Privacy Policy

Thumbmail ("Thumbmail", "we", "us") is an AI email assistant operated by Caring Abode (Australia). This policy explains what information we access, how we use and protect it, and your choices. By connecting your inbox you agree to this policy.

1. What we access

When you connect a Microsoft (Outlook) or Google (Gmail) mailbox, you grant Thumbmail access via the provider's official API to:

• Your basic profile — name and email address (used for your account and to sign off drafts).
• Your mailbox — to read incoming and sent messages (for triage, summaries, learning your writing style, and finding subscriptions), and to create draft replies and send messages you approve. Microsoft scopes: Mail.ReadWrite, Mail.Send. Google scopes: gmail.modify, gmail.send.
• Your mobile number — only if you provide it, to send you SMS notifications and accept your replies.

2. How we use it

• Triage new mail and notify you about what matters (by SMS and/or a daily brief).
• Draft replies in your writing voice and answer questions about your inbox.
• Generate summaries, briefs, and a list of your subscriptions/sign-ups.
• Draft-first: Thumbmail prepares drafts and only sends an email after you explicitly approve it. It does not send on your behalf without your confirmation.

3. AI processing

To generate drafts, summaries and triage decisions, relevant email content is sent to our AI provider, Anthropic (the Claude API), for processing. Anthropic processes this data to return a result and, per its commercial terms, does not use it to train its models. We send only what is needed for the feature you are using.

4. Google & Microsoft "Limited Use"

Thumbmail's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google (and Microsoft) mailbox data only to provide and improve the user-facing features described above, do not sell it, do not use it for advertising, and do not allow humans to read it except with your consent, for security/abuse/legal reasons, or in aggregated/anonymised form.

5. Sharing & subprocessors

We do not sell your data. We share data only with the service providers needed to run Thumbmail:

• Microsoft / Google — your mail provider (source of the data).
• Anthropic — AI processing (drafts, summaries, triage).
• Twilio — sending/receiving your SMS notifications.
• Stripe — subscription billing (we never see your full card details).
• Supabase (database) and Fly.io (hosting) — store and run the service.

6. Storage & security

We store your account record, settings, learned writing-voice summary, knowledge notes, and your email-provider access tokens. Access tokens are encrypted at rest (AES-256). We do not keep a copy of your full mailbox; messages are fetched on demand and processed transiently. Data is hosted in a Sydney (Australia) region.

7. Retention & your choices

• We keep your data while your account is connected. You can disconnect at any time, after which we delete your tokens and account data.
• You can request access to or deletion of your data by emailing us (below).
• You can stop SMS at any time by replying PAUSE, or manage notifications in your settings.

8. International transfer

Some providers (e.g. Anthropic, Stripe) may process data outside Australia (including the United States). By using Thumbmail you consent to this transfer for the purposes described.

9. Australian Privacy Act

We handle personal information in line with the Australian Privacy Principles (Privacy Act 1988). If you have a privacy concern or complaint, contact us first; you may also contact the Office of the Australian Information Commissioner (OAIC).

10. Children

Thumbmail is for adults (18+) and is not directed at children.

11. Changes

We may update this policy; material changes will be posted here with a new date.

12. Contact

Questions or requests: info@caringabode.com.au.