Privacy notice for the Mitt Mail review environment
This notice covers only the isolated Google verification environment at review.mittmail.2024.is, operated by 2024 ehf. Contact: mittdot@mittdot.is.
What this environment accesses
When you explicitly connect Google, the application uses openid and userinfo.email to identify the connected account and gmail.modify to read messages and attachments, compose and send mail, create and update drafts, change read/starred status and labels, archive, and move messages to Trash or restore them. It does not permanently delete received messages. Actions change your real Gmail account; use a dedicated test mailbox.
Server processing and storage
This web environment processes email content on its hosting server when proxying authorized Gmail API requests. Message bodies and attachments are handled transiently and are not saved to an application mailbox database. Access and refresh tokens are encrypted using AES-256-GCM in private server-side session storage. The encryption key, OAuth client secret and hashed application test password are stored outside the public document root. Sessions expire after an hour of inactivity; session files are eligible for garbage collection after two hours. Hosting backups, access logs and filesystem behavior are controlled separately by the operator.
Use and sharing
Google user data is used only to provide and verify the mail features described above. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Data is communicated to Google to perform requested Gmail operations and processed by the hosting infrastructure used to operate this review environment. Human access is limited to what is necessary for user-authorized support, security, legal obligations, or verification, consistent with Google's Limited Use requirements.
Control and deletion
Sign out or use Disconnect Google to remove Google tokens from this application session. This does not revoke Google's account-level authorization; revoke that separately through Google Account security settings. Contact mittdot@mittdot.is to request removal of remaining server-side review data. Gmail messages remain in Gmail unless you explicitly change them through the application.
Mitt Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements.