Privacy Policy

1. Information we collect

• Account information: your email address, name when provided, account identifiers, sign-in information, account settings, subscription or credit balance, and account activity. If you use Google or Microsoft sign-in, we receive the identity information needed to create or authenticate your account.
• Messages and recipients: recipient phone numbers, message text, the selected message type, and images or other supported content you submit. Email-based sending may also involve sender and recipient email addresses, subjects, headers, and attachments.
• Connection information: permissions you grant, identifiers for connected applications, API-key records, and authorization records used to enable, expire, or revoke access.
• Operational information: timestamps, request identifiers, duplicate-prevention records, sending history, message status, provider responses, usage, and errors.
• Website and device information: IP address, browser information, pages visited, referring pages, campaign parameters, and cookie or session identifiers where available.
• Billing and support information: payment and subscription references, transaction status, and information you send when you contact us. Stripe processes checkout payment details; we receive information needed to administer billing.

2. Email, contacts, and connected applications

When you send or forward an email to the service, we receive the information included in that email, which may include quoted conversations, signatures, addresses, headers, and attachments as well as the intended message. Include only information you are authorized to share. Distribution lists and account settings may contain recipient names, phone numbers, email addresses, and routing preferences.

When an application uses your API key or account connection, we receive the message, recipient details, authorization information, and request metadata that it submits. Where supported, we also process replies and delivery acknowledgements and may forward them to the sender. The text.email ChatGPT plugin uses a full-account OAuth authorization to send messages and read or change supported account settings and routing rules. We receive the tool requests and values sent to the plugin, and return the requested account information and operation results to ChatGPT. Depending on the request, returned information can include your account email, account status, settings, authorized senders, subdomains, routing preferences, and send results. ChatGPT processes this information under its own privacy policy and your applicable account controls. You can revoke the connection in account Settings. The connected application's own privacy policy also applies.

3. How we use information

We use information to operate your account; authenticate requests; route and send messages; provide sending history; prevent duplicate requests; enforce plan limits; process billing; troubleshoot problems; answer support requests; understand website use; detect fraud, spam, and abuse; and meet legal obligations.

Automated screening: Some messages are sent to OpenAI's API for classification to help detect prohibited content and select an appropriate sending route. This processing can include the message text and a derived account or sender identifier. Screening can block a message and can make mistakes. Contact support if you believe a message was incorrectly rejected. This screening is distinct from training our own models. OpenAI's handling of API data is governed by the terms and data controls applicable to that service.

4. Who receives information

• Recipients: the people you choose receive the content you send and any sender information presented by the delivery channel. They can retain, copy, or share it.
• Messaging and infrastructure providers: messaging providers, carriers, hosting and infrastructure services, and delivery systems process information needed to run the service. Depending on the route, these may include SimpleTexting, Vibes, other configured SMS providers, and Apple's services for iMessage.
• Account, payment, and screening services: Google or Microsoft for the sign-in method you select, Stripe for payments, and OpenAI for message screening. Storage providers, including Amazon Web Services, may store attachments and related files.
• Legal and business purposes: we may disclose information when required by law, to respond to valid legal process, protect people and the service, or investigate misuse. Information may also be transferred in a merger, acquisition, or sale of the relevant business, subject to applicable law and notice requirements.

We do not sell personal information or share it for cross-context behavioral or targeted advertising. A provider or platform may have its own privacy obligations and policies. This policy does not control how recipients or independent third-party services handle information after receiving it.

5. Anonymous public testing

text.email offers anonymous tests without an account. Recent anonymous test activity can appear in a public demonstration log, including message excerpts or subjects, time, status, and partially masked sender and recipient details. Do not put personal, confidential, or sensitive information in an anonymous test. Masking an address does not remove personal information you put in the message itself. Account-associated sends are not included in that anonymous demonstration log.

Attachment links: Attachments may be stored and made available through download links included in messages. Anyone who obtains one of these links may be able to access the file without signing in, including people to whom the recipient forwards it. Treat these links as confidential; they are not a private account login.

6. Cookies and website measurement

Our account pages use cookies and related mechanisms for sign-in, sessions, security, and remembering how visitors reached the service. The text.email website also uses Google Tag Manager to manage website tags and records page visits and referral information. A landing cookie can retain the first visited URL, referrer, campaign parameters, and a browser identifier for up to one year. Server-side logs also record visits. The tags loaded through Google Tag Manager may change with website configuration.

You can use your browser settings to limit or delete cookies. Blocking essential cookies can prevent sign-in or other account features from working. Clearing cookies does not delete account or message records held by the service.

7. Retention and deletion

We do not currently apply one fixed deletion period to all data. Account, message-history, operational, and billing records may remain after a message has been sent. Retention depends on the record's purpose, the need to provide account history and support, prevent duplicate sending and abuse, resolve disputes, and satisfy legal or accounting obligations.

You can request deletion by contacting us. We assess the request against those needs and applicable law and explain any relevant limitations. Disconnecting ChatGPT, revoking an API key, or allowing an authorization token to expire does not itself delete prior records. Removing records from our systems cannot recall a delivered message or automatically delete copies held by recipients, ChatGPT, carriers, or other providers. Backup copies may persist until overwritten or removed under the applicable backup process.

8. Security

We use safeguards that include HTTPS for API and account-connection traffic, access controls, hashed API keys and OAuth tokens, and encryption for account message-history text. These protections do not mean that all information is encrypted at every stage: message content must be available to systems that screen, queue, and deliver it. text.email does not provide end-to-end encryption across the complete path from an email provider or connected application through our systems to a recipient.

No service can guarantee complete security. Keep API keys and account credentials private. Avoid including keys or sensitive message content in URLs, which can be recorded in browser history, server logs, or other systems.

9. Your choices and privacy requests

You can revoke a connected application or an API key in Settings → API keys. This stops future use of that credential; it does not cancel a request already accepted or queued. You can also stop forwarding emails and remove connected applications in their own settings. Contact us to request account closure; cancel subscriptions or automatic top-ups separately as described in our Terms of Service.

Depending on where you live and which laws apply, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent; or appeal a privacy-request decision. Email us to exercise an applicable right, including if you received a text without having an account. We may need information to verify your identity or authority, and exceptions may apply. We will respond within the time required by applicable law. Where applicable, you can also contact your local privacy regulator.

Where a legal basis is required, we process information to provide the requested service, pursue legitimate interests such as security and service operation, meet legal obligations, or act on consent when required. Withdrawing consent does not affect processing that was lawful before withdrawal.

10. International processing and children

GMass, Inc. is a U.S. business. Our service and providers may process information in countries other than where you live, where privacy laws may differ. Contact us for information about the providers and safeguards relevant to your use.

The service is intended for adults, not children. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

11. Changes to this policy

We may update this policy as the service or our practices change. We will update the date above and provide additional notice or obtain consent when required by applicable law. This policy applies to the services described above, not to unrelated GMass products that have their own policies.

12. Contact

For privacy questions or requests, email ajay.goel@text.email with the subject “text.email privacy request.” Include the account email or enough information to identify the relevant interaction. Do not send passwords or API keys.