Back to Settings

Privacy & Data

How We Handle Your Data

Inbox Cockpit is a self-hosted application that runs entirely on your own server. Your data never leaves your infrastructure — there is no central cloud service or third-party analytics involved.

Encrypted Credential Storage
All email account passwords and OAuth tokens are encrypted with AES-256-CBC before being written to the database. The encryption key lives in your server's config file, under your control.
Self-Hosted & Private
The entire application runs on your VPS. There is no SaaS backend, no tracking pixels, and no third-party telemetry. Your emails stay on your server.
You're In Control
Disconnect an account at any time. All locally stored data for that account is immediately removed from the database.

What Data Is Stored

Email Metadata

When you sync an email account, the following metadata is stored in your local MySQL database:

  • Sender and recipient names and email addresses
  • Subject line and a short preview (first ~200 characters)
  • Date sent/received timestamp
  • Read, starred, and attachment flags
  • Provider message ID for deduplication and reply threading
  • Workflow state (if assigned) — New, Waiting, Follow Up, etc.

Email Bodies

Full email bodies (HTML content) are fetched from the provider on demand when you open an email. Once fetched, the body is cached locally in the database for faster subsequent loads. If you prefer, you can periodically purge cached bodies via a database query without losing metadata.

Attachments

Attachments are not downloaded or stored locally. When you click to view or download an attachment, it is fetched in real time from the email provider and streamed directly to your browser.

Account Credentials

Depending on how you connect your email accounts:

  • Google (Gmail): OAuth 2.0 tokens (access + refresh) are stored, encrypted. Your Google password is never seen or stored.
  • Microsoft (Outlook): OAuth 2.0 tokens are stored, encrypted. Your Microsoft password is never seen or stored.
  • Custom IMAP: Your IMAP/SMTP username and password are stored, encrypted with AES-256-CBC.

How Data Flows

Sync Process

When you trigger a sync (or the cron job runs), the application connects to your email provider using IMAP (for custom accounts) or the Gmail/Outlook REST API (for OAuth accounts). It fetches new message headers and metadata since the last sync. The connection is direct: your server talks to the provider, no intermediary.

Sending Emails

When you compose or reply, the email is sent via SMTP (custom IMAP accounts) or the Gmail/Outlook Send API (OAuth accounts). The application acts as a client to your existing email infrastructure — it does not relay through any third-party service.

Provider Deletion

You can optionally enable "Also delete from provider" in Settings. When enabled, deleting an email in Inbox Cockpit will also move it to Trash on the provider (Gmail, Outlook, or IMAP). When disabled (the default), deletions only affect the local database.

Security Practices

  • Encryption at rest: All stored credentials are AES-256-CBC encrypted using a key defined in your server's config.php.
  • Encryption in transit: All connections to email providers use TLS/SSL. Your application should be served over HTTPS.
  • Password hashing: User login passwords are hashed with bcrypt and never stored in plaintext.
  • Session security: PHP sessions use secure cookies. Session data is stored server-side.
  • No tracking: There are no analytics scripts, tracking pixels, or third-party cookies.
  • No external calls: The application makes no outbound requests other than to your configured email providers.

Data Removal

Disconnecting an Account

When you disconnect an email account from Settings, all locally stored emails, metadata, and cached bodies associated with that account are permanently deleted from the database. Encrypted credentials are also removed.

Deleting Your User Account

Deleting your user account will cascade-delete all associated data: folders, emails, email accounts, credentials, and workflow states. This action is irreversible.

Full Data Wipe

Since the application is self-hosted, you have full control over the MySQL database. You can drop tables, truncate data, or delete the entire database at any time. The application has no remote backup or cloud sync — once data is deleted from your server, it's gone.