Dodosend logoDodosendDownload

Privacy policy

Last updated: November 7, 2026

Overview

Dodosend is a desktop email and calendar app for Google accounts. It has these parts:

  • The desktop app that you install.
  • The website at dodosend.com.
  • The sign-in service at auth.dodosend.com.
  • The API server at api.dodosend.com, which connects the app to Google.

This policy tells you which data we collect, how we use and protect it, and which choices you have.

Information we collect

Account information. When you sign in with Google, we receive your name, email address, and profile picture. We keep them to show which account you use. We also keep your plan. If you upload a profile picture, we keep that picture.

Google user data. When you connect a Google account, the app reads your Gmail messages, threads, labels, drafts, and attachments. It also reads your Google Calendar calendars and events. The app changes this data only when you tell it to. The section "How we use Google user data" tells you what we do with this data.

OAuth tokens. You sign in with Google OAuth, so we never see or keep your Google password. We keep the access and refresh tokens that Google gives us. With these tokens, the app can connect to your account while you are signed in.

Data that you save in Dodosend. Our server keeps the data that you save for later:

  • Saved tabs, which contain your searches.
  • Templates, which contain a name, a subject, and the text of the message.
  • Scheduled sends, which contain a draft identifier and a send time, but not the text of the message.
  • Reminders, which contain a thread identifier and a time.
  • Unsubscriptions, which contain the sender address, the unsubscribe method, and the date.

AI usage. For each request to the AI panel, we keep a usage record: your user identifier, your plan, the feature, the model, the number of tokens, the cost, the result, whether the request starts a new question, the limit that stopped the request if a limit did, and the time. We use these records to apply the AI limits of your plan, for example the number of questions a day. A record does not contain your question, the answer, your mail, or message identifiers.

Payment information. If you buy a paid plan, Stripe processes the payment. To charge the right tax, Stripe asks for the parts of your billing address it needs, and a business can add its VAT or tax number. Stripe keeps these details. We keep the Stripe customer and subscription identifiers and the status of your plan. We never see or keep card numbers.

Support notes. When we help you, write to you, or give you a paid plan at no charge, we can keep a short note about it with your account, so that the next person who helps you knows what happened. These notes do not contain mailbox content.

Technical data. Each request gives us your IP address, the app version, and device information. We keep this data only for the time necessary to operate and protect the service.

Diagnostics. We use PostHog to find errors and to see how people use the app. PostHog receives crash reports, app events, and performance measurements. Diagnostics do not contain mailbox content. They do not contain subjects, message text, drafts, attachments, search text, contact addresses, session values, or tokens.

How we use Google user data

Dodosend asks for the smallest set of Google permissions that it needs to operate as an email and calendar app. Each permission is for features that you use in the app.

Gmail (read, write, and send, "gmail.modify")

  • Show your mailbox: messages, threads, labels, and attachments.
  • Search your mail, and keep the app current with Gmail change notifications.
  • Archive, label, and star messages, and mark them as read or unread.
  • Move messages to the Trash, and restore them from the Trash.
  • Create, edit, and delete drafts.
  • Send messages and replies. For a scheduled send, our server sends the draft from Gmail at the time that you select.
  • Show a thread again at the time that you set for a reminder.
  • Unsubscribe from a mailing list when you tell the app to. Our server sends the one-click request of the sender, or sends the unsubscribe email from your account.
  • Read your "send as" addresses, so that you can select the sender address.

Dodosend never deletes mail permanently. Messages that you move to the Trash follow the Trash rules of Gmail. You can restore them from Gmail.

Google Calendar events ("calendar.events")

  • Show your events, which include the invitations that you receive by email.
  • Create, edit, and delete events, and add Google Meet links.
  • Accept, tentatively accept, or decline invitations.
  • Do these actions on the calendars that you own or that you can edit.

Google Calendar list (read only, "calendar.calendarlist.readonly")

  • Show the calendars in your account. You select which calendars to show, and the calendar for new events.

Limited Use

Dodosend's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. These rules apply:

  • We use Google user data only to provide and improve the features in this policy.
  • We do not use Google user data for advertisements, and we do not sell it.
  • No person at Dodosend reads your mail or calendar. There are three exceptions: you give permission for support, a security investigation makes it necessary, or the law makes it necessary.
  • We do not use Google user data to train or improve AI or machine learning models.
  • We transfer Google user data to AI models only to give you the AI features that you use. These transfers are not for generalized or non-personalized AI or machine learning models. The section "AI features" tells you which data goes to which AI provider.

