Privacy

Last updated 10 October 2026.

Who we are

mailnote is made by CloudCircus. Contact us at support@cloudcircus.com.

mailnote works in Microsoft Outlook (an Outlook add-in) and in Gmail (a Google Workspace add-on). Both show the same notes. Read what the Gmail add-on accesses below.

Notes belong to the organisation (company) they were written in. The organisation decides who is a member and what is written. For that content, the organisation is the data controller and we process it on its behalf.

What we store

• Your account: email address, name (if you add it), and a hashed password or the social login you used.
• Organisations: their name and email domains, who is a member with which role, and invites (the invited address and who sent it).
• Notes, customers and projects that members write, and a history of changes (who changed what, and when).
• Email details, only for emails someone attached a note to: the subject, the names and addresses of the sender and recipients, the date, and the technical Message-ID headers (which identify the email thread).

Profile pictures

Our server looks up your picture on Gravatar (using a hash of your email address), or from the account you log in with, keeps a copy and shows it to your colleagues from our own site. Their browsers never contact Gravatar. You can turn this off in Settings; then your initials are shown.

What we don't store

• Email bodies and attachments. Neither the Outlook add-in nor the Gmail add-on reads them.
• Anything about emails without notes. When you open an email, the add-in sends its subject, people and Message-IDs to find matching notes, and we don't keep them.

When the last note on a thread is deleted or unlinked, we delete that thread's email details too.

So that it can reopen an email a note was written on, the Outlook add-in remembers, on your own device only, which emails it was open on (their Message-ID and Outlook's id for your copy, for up to 180 days). This never leaves your device.

Gmail

When you open an email with mailnote open in Gmail, Google sends our server a temporary permission for that one email, and our server asks Google for its headers only: the subject, the sender and recipients (names and addresses), the date and the Message-ID headers (Message-ID, References, In-Reply-To). We use them exactly as described above for Outlook: to find the notes on that email's thread and related notes, and, when you add or link a note, to store that email's details with the note. We never request the email's body or attachments, and we can't read any other email in your mailbox.

The Gmail add-on asks Google for these permissions:

• Run as a Gmail add-on and view the open email's metadata (the headers above, for the email you're looking at, while you use the add-on).
• Your Google account's email address and ID, to connect it to your mailnote account. We store the connection (your Google account's ID and email address) until you disconnect it in Settings, sign out in the add-on, or change your mailnote password.
• Your language and time zone, to show dates in your time zone. We don't store them.

mailnote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide mailnote's features described here; we don't use it for advertising, don't sell it, and don't transfer it to others except as needed to run mailnote (our hosting), for security, or when the law requires it. Nobody at CloudCircus reads it, unless you ask us to (for support), it's needed for security or abuse investigations, or the law requires it. We don't use Google user data to develop, improve or train AI or machine learning models.

Removing mailnote from Gmail stops all access to your emails. The stored connection (your Google account's ID and email address) is deleted when you disconnect Gmail in Settings, choose Sign out in the mailnote panel, or change your mailnote password. Email details stored with notes are deleted as described above.

Who can see it

Only members of the organisation see its notes and email details (and IFTTT, for a member who connects it: see below). We don't sell data, show ads or send notes or email details to AI services. Suggestions of related notes are computed on our own server.

IFTTT

A member can connect their mailnote account to IFTTT (Settings), to use mailnote in IFTTT applets. Only when they do, IFTTT can read the notes of that member's organisations (with their customer, project and the subject of the email they were written on, from Outlook or Gmail), the organisations' history and members' names, and add notes and customers and change the status of action items as that member. What an applet then sends to other services is up to the applet, which that member sets up on IFTTT. Other members' email addresses and email bodies are never sent to IFTTT. When someone in your organisation has connected IFTTT, our server tells IFTTT (by user ID only) that there's something new, so applets run without delay. Disconnecting IFTTT in Settings stops all access at once, and we delete the stored connection.

Emails we send

Invites, account emails (confirming your address, resetting your password), a note to the inviter when an invite is accepted, and a note to an organisation's owners and admins when a member asks them to invite a colleague. Note content is never put in an email.

Logs

Our server keeps technical logs (such as IP addresses and requested pages) for 30 days, to run and secure the service.

Deleting data

Owners can delete their organisation, which deletes all of its notes, customers, projects and email details at once. To delete your account, email support@cloudcircus.com from your account's address.