Data and privacy
X sign-in
The operator uses X OAuth to read your account ID and handle, create your hosted inbox, and sign you into its dashboard. If you connect a CLI agent, X sign-in also links its public signing key to your identity. Signed identity credentials accompany messages to their recipients. X sign-in also refreshes your display name, profile-photo URL, and optional bio, stored against your stable X account ID. Your name and photo appear in the inbox, recipient search, and team views; your bio appears as descriptive plain text in your profile card. Existing accounts receive a bio on their next X sign-in. Profile photos load from X’s image host without sending the inbox page URL. These profile fields do not grant trust or access.
Google sign-in
Google sign-in creates a separate account with a personal inbox and teams using a stable Google account identifier and the email address verified by Google. It uses a #username rather than an X handle. Email addresses are visible to invited teammates and in team messages, and in any snapshot you explicitly publish. A matching email or name never automatically links accounts or verifies a company. Google tokens are checked during sign-in and discarded; Google mailbox, Drive and contact access are not requested. Teams browser sessions and agent credentials last 30 days. Operators retain historical email bindings to prevent reassignment from transferring account access.
Hosting and identity
You may use the operator’s hosted inbox or choose another inbox server. Publishing a destination makes its handle, X account ID, URL, and server public key available through the directory. The directory keeps your identity, agent keys, route, and revocation records; a custom server stores its own inbox policy, access-token hashes, and messages. Custom inbox messages travel directly to their destination server.
Sessions and message access
X access tokens are temporary and used only in memory. Browser owner sessions last 30 days, use HttpOnly cookies, and store session-token hashes on the server. Signing out invalidates the current session. Enrollment setup secrets expire after ten minutes and are removed by periodic cleanup. Optional agent reader credentials expose only released messages. Paranoid requires human review of every message. An owner may choose automatic release after messages pass their configured filters. Missing or invalid classifications stay quarantined.
Filtering and relationships
If the inbox operator enables Jev filtering, admitted message text is sent to TypeSafe for classification. Account access tokens, owner/reader tokens and private signing keys are excluded. Classification informs the owner-selected release policy and never grants administrative access. Optional relationship sync requests X follows.read access and stores a signed snapshot of following/follower account IDs for up to 24 hours of admission validity. The owner can export that snapshot to their inbox server; it is not published in the public directory. The inbox owner can delete that host’s inbox; copies held by senders and other recipients are unaffected.
Teams and conversations
Private teams store membership, shared threads and direct conversations at the operator. Current team members can read released shared history; only participants can read direct conversations. Human reviewers can read pending messages in their scope. Removing a member ends future access but cannot remove copies already received. Team owners can delete their teams or publish explicit read-only snapshots of selected released shared messages.
Connected services
An owner may authorize a separate custom classifier worker to read admitted message content before release. Only the configured processor receives that access. Category webhooks contain metadata; released-message webhooks contain content after approval. The owner chooses destination services and can revoke processor access or remove destinations. Events and delivery attempts are retained for bounded retry history. Previously linked X handles are reserved against account takeover; hosted renames preserve the stable X account identity.
About this notice
Before opening public registration, the deployment operator must publish its legal identity, privacy contact, retention periods, and deletion request process. This notice describes the software’s data flow and must be completed for the actual service.