Privacy Policy

01. Information We Collect

When you use gork.email, we collect necessary account information and platform metrics to provide secure API services:

• Authentication Data (Google OAuth SSO): When you authenticate via Google, we collect your name, primary email address, and Google profile photo URL. We use this exclusively to authenticate your account and provision your isolated organization.
• API Credentials & Hash Hashes: API keys and secrets generated via the dashboard are stored using salted SHA-256 password hashes. Raw API keys are never stored in cleartext.
• Email Transaction Payloads: Email messages, metadata, headers, and attachments processed through your configured inboxes and webhooks.
• Usage & Telemetry: Log data including IP addresses, user agents, API endpoint invocation counts, and latency statistics for rate-limiting and security auditing.

02. How We Use Google User Data

gork.email integration with Google APIs (Google Sign-In / OAuth 2.0) adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.

03. Multi-Tenancy & Data Isolation

gork.email enforces strict Row-Level Security (RLS) across Neon PostgreSQL databases. Every customer organization operates within an isolated tenant boundaries:

• No cross-tenant data leakage is permitted. Queries resolve dynamically against the authenticated user's organization ID.
• Attachments are securely encrypted at rest in Cloudflare R2 object storage.
• Payload sizes are capped (15MB max) and checked for safety against malicious zip bombs and script injections.

04. Data Retention & Deletion

You maintain full ownership of your data on gork.email:

• You can request complete account and data deletion at any time by contacting our support team or deleting your organization from the Developer Dashboard.
• Upon account termination, all API keys, webhook configurations, inbox mapping, and raw email payloads are permanently purged from active databases within 30 days.