Paloma Mail — Privacy Policy
Effective October 17, 2026 · Paloma Mail is operated by Gonzalez Consulting LLC (Oklahoma, USA). Questions: info@gonzalezcap.com
Paloma Mail is an email app: it opens the mailboxes you choose to connect (Gmail, Google Workspace, Microsoft 365 / Outlook, Yahoo or any IMAP mailbox) in one place, so you can read, sort, answer and organize your mail. This page explains what Paloma Mail accesses, what it keeps, and your choices.
What Paloma Mail accesses
- Your mailbox, only after you connect it. For Google and Microsoft accounts you sign in on Google’s or Microsoft’s own sign-in page and approve access; we never see your Google or Microsoft password. For other providers you enter an app password that your provider gives you.
- Google accounts: Paloma Mail asks for your basic profile and email address (
openid email profile) and full mailbox access (https://mail.google.com/). It uses that access to open your mailbox over IMAP and send over SMTP, as you: to list and show your messages, search, mark read/unread, star, archive, delete, move to labels, snooze, answer calendar invites, and send the mail you write. - Microsoft accounts: the same, through Microsoft’s IMAP and SMTP permissions
(
IMAP.AccessAsUser.All,SMTP.Send) plus basic sign-in details.
A live window — your mail is not copied
Paloma Mail does not keep copies of your emails. Messages stay with your provider and are read live when you open them; every change you make (read, archive, delete, labels) happens directly in your real mailbox, so Gmail or Outlook shows the same thing. Your phone or browser keeps a short-lived cache so screens open quickly.
What we store
- Your Paloma account: your username, display name and settings.
- Connected mailboxes: the address, provider and your settings for each mailbox (color, nickname, notifications, what the assistant may keep).
- Sign-in credentials for your mailboxes: Google / Microsoft refresh tokens and app passwords, stored encrypted in our database vault. They are never shown back to anyone, including you, and are used only to open your mailbox for you.
- The assistant’s notes, keyed to message IDs: for each message, the provider’s message ID with the sorting label (business / topic), a one-line summary, reply reminders and cards you act on (receipts, bills, invites, requests). You choose per mailbox how much is kept — Notes & cards, Sort only (labels, no summaries) or Nothing (the assistant never reads that mailbox).
- Notification tokens: if you turn on notifications, your device’s push token, and the IDs of messages already announced so you’re never notified twice.
- Notices on your iPhone or iPad: with notifications on, the app keeps the latest new-mail notices on that device (at most 50, for up to 7 days) so new mail shows the moment you open the app; they’re cleared as the app catches up with your mailbox, when you remove a mailbox, and when you sign out. They never leave the device.
The assistant runs on our own server
Sorting, summaries and reminders are produced by software running on a server owned and operated by Gonzalez Consulting LLC. Your mail is not sent to outside AI companies, and Google user data is not used to train general-purpose AI or machine-learning models.
Who else handles data
We do not sell your data, show ads, or share your data with advertisers or data brokers. We use a few service providers only to run the app: Supabase (our database, where the items above are stored), Netlify (this website), Cloudflare (the secure connection to our server) and — only if you turn on notifications — Apple’s push notification service, which delivers the notice (sender, subject and the first line of the email, or just “New email” if you switch previews off). If you connect a calendar app from Paloma Mail (such as Hoy Genda), only the meetings and to-dos you choose are sent to it.
Google user data — Limited Use
Paloma Mail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing email features you see in Paloma Mail.
- We do not transfer it to others except as needed to provide or improve those features, to comply with the law, for security, or as part of a merger or acquisition with your notice.
- We do not use or transfer it for advertising, including personalized or retargeted ads, and never sell it.
- No person reads your email unless you ask us to (for example, for support), it is needed for security or to investigate abuse, it is required by law, or the data has been aggregated and anonymized for internal operations.
Your choices
- Disconnect a mailbox in Paloma Mail → Settings: its stored credentials and the assistant’s notes for it are removed.
- Revoke access at the source any time: Google — myaccount.google.com/permissions; Microsoft — account.microsoft.com/privacy/app-access (work accounts: myapps.microsoft.com).
- Delete your account and everything we hold: email info@gonzalezcap.com from an address we can match to your account. We delete it within 30 days and confirm.
- Turn notifications, summaries or the assistant off per mailbox in Settings.
Security
All connections use encryption (TLS). Mailbox credentials are stored encrypted, each person’s data is walled off by database access rules, and our staff’s access is limited to what running the service requires.
Children
Paloma Mail is not directed to children under 13, and we do not knowingly collect their information.
Changes
If this policy changes, we’ll update this page and the date above; for significant changes we’ll tell you in the app.