Privacy notice

Operator and scope

Cameron Low in Ontario, Canada operates grizzlymailbox.com and publishes GrizzlyMail under that brand. Contact hello@cameronlow.com for privacy questions, access, correction, deletion requests, or a concern. This notice covers the public website and the desktop app’s core mailbox and AI features. Your employer and the services you connect may have additional policies.

Mailbox connection and local information

When you connect Outlook, or Gmail where access is available, the app uses the provider’s sign-in and permission screen. It receives account identifiers and authorization tokens to synchronize permitted mail. It mirrors messages, senders, recipients, subjects, bodies, folder information, and relevant metadata locally, and stores derived classifications, tasks, drafts, and preferences. The database is encrypted; its key is protected using the operating system’s credential protection.

Provider permissions may include reading and updating mail and sending messages. Granting a permission does not itself send a message: sending requires your explicit action in the app. Review the provider’s permission screen before connecting. Gmail remains in private testing and is not offered as generally available.

AI processing outside your computer

When AI work runs, selected email context—including subjects, participants, message text, and relevant working preferences—is sent to the configured provider to classify threads, draft replies, identify tasks, or answer your questions. The default route uses Codex and OpenAI through your own subscription. Configured alternatives can use Claude Code or Anthropic’s API. Those providers receive the submitted context on their infrastructure; their retention and data-use terms depend on the service and account you use.

Review your AI provider’s privacy and data controls before enabling processing, and obtain your organization’s permission before connecting work mail. Do not connect a mailbox whose information you are not authorized to process. AI output can be incorrect and needs your review. Provider access, subscriptions, and usage charges are separate from GrizzlyMail.

Downloads, updates, and website logs

The public website has no visitor accounts, payment form, advertising pixels, or analytics scripts. Hosting and download servers receive ordinary request data, including IP address, time, URL, browser information, and any referrer. These logs support delivery, troubleshooting, and abuse prevention. Normal web-server logs rotate daily with 14 rotations retained; incident evidence may be retained longer when necessary.

The website and release channel use Hostinger infrastructure in the United States. Some download links or fallbacks use GitHub, which receives the download request. The app checks its release channel for updates. Website logging and update requests do not give Cameron access to your local mailbox database.

Retention, disconnecting, and deletion

Your mirrored mail and generated working data remain on your device until removed. Disconnecting a provider stops its connection but does not automatically erase the local mail database. Uninstalling an application may also leave its data directory behind. To remove local data, first disconnect the mailbox and close the app, then remove its application data and any copies or backups you made. Contact Cameron for instructions for your platform before deleting files you may need.

You can revoke provider access in your Microsoft or Google account. Deleting local data does not delete the original mailbox or information retained by an AI provider. Use the relevant provider’s controls for those records. Cameron cannot remotely erase your local database.

Contact information and your rights

Support email is forwarded through Cloudflare Email Routing to a Google Gmail inbox. Your address, message, and any attachments are used to respond and manage the inquiry, and retained while needed for that purpose or necessary legal records. Do not send mailbox exports, credentials, or sensitive message content with an initial support request. Information is not sold, and support requests do not enroll you in marketing.

Providers may process information outside Canada under local laws. Ask Cameron to access, correct, or delete information he holds, or to explain a retention limit or privacy concern. You can also contact the Office of the Privacy Commissioner of Canada.