Privacy

Alchemail Tools connects to your email sending services so you can audit and manage outreach from one place. When you create an account, your username is stored as plain text so we can identify you, and your password is never stored in a readable form. We hash passwords with scrypt, a slow, memory-hard algorithm, which means the stored value cannot be reversed back into your password even by us.

API keys you connect are encrypted at rest and stay encrypted for as long as the connection exists. When you disconnect a service or delete your account, the associated keys are removed. Customer API keys are entered only on the Alchemail Tools website, never inside ChatGPT or any chat interface, so your sending credentials do not pass through a third-party conversation layer.

When you link a sending platform such as Smartlead or Instantly through ChatGPT, the OAuth relationship is strictly between ChatGPT and Alchemail Tools. It is not an OAuth link between Alchemail and your sending platform. That separation means ChatGPT is authorized to talk to Alchemail Tools on your behalf, and nothing more. You can revoke that OAuth access at any time from your account settings.

Deleting your account removes your user record, stored credentials, active sessions, and tokens. Email headers you supply for inspection and the aggregate campaign reports we process are handled transiently in memory to produce your results and are not saved afterward. We do not retain the raw message content you paste in for diagnosis.

Our DNS lookups are served through Cloudflare, and the service runs on Railway infrastructure, whose operational logs may retain basic operational metadata for reliability and debugging. Rate limiting is applied transiently in memory using short per-minute IP buckets. We do not run behavioral analytics or build advertising or tracking profiles on you.

We do not sell your data and we do not use it for advertising. For questions, corrections, or deletion requests, contact arthur@alchemail.io. This document describes how the product handles your data and the technical checks it performs; it is not a legal compliance statement, and it makes no guarantees about regulatory standing.