AI features

Three features send text to an AI model. Our servers send the text to the model and do not keep it.

Search interpretation. When you open a search as a tab and the search is a sentence, the app sends the sentence to our server. Our server sends at most 500 characters through Vercel AI Gateway to an OpenAI model. The model changes the sentence into search filters.

Closest mail. Closest mail finds the messages that are closest in meaning to a sentence that you type in search. For this, the app makes a vector for each message. A vector is a list of numbers that shows the meaning of a text. The app sends this text to our server, and our server sends it to Voyage AI:

  • The subject, the sender, and the text of each message, one time for each message. The app removes link addresses and sends at most 8,000 characters.
  • Each sentence that you use to search for closest mail.

Voyage AI returns the vectors. The vectors stay on your device, and our server does not keep the text or the vectors. We set our Voyage AI account to refuse data use. Because of this, Voyage AI deletes each text after it makes the vector. Voyage AI does not use the text to train models.

AI panel. In the AI panel, you ask questions about your mail, and an AI model answers. The AI panel stays off until you agree on its first screen in the app. You can turn it off in Settings at any time.

To answer, the AI can search and read your mail. For each answer, the app sends:

  • Your question and the earlier messages of the conversation.
  • The subject and the sender of the conversation that is open in the app.
  • For each search result that the AI gets: the subject, the sender, the date, the labels, and a short preview.
  • For each conversation that the AI reads: the senders, the recipients, the dates, the names of the attachments, and the text of the messages. The app does not send the attachments.

Our server adds the instructions for the model, and sends the request through OpenRouter to GPT-6.1 Terra, a model made by OpenAI. GPT-6.1 Terra runs on Microsoft Azure in the European Union. We send each request only to endpoints with zero data retention: the company that runs the model does not keep the request or the answer, and does not use them to train models. OpenRouter keeps data about each request, for example the number of tokens and the time, but not the content of the request or the answer.

The AI can write drafts, which the app saves in Gmail. It can also propose changes, for example to archive a conversation or to move it to the Trash. The app makes a change only after you approve it. The AI cannot send mail, and it cannot delete mail permanently.

Our server does not keep your question, the answer, or your mail. It keeps only the usage record in "Information we collect".

Where your data is

On your device. The desktop app keeps a local copy of your mailbox and calendar in a database in its data folder. This copy contains messages, drafts, labels, events, and the vectors for Closest mail. Your operating system user account protects this folder. The app keeps your Dodosend session credential in an encrypted vault. The key for this vault is in the keychain of your operating system: macOS Keychain, Windows Credential Manager, or the Linux Secret Service.

On our servers. Our API server processes each request in memory and does not store the content of your mail. There are two exceptions:

  • The templates that you save, which our database keeps.
  • Remote images in messages. The app loads them through our server, so that senders do not get your IP address. Our server keeps each image in memory for at most 24 hours.

Our database also keeps your account profile, OAuth tokens, sessions, the data that you save in Dodosend, and the Gmail sync state. A cache keeps short-term data, for example draft identifiers, for at most 24 hours.

At Google. Your mailbox and calendar stay in your Google account. Dodosend makes your changes there, and you can see them in Gmail and Google Calendar.

How we protect your data

  • Encryption in transit. All connections between the app, our servers, Google, and our service providers use TLS.
  • Encryption at rest. Our database and cache operate on Railway infrastructure, which encrypts its storage. We also encrypt your Google tokens before we store them. On your device, full-disk encryption protects the local database if your operating system uses it. The session vault is always encrypted.
  • Token protection. Only our servers keep your Google tokens. We never write them to logs. Our servers refresh the tokens automatically. We delete them when you unlink a mailbox or delete your account. You can revoke them at any time on your Google Account permissions page, and our access stops immediately.
  • Access control. Our API accepts a request only with your session, and only for your own accounts. Only the operator can access production systems, through provider consoles that require sign-in. Nobody has routine access to user data. We keep secrets in environment configuration, never in code.
  • Least privilege. We ask only for the Google permissions in this policy, not for full access to your mailbox. We examine these permissions each time that the features change.
  • Logs. Our server logs record data about requests, for example times, endpoints, status codes, and internal identifiers. The logs never contain subjects, message text, drafts, addresses, search text, session values, or tokens.
  • Security incidents. If we find a security incident that affects your data, we tell you and the applicable authorities without undue delay.

