Privacy Policy

Last updated: 14 October 2026

Inbox Bullet (https://inboxbullet.com) is a private, internal email deliverability dashboard operated by Kristjan Mestnik (“the operator”, “we”). It is not offered to the public; only the operator can sign in.

Contact

Kristjan Mestnik — [email protected]

What data we access

• Google Postmaster Tools API, with the single read-only scope https://www.googleapis.com/auth/postmaster.traffic.readonly. It is used only to read and display email traffic statistics (spam rate, SPF/DKIM/DMARC success rates, TLS encryption rates, delivery errors, compliance status) for the operator’s own domains registered in Google Postmaster Tools.
• We do not access Gmail messages, contacts, or any other Google account data, and we cannot add, change or delete anything in Postmaster Tools.
• Other sources: email deliverability test results from the operator’s own GlockApps account and public DNS / blocklist lookups for the operator’s domains.

How the data is used

Data is used solely to show the operator his own deliverability statistics and history inside this dashboard. It is not used for advertising, profiling, or any other purpose.

Storage and security

Data is stored in a database on the operator’s own server (EU, Germany), served only over HTTPS and protected by a login. The Google OAuth refresh token is stored encrypted. We do not sell, rent, share or transfer data to third parties, and there are no ads or third-party trackers on this site.

Google API Services User Data Policy

Inbox Bullet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described above, is not transferred to others, is not used for advertising, and is not read by humans except with the operator’s own consent, for security purposes, or to comply with law.

Retention, revocation and deletion

• Postmaster statistics are kept as history for as long as the Google connection is active or until deletion is requested.
• You can revoke access at any time with the Disconnect button in Inbox Bullet settings (this revokes the token at Google and deletes it from our database), or in your Google Account under Security → Third-party apps & services.
• To have all stored data deleted, email [email protected]; it will be deleted within 30 days.

Cookies

Only a single strictly necessary session cookie is used to keep the operator signed in.

Changes

Any changes to this policy will be published on this page.