JJuly Email
Sign inGet started

Privacy Policy

Effective: August 2, 2026 · JULY Email (julyemail.com)

Who we are

JULY Email routes email for custom domains: mail sent to addresses on your domain is forwarded to the inbox you choose, and you can send and reply as your domain from your existing Gmail. We are the data processor for mail that transits our systems; you remain in control of your domain and your inbox. Contact: hello@julyemail.com.

What we collect and why

  • Account data. Your email address, password hash (bcrypt; we never store the password), plan, and billing status. Used to operate your account.
  • Domains and addresses. The domains you connect, the addresses you create, and where each forwards. This is the routing table that makes the service work.
  • Mail in transit. To forward reliably, a raw copy of each message is buffered in encrypted object storage and deleted automatically after 7 days. We keep routing metadata (sender, recipient, subject line, timestamps, spam score, delivery outcome) as an activity log. We do not build profiles from your mail and we do not scan mail content for advertising.
  • DNS provider credentials (optional). If you use one-click DNS setup, the API token you provide is stored encrypted (AES-256-GCM) and used only to write the DNS records you asked for.
  • Payment data. Handled by Stripe; we never see full card numbers.

Google user data

If you connect a Google account, we request the minimum Gmail permissions needed for the features you enable, and nothing else:

  • gmail.compose — to create draft messages inside your own mailbox (AI summaries and suggested replies appear as drafts in the conversation). We never send mail from your Gmail; drafts wait for you.
  • gmail.metadata — to read message headers only (never message bodies) so each draft can be placed in the correct conversation thread.
  • gmail.settings.sharing — to add your custom-domain address to Gmail's "Send mail as" list on your behalf where Google permits it (Google Workspace accounts), so you can send as your domain natively.

The OAuth refresh token Google issues is stored encrypted with AES-256-GCM and used solely to perform the actions above for your account. Disconnecting Google in Settings deletes the token from our systems and we ask Google to revoke it. You can also revoke access at any time at myaccount.google.com/permissions.

Limited Use disclosure: JULY Email's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and humans do not read it except with your explicit consent, for security and abuse investigation, or where required by law.

AI processing

AI features are off by default and per-user opt-in. When you enable them, the content of an individual incoming message is processed by Anthropic's Claude API (our AI subprocessor) to produce a summary or a suggested reply, which is placed as a draft in your own mailbox. We do not use your mail to train AI models, and our API agreements with Anthropic exclude training on this data. Disable the toggles in Settings at any time to stop all AI processing.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Specifically: Google user data is never used to develop, improve or train any AI or machine-learning model beyond the individual user's own personalized output, and it is never transferred to any third-party service that would use it to train its models. Anthropic does not train its models on data submitted through its API.

Sharing

We share data only with the infrastructure providers needed to run the service: Amazon Web Services (mail relay and hosting), Stripe (payments), Anthropic (AI features, when enabled), and your DNS provider (only the records you asked us to write). We never sell personal data and we do not share it with advertisers.

Retention and deletion

  • Raw message copies: deleted automatically after 7 days.
  • Routing metadata and activity logs: kept while your account is active.
  • Account deletion (Settings → Danger zone) removes your domains, addresses, routing data, stored credentials, and Google tokens. Buffered mail copies expire on their 7-day schedule.

Security

Mail moves over TLS; outbound mail is DKIM-signed for your domain with SPF and DMARC configured. Credentials and tokens are encrypted at rest (AES-256-GCM); passwords are bcrypt-hashed; SMTP credentials are stored as hashes only. Access to production systems is limited to the operator.

Changes and contact

We will post updates to this policy here with a new effective date. Questions or data requests: hello@julyemail.com.