Privacy policy for QuillSail hosted sign-in

Last updated: November 3, 2026.

This policy covers QuillSail's Gmail connection in the desktop and server application, the QuillSail website, and its shared Gmail, Outlook and Cloudflare sign-in services. A publication is the QuillSail installation you connect. Publications run by other people have their own operators and privacy practices.

Google user data we access and use

Connecting Gmail is optional. When you approve it, QuillSail requests openid, email and https://www.googleapis.com/auth/gmail.send. It does not request permission to read your inbox.

Account identification: your publication receives your Google email address, its verification status and the Google account identifier returned with the account information. It checks that the email address is verified and saves that address to identify the connected sender. It does not request your name, contacts, calendar or Drive files.
Authorization data: authorization codes, access tokens, refresh tokens, any identity tokens returned by Google, granted permissions and token expiry information let QuillSail connect your account and keep sending while you are signed out. The hosted sign-in service processes codes, proof-of-key verifiers and tokens to exchange or renew authorization with Google. It returns the connection credentials to your publication.
Sending email: your publication sends the messages you ask it to deliver, including sender and recipient addresses, subjects, message bodies and any attachments, directly to the Gmail API. It processes Google's sending success or failure response. Message content and recipient lists do not pass through the QuillSail website.

Google user data is used only to identify the sender, maintain the connection and deliver the publication's requested email, such as newsletters and account notifications.

Google: QuillSail sends authorization information to Google's token service to connect or renew access. Your publication contacts Google for account identification and sends outgoing messages to Google for delivery to the recipients you select. Recipients receive the message and its sender information.
Your publication and its operator: connection credentials and the sender address are stored on the publication you choose. Its authorized administrators manage the sender. If someone else hosts that publication, that operator controls its database, configuration and backups.
Service infrastructure: the systems and hosting or network providers that operate the hosted sign-in service process its traffic and operational logs to provide and secure sign-in and token renewal. They are not given your publication's outgoing message content or recipient lists through this service.

We do not sell Google user data or share it with advertisers, data brokers or information resellers. We do not use it for advertising, creditworthiness or lending decisions. We do not use Google Workspace API data to develop, improve or train generalized or non-personalized AI or machine-learning models. Gmail authorization is not used to connect a Microsoft or Cloudflare account.

Other access or disclosure is limited to support you explicitly authorize, investigating security incidents or abuse, or complying with applicable law, consistent with Google's Limited Use requirements. QuillSail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How Google user data is protected

Connections to Google and the hosted sign-in service use HTTPS with TLS encryption and certificate verification. Remote publication callbacks require HTTPS; desktop callbacks can use HTTP only on the device's loopback address. Sign-in uses proof-of-key verification (PKCE), time-limited authorization state, and a browser-bound confirmation protected against cross-site request forgery.

Your publication encrypts its saved email connection, including the sender address and Google tokens, using a key derived from its instance secret. Changing the sender requires a verified publication administrator. The confidential Google application secret stays on the hosted service's backend. Token renewal through that service requires a signed proof bound to the refresh token.

The hosted service does not keep a persistent database of Google user tokens. Token responses are marked not to be cached. Credentials, authorization-code query strings and token request bodies are excluded from operational access logs. Publication operators are responsible for protecting their instance secret, server access and backups.

Google user data retention and deletion

Hosted sign-in: codes, verifiers and tokens are processed for the duration of the exchange or renewal request, without persistent central storage. The signed confirmation form is held in your browser and expires after ten minutes. Temporary in-memory rate-limit counters use one-minute windows and are cleared as later requests arrive. Operational logs may contain request paths, status, time and source network addresses; they are kept to operate and secure the service and removed through the server's log rotation.

Your publication: the saved sender address and authorization tokens remain in its encrypted active connection until an administrator disconnects the sender or successfully replaces it with another connection. Under Settings → Email, choose Disconnect to remove that saved connection from the active database. Disconnecting does not itself revoke Google's authorization grant or delete messages, publication content, subscribers, audit records or backups.

Revoke access: remove QuillSail from your Google Account's third-party connections to revoke its Google authorization. Revocation stops further authorized access; also disconnect the sender to remove the publication's saved credentials. Email already delivered remains with Google and its recipients under their own retention practices.

Deletion requests: contact 206abdoula@gmail.com about Google user data or operational records held by the hosted service. Identify the connected sender and the service use concerned; do not send passwords or tokens. For data stored by a publication, contact its operator. That operator controls any remaining sender references, messages, audit records and backups, including their retention and deletion schedule. We do not set a universal retention period for independently operated publications. Copies in backups remain until the responsible operator removes them or the backups expire; records required by law are retained only as required.

Microsoft account data

Outlook sign-in requests basic account identification, permission to send mail as the signed-in user, and offline access to renew authorization. It does not request permission to read your inbox. Your publication uses your Microsoft mailbox address to identify its sender.

The website exchanges codes and renews Microsoft tokens using a confidential application secret. Codes, PKCE verifiers and tokens pass through these operations without a central user-token database. Each publication keeps its connection encrypted locally and sends email content and recipient lists directly to Microsoft Graph.

Microsoft account information is used only to connect the sender and provide sending and authorization renewal. It is not sold, used for advertising, used to determine creditworthiness, or used to train general-purpose AI models.

Cloudflare and service operation

Cloudflare sign-in uses public app metadata and an authorization-code confirmation relay. Cloudflare tokens and PKCE verifiers stay on the publication. The website uses a session cookie to bind confirmation forms to your browser.

Your choices

You can disconnect a sender in your publication. To revoke Google's, Microsoft's or Cloudflare's authorization grant itself, use that provider's account permissions page. A self-hosted publication can use its own OAuth registration or SMTP instead of shared email sign-in.

For questions or deletion requests concerning the hosted service, contact 206abdoula@gmail.com. For publication content, subscribers or locally stored tokens, contact the operator of that publication.