Last updated: September 22, 2026

Privacy Policy

Effective date: 15 September 2026. Last updated: 22 September 2026. This policy applies to the Turbomail service at https://turbomail.beast.falcongo.xyz/.

This document explains what personal data Turbomail collects, including data received from Google APIs, why we process it, how long we keep it, who we share it with, and the rights you have. It is written to meet Google’s OAuth verification requirements for apps that request Gmail scopes, and the EU General Data Protection Regulation (GDPR) where it applies.

1. Who we are

The controller of personal data processed through Turbomail is Augustinas Žinevičius, operating the service from Lithuania in the European Union. Contact: augustinas@nomads.lt.

If you connect a Gmail account, Google remains the provider of your Google Account. Turbomail is an independent application that you authorise to access specific Gmail APIs on your behalf.

2. What this policy covers

This policy covers:

the public website (homepage, this Privacy Policy, and the Terms of Service);
the Turbomail workspace, including mailbox connection, drafting, sending, and inbox views;
personal data you provide to us, and personal data we receive from Google when you grant consent.

It does not cover Google’s own processing. Google’s practices are described in the Google Privacy Policy.

3. Google user data we access

Connecting Gmail is optional. If you choose Sign in with Google, Turbomail requests only these two OAuth scopes — the same full URIs requested in the authorization URL and configured in Google Cloud Console. We follow least privilege: every requested scope is required for a user-facing feature, and we do not request Gmail access for features that are not implemented.

Scope	Type	User-facing feature	Why a narrower scope cannot be used
https://www.googleapis.com/auth/gmail.send	Sensitive / write	The user composes or approves a message, then sends it. Recipients receive mail from the user’s Gmail address. The same message appears in Gmail Sent.	gmail.compose only creates drafts. gmail.insert can add a message to the mailbox without delivering it. mail.google.com would also send, but it grants modify and permanent-delete access we do not use.
https://www.googleapis.com/auth/gmail.readonly	Restricted / read	Show the connected Gmail address, list inbox and sent mail (sender, recipient, subject, snippet, date), match replies to sent mail, and keep connection status current.	gmail.metadata omits bodies and snippets, so inbox view and reply matching cannot work. We do not request userinfo.email; the mailbox address comes from the Gmail profile under gmail.readonly. mail.google.com would also read mail but would add modify and permanent-delete access.

We do not request scopes that would allow Turbomail to:

permanently delete mail, bypassing Trash;
modify or delete messages, labels, filters, or forwarding;
access Drive, Calendar, Contacts, or other Google products that the product does not use;
read the Google Account email through userinfo.email or OpenID profile scopes — the connected address is read from Gmail with gmail.readonly.

Google user data we may receive under those scopes includes: your Gmail address from the mailbox profile; OAuth access and refresh tokens; message metadata (From, To, Subject, Date, Message-ID, thread identifiers); and message body content needed to display mail, draft replies, and attach incoming mail to the correct conversation.

4. How we use information

We process personal data only for these purposes:

Account and security. Create and authenticate your Turbomail workspace, keep sessions, and prevent unauthorised access.
Mailbox connection. Store tokens so the workspace can send and read mail after you connect Gmail, and show which inboxes are connected.
Sending. Transmit messages you approve through Gmail, and keep a record of what was sent so you can see status in the product.
Inbox and replies. Read mailbox content to display threads, match replies, and surface relevant incoming mail in the user interface.
AI drafting (optional). If you ask Turbomail to suggest copy, we send the prompt and the minimum mailbox context needed for that draft to our drafting processor so the suggestion can appear in the product. You review and send the result yourself.
Support and legal. Respond to your requests, protect the service, and meet legal obligations.

Where GDPR applies, the legal bases are: performance of a contract (providing the workspace you asked for); consent (Google OAuth, which you may withdraw at any time); and legitimate interests in securing and operating the service, balanced against your rights.

Google user data is used only to provide or improve user-facing features that are prominent in Turbomail (connected mailboxes, drafts, send from your inbox, and follow-up of incoming mail). We do not use Gmail content for unrelated analytics products, advertising, or profiling.

5. Google Limited Use

Turbomail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Permitted use

Google user data, including Gmail message content obtained via restricted scopes, is used solely to provide or improve user-facing features that are visible and prominent in Turbomail.

