Privacy Policy

Wompy (“we”, “us”) turns your inbox into a chat-style conversation with each person and company you email. This policy explains what we collect to do that, why, and what choices you have. Wompy is early — this policy will evolve as the product does, and we’ll update the date above whenever it does.

What we collect

• Account info: your email address, and a password if you sign up that way rather than with Google.
• Email content:when you connect a mailbox (currently Gmail), we access messages, threads, and labels via Google’s API so we can display and organize your mail as conversations. This includes message bodies, senders, recipients, and attachments.
• Usage data:basic product analytics — currently limited to what we need to operate the service (error logs, request timing). We plan to add a privacy- conscious analytics tool (such as PostHog) and/or Google Analytics to understand how Wompy is used and improve it; if and when we do, this section will be updated with specifics on what’s collected and how to opt out, before it goes live.

How we use it

• To show your mail as conversations and keep it in sync.
• To operate account features like sign-in, read/unread state, and reactions.
• To send you account-related email — welcome messages, password resets, and similar transactional mail.
• Once added, aggregated product analytics to understand usage patterns and improve the app — never to sell your data or target you with third-party advertising.

Google user data

Wompy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the Gmail access needed to display and organize your mail, and we never use it to serve ads. OAuth tokens are encrypted at rest, separately from the database itself, so a database compromise alone doesn’t expose usable mailbox credentials. Revoking Wompy’s access from your Google Account settings disconnects the mailbox immediately.

Who we share it with

We don’t sell your data. A small number of service providers process it on our behalf, under their own privacy and security commitments, strictly to run Wompy:

• Google — to access Gmail on your behalf, per the permissions you grant.
• Supabase — our database and authentication provider, where account and message data is stored.
• Mailtrap — delivers transactional email (e.g. password resets) on our behalf.
• Future analytics providers (e.g. PostHog, Google Analytics) — if added, they would receive usage data as described above, not email content.

Your choices

• Disconnect a mailbox any time from Settings, or by revoking access in your Google Account.
• Request deletion of your account and associated data by emailing us (below) — this removes your profile, connected mailboxes, and stored messages.
• Once analytics are added, we’ll provide a way to opt out of non-essential tracking.

Contact

Questions about this policy or your data? Email us at [email protected].