Privacy Policy

What we access

Jam & Nuts requests Gmail read access to find invoices and receipts, and compose access to create drafts or send packets you request. Compose permission also allows managing drafts. The app does not edit or delete the source messages it collects from.

Sending to your accountant

Each month Jam & Nuts packages your invoices and receipts and prepares an email to the accountant address you set. By default that is created as a draft in your own Gmail for you to review and send. Only if you switch on automatic sending does Jam & Nuts send it for you, and only to the address you configured.

What we store

• Your name and email address from your Google account
• An encrypted OAuth refresh token, so we can reach your Gmail
• Email metadata — sender, subject and date — for messages classified as invoices or receipts
• Collected attachments, kept until your packet is saved to Gmail drafts or sent, then deleted from our collection storage
• Your keywords, vendors and schedule preferences

For receipts contained in an email rather than an attachment, we save the message body as an HTML file for your packet. Collected copies are deleted after the draft or sending step. A completed collection prepares your Gmail draft or sends your packet, then deletes the working copies. If you stop a collection or delivery fails, working copies may remain until you finish the handoff or delete your data.

What the classifier sees

To decide whether a message is an invoice, we send the sender, subject, date, attachment filenames and the short preview line Gmail provides to our classification model. Full email bodies and attachment contents are never sent to it.

How we use your data

We use this data to find invoices and receipts and prepare your packets. Data is processed by the service providers listed below and sent to a recipient only when you request it. We do not sell your data or use it for advertising.

Third-party services

• Google Gmail API — to search your mail and download attachments
• Mistral AI — to classify messages. It receives sender, subject, date, attachment filenames and the Gmail preview line. Never a full body, never an attachment.
• MongoDB — to store your account data
• PayPal — to process subscription payments

Data deletion

From Settings, you can disconnect a Gmail account to revoke its access and delete its collected files and metadata. Delete all my data removes your account, settings, schedules and collected files across all connected mailboxes. You can also email us and we will delete everything within 7 days.

Security

OAuth refresh tokens are encrypted at rest with AES-256-GCM. All traffic uses HTTPS. Attachment files are held on a private volume that is not reachable from the internet.

Contact

Questions? Email us.