Transfers

We do not transfer Google user data except:

to subprocessors that help us provide those same user-facing features (hosting the application, and, when you request an AI draft, the drafting processor), and only as needed for that purpose;
for security purposes (for example investigating abuse);
to comply with applicable law;
as part of a merger, acquisition, or sale of assets, and only after obtaining explicit prior consent from you where Google’s policy requires it.

Human access

Humans at Turbomail are not allowed to read Google user data unless:

you first gave affirmative agreement to view specific messages or other data;
it is necessary for security purposes (for example investigating a bug or abuse);
it is necessary to comply with applicable law; or
the data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy law.

Prohibited uses

We do not:

sell Google user data, or transfer it to data brokers, information resellers, or advertising platforms;
use Google user data for serving ads, including retargeting, personalised, or interest-based advertising;
use Google user data to determine credit-worthiness or for lending;
use Google user data, including Gmail content, to train, improve, or fine-tune general-purpose AI or machine-learning models, including models used by our drafting processor for other customers.

We do not sell personal data. We share it only with providers that process it on our instructions to operate Turbomail:

Recipient	Role	Data involved
Hosting provider (application and database in the EU)	Stores the workspace, tokens, and message records needed to run the product	Account data, OAuth tokens, mailbox identifiers, and message content processed by Turbomail
OpenAI, when you request an AI draft	Generates suggested email copy for the drafting feature	The text you submit and the minimum related context needed to produce that draft
Google	Authenticates OAuth and provides Gmail send and read APIs	Whatever you authorise on the Google consent screen

OpenAI is used only to provide the optional drafting feature in the user interface. Drafting requests are not used by Turbomail to train general-purpose models. You should not submit information you are not allowed to share with that processor.

7. Storage, security, and location

Turbomail stores data on servers used to run the application and its database. Transmission to Google and to the website uses HTTPS. OAuth tokens are stored so the product can act on the mailbox until you disconnect it or revoke access. Access to the workspace is limited to authorised users of that account.

No method of transmission or storage is completely secure. You should use a strong password, protect your Google Account, and revoke Turbomail if a mailbox should no longer be connected.

If a processor is located outside the European Economic Area (for example OpenAI in the United States), we rely on an appropriate transfer mechanism, such as the processor’s standard contractual clauses or other lawful safeguards, for that processing.

8. Retention and deletion

We retain personal data only as long as needed for the purposes above:

account and mailbox records: while the account or mailbox connection remains active;
OAuth tokens: until you disconnect the mailbox, revoke Google access, or the token expires or is replaced;
message content stored to operate sending and inbox features: while needed for those features, and no longer than the life of the account unless a legal hold applies;
security and legal records: only as long as required by law.

You can stop Gmail access at any time by:

disconnecting the mailbox inside Turbomail, if that control is available in your workspace; and/or
revoking Turbomail under Google Account → Third-party connections.

To delete your Turbomail account and Google user data we store, email augustinas@nomads.lt with the subject “Delete my Turbomail account”. We will delete or irreversibly anonymise the personal data we hold, including Gmail tokens and stored message content, unless we must keep a limited record to meet a legal obligation (for example an invoice or abuse investigation). We aim to complete deletion requests within 30 days.

9. Your rights and choices

Depending on applicable law, you may have the right to:

access a copy of personal data we hold about you;
correct inaccurate data;
erase data, or restrict or object to certain processing;
receive data you provided in a portable format;
withdraw Google OAuth consent without affecting processing that occurred before withdrawal;
lodge a complaint with a supervisory authority.

To exercise these rights, email augustinas@nomads.lt. If you are in the EEA or Lithuania, you may also contact the State Data Protection Inspectorate (VDAI) in Lithuania.

10. Cookies and account data

The public pages do not require an account. The workspace uses a session cookie (currently named turbomail_session) to keep you signed in. We also store your workspace name, email address, and a hashed password. We do not use advertising cookies or third-party ad trackers on the public site.

11. Children

Turbomail is not directed at children under 16. We do not knowingly collect Google user data from children. If you believe we have, contact augustinas@nomads.lt and we will delete it.

12. Changes

We may update this policy when the product, subprocessors, or legal requirements change. The “Last updated” date at the top will change. Material changes that affect Google user data will be reflected here before the new practice begins. Continued use of Turbomail after an update means you accept the revised policy. The current policy is always published at https://turbomail.beast.falcongo.xyz/privacy, which is the same URL linked from the Google OAuth consent screen.

13. Contact and complaints

Privacy and deletion requests: augustinas@nomads.lt.

This policy is provided so you can make an informed choice before granting Gmail access. It is not legal advice.