data, including Google user data. The app is a single-user tool used only by its owner.

1. Data the app accesses

When the owner connects a Google account, the app requests these Google permissions (OAuth scopes):

gmail.modify (https://www.googleapis.com/auth/gmail.modify): read email messages, threads, attachments and labels; add and remove labels (for example to archive or mark as read); move messages to trash; create, update and send drafts. This scope does not allow permanent deletion.
gmail.settings.basic (https://www.googleapis.com/auth/gmail.settings.basic): read the mailbox's send-as addresses and signatures so replies come from the correct address; view and manage mail filters.
openid and userinfo.email: the Google account's email address, used to identify which mailbox was connected and to confirm the owner's identity at sign-in.

The app does not access Google Contacts, Calendar, Drive or any other Google service.

2. How the data is used

Email content is read only when the owner asks the app to do something, such as searching, summarising, organising or drafting a reply.
To carry out those requests, relevant email content is passed to the owner's own AI assistant session, which the owner controls. It is shown only to the owner.
Google user data is never used for advertising, never sold, and never used to develop, improve or train generalised artificial intelligence or machine learning models.
No human other than the owner reads the data.

3. Storage and retention

Email content is not stored. Messages are fetched from Gmail when needed and discarded after the request completes.
Access credentials: the OAuth refresh token for each connected mailbox is stored so the app can act without asking the owner to sign in every time. Tokens are encrypted at rest using Google Cloud Key Management Service, in cloud infrastructure controlled by the owner. They are kept until the mailbox is disconnected.
Activity log: a record of actions taken (for example "archived 12 threads in account X", with message identifiers and label changes) is kept for 90 days so changes can be reviewed and undone. The log contains no email bodies, subjects or attachments.

4. Sharing and disclosure

We do not sell, rent, share, transfer or disclose Google user data to any third party, except as needed to provide the app's features to the owner (such as returning results to the owner's AI assistant), to comply with law, or with the owner's explicit consent.

5. Security

All connections use HTTPS.
Sign-in to the app is restricted to the owner's Google identity; all other sign-in attempts are refused.
Tokens are encrypted with keys held in Google Cloud KMS and are never written to logs.
Email is never sent automatically; every outgoing message requires the owner's explicit approval.

6. Your control and deletion

A connected mailbox can be disconnected at any time from the app's account page. Disconnecting revokes the app's access with Google and deletes the stored token.
Access can also be revoked directly at myaccount.google.com/connections.
To request deletion of any remaining data, including the activity log, email admin@tahmoraventures.com. Requests are completed within 30 days.

7. Google API Services User Data Policy

Tahmora Mail Hub's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Children

The app is not directed to children under 13 and does not knowingly collect their data.

9. Changes

If this policy changes, the updated version will be posted on this page with a new effective date.

10. Contact

Tahmora Ventures · admin@tahmoraventures.com