Privacy

For each account:

• Your email address and a bcrypt-hashed password.
• Profile preferences (display name, preferred currency, timezone).
• Reminder preferences and two-factor settings.

For each connected mailbox:

• The mailbox address, provider name (Gmail / Outlook), and the date of the most recent scan.
• An encrypted refresh token from the provider so we can refresh access without prompting you each time. Tokens are encrypted at rest with a per-deployment symmetric key (Fernet / AES-128-CBC + HMAC). They're decrypted in process only when needed to mint a short-lived access token, and never logged.
• For each email that looks like a receipt or renewal notice we ingest: the message id, sender, subject, received-at date, and the message body — both the plain text and, when the email has one, the full HTML version — encrypted at rest with the same key. The HTML version can include everything the sender embedded in the email (formatting, images and links, tracking pixels); we keep it so billing details can be read accurately from the message's original structure. Emails that don't look billing-related are not uploaded.
• The result of the mailbox provider's own sender-authentication checks (DKIM / SPF) for each ingested email — metadata about who really sent the message, used to protect your records from spoofed emails. No additional message content is involved.
• The extracted subscription / purchase fields (service or merchant, amount, currency, billing cycle, next renewal or purchase date).

Octoplus runs on infrastructure we operate. Encrypted data lives in a Postgres database; the encryption key is held in environment configuration on the application server, separate from the database. We do not back up the encryption key to the same place we back up the database.

The third parties involved in delivering Octoplus:

• Google — mailbox access for Gmail accounts (read-only).
• Microsoft — mailbox access for Outlook accounts (read-only).
• Resend — transactional email (sign-up confirmations, two-factor codes, password resets, renewal reminders). Resend receives your email address + the contents of the message we send; they don't see anything else.
• Sentry — error diagnostics. When something in Octoplus crashes, a technical report is sent so we can fix it. Those reports carry the error and the page or endpoint it happened on. They do not carry your credentials, your session, the contents of a request, or the contents of your messages — we strip all of that before the report leaves our servers. We do not record your screen or your session.
• Our hosting provider — the infrastructure the application runs on. Encrypted data is encrypted before it reaches their disks.

We do not sell, rent, or share your data with anyone else. There are no advertising, marketing, or analytics third parties involved.

Octoplus administrators may access the content of individual ingested messages, solely to diagnose and improve how billing details are read from them. Every such access is logged — which administrator, which message, when, and for what purpose — and the access is rate-limited. To improve accuracy, a copy of a message may be retained for testing after identifying details (your name, email address, card digits, postal address) have been removed and the result manually reviewed; such exports are logged the same way. Administrators never access your mailbox itself, only messages already ingested as described above.

Passwords are stored as bcrypt hashes (work factor 12). Sign-in requires a one-time code on every device that hasn't been trusted in the last 30 days; you can also enable an authenticator app (TOTP). Failed sign-ins are rate-limited.

Your subscriptions, purchases and corrections are kept for as long as your account exists — that history is the product. The rest is on a clock, and a nightly job enforces it:

• Message contents — 12 months after we last read a message. After that the message text is deleted; we keep the subject, who sent it, and the subscription or purchase we worked out from it. (We may re-read a message when we improve how billing details are recognised, which starts the 12 months again.)
• Sign-in codes and password-reset links — 7 days after they are used or expire.
• Sign-in sessions and remembered devices — 30 days after they end or are revoked.
• Mailbox-connection handshakes — 24 hours.
• Security history — we keep a record of sign-ins and other account-security events for as long as your account exists, because it is what lets us investigate a compromise. The IP address and browser recorded alongside each event are deleted after 12 months.

Deleting your account removes everything in a single cascade, without waiting for any of these clocks.

We don't set analytics or marketing cookies. To keep you signed in, we set a single essential cookie (for the Octoplus app itself, not your mailbox) that expires after 7 days; it is HTTP-only, so scripts running in the page can never read it, and it is sent only to our sign-in endpoints. Signing out removes it. If you opt in to "remember this device" during sign-in, a device token is kept in your browser's local storage for 30 days; you can revoke devices any time from Settings → Security. No third-party tracking pixels.

We'll update the date at the top whenever this page changes. If a change materially affects how we handle your data, we'll surface it in the app on your next sign-in.

Questions? Reach us at hello@octoplusapp.com.