Privacy Policy

1. Who we are

NEXA Inbound is a private, single-user tool built and operated by Emre (NEXA) in the Netherlands. It is used only to read the operator's own Gmail account. It does not offer accounts to other people. Questions about this policy can be sent to the developer contact email shown on the Google consent screen of this app.

2. Google permission requested

NEXA Inbound requests only the read-only Gmail scope https://www.googleapis.com/auth/gmail.readonly. It does not request permission to send, delete, modify or label email, or to access contacts, calendar or files.

3. What data is read

• Only messages whose sender is an official domain of a freelance platform (for example freelancer.com, upwork.com, contra.com, malt.com, peopleperhour.com, guru.com, fiverr.com), received in the last few days, excluding spam and trash. The search filter runs at Google, so other email is never downloaded.
• For each matching message: the message headers needed to check that it really comes from the platform (sender, Gmail's authentication results), the subject and body, in order to extract the project details.
• At most 50 messages per run.

4. What data is stored

• Project cards: platform, project title, budget, a short summary (capped length), the https link to the platform's own project page, and the time received.
• Processed-message list: Gmail message ID, thread ID and processing time, so a message is not read twice. Only the most recent 3,000 entries are kept.
• OAuth credentials: the Google refresh token, stored encrypted or as a file readable only by the service, on the operator's own computer and private server. Tokens are never logged or published.
• Full raw email bodies and attachments are not stored.

5. How data is processed

Project cards are used only to show the operator a list of possible freelance projects and to help him prepare a response, which he submits himself on the platform's website. Text from emails is treated as untrusted data. NEXA Inbound never sends email, never contacts the platforms automatically and never places bids.

6. Sharing

Gmail data is not sold, rented or shared with third parties, and is not used for advertising. It is only visible to the operator, in his own access-controlled dashboard. Infrastructure that stores the data (the operator's private server) is under the operator's control.

7. Google API Services User Data Policy

NEXA Inbound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used to develop, improve or train generalized AI or machine learning models, and no person reads the data except the operator himself, or where required by law or for security.

8. Retention and deletion

• Project cards are kept until the operator deletes them. The processed-message list keeps only the latest 3,000 IDs.
• You can revoke access at any time at myaccount.google.com/permissions. After revocation the stored token no longer works and no further email can be read.
• On revocation or request, the operator deletes the stored token files and the stored project cards from his computer and server.

9. Security

Credentials are stored with restricted file permissions or Windows DPAPI encryption and are never written to logs, code repositories or reports. The dashboard is protected by Cloudflare Access and is not public.

10. Changes

If this policy changes, the new version is published on this page with a new effective date.