Privacy Policy
Effective October 13, 2026
InboxGrade ("we", "us") is operated by Tubesock, Inc. (a dba of Rob Nolley, Inc.) at 30 E. Washington St., Suite 400, Shelbyville, IN 46176, USA. We take privacy seriously because the whole product is about email, and nobody wants to hand their email to someone careless.
What we collect
- Email probes you send us. When you send a test email to a
test-xxxx@tests.inboxgrade.ioaddress, we receive the full message (headers + body) via our Postmark inbound endpoint. We parse SPF, DKIM, DMARC, TLS, PTR, List-Unsubscribe, BIMI, MTA-STS, blacklist listings, and spam signal metadata. We retain the parsed metadata for 30 days (anonymous one-off tests) or until you delete the record (signed-in account tests). Raw message bodies are retained for 24 hours in R2 cold storage for troubleshooting, then deleted. - Account information. If you sign up, we store the email address and name provided by your Clerk-managed identity, your plan tier, and billing metadata (Stripe customer and subscription IDs). We never see your card number — that's handled directly by Stripe.
- Monitor configurations. If you set up a monitor, we store the monitor name, interval, score threshold, alert email, and an install secret (hashed) used to authenticate probes from your mail server.
- Request logs. Standard web server logs (IP, user agent, referrer) retained for 30 days for abuse prevention and debugging.
What we don't collect
- We do not read your production mail. The monitor script sends new, synthetic test messages — it does not touch your inbox, your sent folder, your queues, or your logs.
- We do not sell data. Ever. Full stop.
Cookies & consent (EEA, UK, Switzerland)
If you visit from the European Economic Area, the United Kingdom, or Switzerland, Google Analytics and Google AdSense are blocked by default under Google Consent Mode v2. You'll see a banner at the bottom of the page where you can Accept or Decline. If you decline, we receive no analytics or advertising cookies — only a single functional cookie remembering your choice. Visitors from the rest of the world get the banner too, but tags run by default (we still anonymize IP and never pass personal data to Google). You can clear your choice any time by clearing inboxgrade.io cookies and site data in your browser.
Advertising
On a limited number of pages (the Error Reference library and a few other high-traffic content pages), we show display ads served by Google AdSense. Signed-in dashboards, billing pages, pricing, admin surfaces, sign-in/sign-up, and your personal test reports are never ad-supported. Google uses cookies to serve relevant ads and measure performance — you can opt out of personalized advertising at adssettings.google.com. See Google's advertising policies for details.
Third parties we use
- Clerk — authentication (email magic links). Privacy policy
- Stripe — payment processing. Privacy policy
- Postmark — inbound and outbound email transport. Privacy policy
- Google Analytics 4 — aggregate traffic analytics (anonymized IP). Privacy policy
- Neon — Postgres database host.
- Cloudflare R2 — short-term raw-message archive.
- Vercel — application hosting.
Deleting your data
You can delete individual test records from your dashboard. To delete your entire account (and everything attached — tests, monitors, alerts, billing linkage), email us at hello@inboxgrade.io from your account email, and we'll complete the deletion within 7 days.
Public report pages
Each test gets a shareable URL at inboxgrade.io/r/<token>. These are unlisted but publicly accessible by anyone with the link — the token itself is the access control. Be aware that if you share the URL, anyone with it can see the parsed test headers (including your From address, Subject, and sending IP). Reports expire after 30 days.
Changes
If we materially change this policy, we'll bump the Effective date and notify signed-in users via email.