Privacy & permissions. Read-only Gmail access.

What Google user data we access

• Gmail message metadata and content (sender, subject, date, and attachment files) needed to search your inbox and fetch the specific attachments you choose to download, via the read-only gmail.readonly scope.
• Your basic Google account profile (email address and name) via the openid/email/profile scopes, used only to show which account is signed in inside the app UI.

How we use your Google user data

• Gmail data is used solely to let you search your own inbox by date range, sender, or label, and to build the ZIP file of attachments you explicitly request.
• Your account profile is used only to display who is signed in and to associate your own usage history (file/byte counts, not message content) with your account.
• We do not use your Google user data for advertising, profiling, or to train any AI/ML model, and we do not use it for any purpose beyond fulfilling the specific download you requested in that session.

Who we share your data with

• We do not sell, rent, share, transfer, or otherwise disclose your Google user data to any third party, for any purpose.
• Gmail data never leaves the request that fetches it — attachments are streamed directly from the Gmail API into your own ZIP download and are never sent to, or stored by, any other service or party.
• The only exception is where required by law (e.g. a valid legal request) or to protect against fraud or abuse of the service.

How we protect your data

• All connections to Google's APIs and to BulkZip itself are encrypted in transit via HTTPS/TLS.
• We do not store your email bodies or attachment content — see "What we store" below.
• Your Google OAuth access and refresh tokens are encrypted (AES-256-GCM) inside an HTTP-only, same-site session cookie, never exposed to client-side JavaScript, and are discarded when you disconnect or your session ends.

What we store

• We do not store your email bodies or attachment content.
• Attachments are fetched on demand and streamed directly into a ZIP download, never written to disk on our servers.
• We retain lightweight, non-content usage records tied to your account (file/byte counts processed, timestamps, error status) so you can see your own download history — never message or attachment content itself.
• Sessions use an HTTP-only cookie; you can disconnect any time.

How to revoke access

You can disconnect inside the app, or remove BulkZip from your Google Account’s third-party access list to fully revoke permission. Revoking access immediately invalidates our ability to access your Gmail data going forward.