Service providers

We share data only with the providers that we need to operate Dodosend. Each provider gets only the data that it needs for its task.

  • Google. Google gives sign-in and the Gmail and Google Calendar APIs.
  • Railway. Railway hosts our API server, sign-in service, database, and cache.
  • Vercel. Vercel AI Gateway sends search sentences to OpenAI.
  • OpenAI. An OpenAI model changes search sentences into filters.
  • Voyage AI. Voyage AI makes the vectors for Closest mail.
  • OpenRouter. OpenRouter sends AI panel requests to the GPT-6.1 Terra model, only to endpoints with zero data retention.
  • Microsoft. Microsoft Azure runs the GPT-6.1 Terra model for the AI panel, in the European Union.
  • PostHog. PostHog records errors, app use, and visits to our websites, without mailbox content.
  • Stripe. Stripe processes payments for paid plans.
  • Resend. Resend sends the emails that we send about your account, for example when we give you a paid plan at no charge.
  • GitHub. GitHub hosts the downloads of the desktop app.

We do not share data for advertisements, and we do not sell personal information. We can disclose information if the law makes it necessary.

Data retention and deletion

  • We keep your account profile and OAuth tokens only while your account is active.
  • When you unlink a mailbox in the app, we delete its tokens and stop the sync. The app also removes the local copy of that mailbox from your device.
  • When you delete your account, we remove your profile, tokens, sessions, our support notes about you, and all the data that you saved in Dodosend from our systems. We remove the AI usage records of past months. We keep the AI usage records of the current month without your user identifier, under a code that we make from your Google account identifier with a secret key. Thus a new account on the same Google account continues with the AI limits of that month. We delete these records in the first hour after the month ends (UTC).
  • Cache entries and stored images expire within 24 hours.
  • Voyage AI deletes the text for Closest mail after it makes the vectors.
  • OpenRouter and Microsoft Azure, which runs the GPT-6.1 Terra model, do not keep the content of AI panel requests.
  • PostHog keeps diagnostic data only for the time necessary to find and repair problems.
  • When you uninstall the app, the uninstaller removes the local database. You can remove the vault entry from the keychain of your operating system.
  • When you revoke Dodosend at myaccount.google.com/permissions, our access to your Google account stops immediately.

Our websites

Our websites, dodosend.com and auth.dodosend.com, use PostHog to count visits, to find errors, and to see how people use the pages. For this, PostHog keeps an identifier in your browser, and it records your visits: the pages that you open, what they show, your clicks, and your scrolling. PostHog does not record what you type in password fields. When you sign in, the website gives PostHog your user identifier, your email address, and your name, so that PostHog counts your visits and your use of the app as one person.

A Dodosend user can share a gift link with a friend. When you open a gift link, your browser keeps the link's code in a cookie for 30 days. If you then sign in to Dodosend in that browser for the first time, we record which user shared the link, and we tell PostHog that you came through a gift from that user. The user who shared the link is not told. The link's code is not sent to PostHog.

The download page asks GitHub for the latest version, and the download comes from GitHub. GitHub receives your IP address for these requests.

What we do not do

  • We do not keep your passwords.
  • We do not send marketing email.
  • We do not sell your personal information.
  • We do not delete your mail permanently.

Your rights

You can ask us to show, correct, or delete the personal data that we keep about you. Send your request to the address in "Contact". You can also delete your account in the app.

Account deletion

To delete your account, do these steps in the desktop app:

  1. Open Settings.
  2. In Account, select Delete account.
  3. Type DELETE, and then select Delete account.

This removes your Dodosend user and its mailboxes from our systems. Your mail stays in Gmail.

Children's privacy

Dodosend is for a general audience and not for children. We do not knowingly collect personal data from children.

Changes to this policy

We can change this policy. When we change it, we change the "Last updated" date at the top of this page.

Contact

If you have questions about this policy, send an email to chergaoui@houdaifa.com.