Privacy Policy — ColdFlow

Last updated: 5 October 2026

ColdFlow is a private tool used by a single person, its operator, to write and send one-to-one business emails from mailboxes the operator controls. It is not offered to the public.

What the app accesses

When the operator connects a Google mailbox, ColdFlow asks Google for these permissions on the operator's own account:

• Send email (gmail.send): to send the emails the operator writes from that mailbox.
• Read email (gmail.readonly): only to detect replies to the emails that were sent and delivery failure notices (bounces), so that follow-ups stop when someone answers or an address does not exist.
• Email address and basic profile (openid, email): to show which mailbox is connected.

How Google user data is used

ColdFlow's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail data is used only to send the operator's own emails and to recognise replies and bounces to them.
• Google user data is not sold, not used for advertising, and not transferred to third parties, except where required by law.
• It is not used to develop, improve or train generalised artificial-intelligence or machine-learning models.
• No person reads the content of the mailbox, except where strictly necessary for security or to comply with the law.

What is stored, where, and for how long

• The access and refresh tokens that Google issues to the app are stored encrypted on the operator's server.
• For each email sent, the app stores the message, its status, and the replies and bounces detected.
• Data is kept while the mailbox is connected and the records are needed. Disconnecting the mailbox in ColdFlow deletes its stored tokens. Revoking access from the Google account (myaccount.google.com/permissions) stops all access immediately.

People who receive the emails

The operator emails business contacts to propose a professional conversation, stores their name, email address and business details, and stops contacting anyone who asks not to be contacted.

Your rights and contact

To ask for access to, correction of, or deletion of your personal data, or to object to its processing, contact the operator at the support email address shown on Google's consent screen when a mailbox is connected, or reply to any email received from the operator.

Security

Data travels over HTTPS, access to the application requires a password, and stored credentials are encrypted.