Privacy Policy

Introduction

MarleyFetch ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our service.

Information We Collect

Sign-In Information

When you authenticate with a third-party sign-in provider such as Google, we collect:

• Your email address
• Your name
• Your profile picture
• Provider account ID

Sending Connection Data

When you add an SMTP connection, we collect the information needed to route your mail, such as:

• Sender email address
• SMTP host, port, and encryption settings
• Authentication username
• Credentials required to deliver your mail

Usage Data

We collect information about how you use our service:

• Email sending logs (recipient, subject, timestamp, status)
• API token usage statistics
• Authentication timestamps

How We Use Your Information

We use your information to:

• Provide and maintain our email sending service
• Authenticate your identity and authorize API requests
• Maintain your configured sending connections
• Send emails through the SMTP connections you configure
• Generate activity logs and usage statistics
• Improve and optimize our service
• Communicate with you about service updates

Data Storage and Security

Your data is stored securely using industry-standard practices:

• Sensitive sign-in and sending connection data is stored in protected infrastructure
• All connections use HTTPS/TLS encryption
• Access to your data is restricted and monitored

Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

• With your consent: When you explicitly authorize data sharing
• Service providers: With trusted service providers (Cloudflare) who help us operate our service
• Legal requirements: When required by law or to protect our rights

Cookies and Similar Technologies

We use only cookies and local storage that are strictly necessary to provide the service you asked for. We run no analytics, no advertising and no cross-site tracking, and we do not embed third-party scripts on page load — our web fonts are served from our own domain rather than a third-party CDN. Because nothing we set is used for tracking, no consent banner is required under Article 5(3) of the ePrivacy Directive.

• Session cookie: Set when you sign in to the dashboard so we can keep you signed in. Expires when your session ends.
• Cloudflare security cookies: Set by Cloudflare, our hosting and CDN provider, to block bots and abusive traffic (including the Turnstile check on public sign-up and contact forms).
• Paddle cookies: Set by Paddle, our payment provider, only once you open a checkout or billing page. We do not load Paddle on ordinary page views.
• Local storage: Used to remember interface preferences and that you have seen the cookie notice. Never sent to our servers.

You can clear or block cookies in your browser settings at any time. Blocking the session cookie will prevent you from signing in.

Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Revoke access: Remove a sending connection or disconnect third-party sign-in access at any time
• Data portability: Request your data in a structured format

To exercise these rights, you can update your dashboard settings, revoke sign-in access through your identity provider settings, or contact us directly.

Data Retention

We retain your data for as long as your account is active or as needed to provide services. When you remove access or delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes.

Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this policy. Your continued use of the service after any changes constitutes acceptance of the updated policy.

Google User Data & Limited Use

If you sign in with Google, MarleyFetch's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy , including the Limited Use requirements.

We use Google sign-in only to authenticate you and display your basic profile information (name, email address, and profile picture) within the MarleyFetch dashboard. We do not read your Gmail, access your contacts, or send mail through your Google account — outgoing email is delivered through the SMTP connection you configure yourself. Specifically, MarleyFetch does not:

• Transfer or sell Google user data to third parties such as advertising platforms, data brokers, or any information resellers.
• Use Google user data for serving advertisements, including retargeting, personalized advertising, or interest-based advertising.
• Use Google user data to determine credit-worthiness or for lending purposes.
• Allow humans to read Google user data, unless we have your affirmative consent, it is necessary for security purposes (such as investigating abuse), required to comply with applicable law, or the data is aggregated and used for internal operations in line with the Limited Use policy.

You can revoke MarleyFetch's access to your Google account at any time through your Google Account permissions page. Profile data received from Google sign-in is deleted within 30 days after you delete your MarleyFetch account, unless retention is required by law.