Privacy Policy

This policy explains what Nebula ("we", "the app") does with your information, including data from the Google, Microsoft or Atomic Mail account you link. Nebula is run privately by its team manager for a small group of invited users.

Information we collect

• Your Nebula account: username, a protected (hashed) password, and login times.
• Linked mailboxes: you can link Gmail, Outlook (Microsoft) and Atomic Mail accounts. When you do, we receive the email address and a sign-in token (for Atomic Mail, an API key) that lets the app act on that mailbox. It is stored encrypted on our server.
• Email data: messages are read from your mailbox to show your inbox and to detect replies and bounces to proposals you sent. Messages you send through the app (proposals and replies) are stored with their delivery status.
• Settings you enter: your prompts, AI writer settings, and the API keys you add for your AI provider. API keys are stored encrypted on our server.

How we use Google user data

Nebula requests access to Gmail only to provide its features to you:

• showing, searching, labeling and deleting messages in your inbox when you ask;
• sending email from your account: replies you write, and proposals you send or set to send automatically;
• checking for replies and bounces to messages sent through the app.

Nebula's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train AI models. Data from Microsoft and Atomic Mail accounts is handled the same way.

AI services

Proposals are written with the AI provider you configure with your own API key (for example OpenAI or Anthropic). To write one, the project description and your prompt are sent to that provider under your key, and the provider's own terms and privacy policy apply to that request. Your email inbox is not sent to AI services unless you ask the app to draft a reply to a specific message, in which case that message's text is sent.

Who can see your data

• Team managers can see account activity (for example linked addresses, proposals sent, and delivery status), may sign in as a user to help them, and can recover API keys a user saved. Every recovery is logged.
• The server operator runs the computer that stores the data above, including the encrypted tokens and API keys.
• We do not share your data with anyone else, except where the law requires it.

Storage and security

Data is stored on the server that runs Nebula and is reached over an encrypted (https) connection. Stored sign-in tokens and API keys are encrypted on the server, passwords are hashed, and sign-in sessions are signed.

Your choices

• Unlink a mailbox at any time in Settings → Mail accounts. This deletes its stored token or key.
• You can also remove the app's access from your Google account permissions or Microsoft account permissions.
• Remove an AI provider's API key in Settings at any time. Removed keys stay in an encrypted recovery backup that team managers can restore; to stop a key working everywhere, revoke it with the provider.
• To have your account and its data deleted, email marianrose704@gmail.com.

Contact

Questions about this policy: marianrose704@gmail.com.