Privacy policy
SwipeMail is a private internal tool operated by Beyo. It is used only by Beyo staff on an explicit allowlist, with one Gmail mailbox owned by Beyo. It is not offered to the public.
1. What SwipeMail does
SwipeMail helps us review emails from people offering second-hand furniture. It shows each relevant email with its photos, lets us approve, decline or skip it, and lets us reply in the same email thread using message templates.
2. Google data we access, and why
With the mailbox owner's consent, SwipeMail uses Google's official Gmail API with one permission: gmail.modify ("Read, compose, and send emails from your Gmail account"). We use it only to:
- Read messages in the connected mailbox to find offers that match the filters we configure (keywords, attached photos, senders, date range), and to show their text and photos.
- Download image attachments of those offers to display them.
- Send replies from the connected mailbox in the original email thread. Declines are sent automatically when we decline an offer; all other replies are written and sent by a person.
- Apply labels ("SwipeMail/Approved", "SwipeMail/Rejected") and mark reviewed offers as read, so the mailbox shows what has been handled.
SwipeMail never deletes email, never changes mailbox settings or filters, and never moves or modifies messages beyond the labels and read status described above.
When someone signs in to SwipeMail itself, we receive their Google account name and email address (scopes openid, email, profile) only to check them against the allowlist. Signing in does not give SwipeMail access to that person's mailbox.
3. What we store
Gmail remains the source of truth. SwipeMail keeps a small local database containing only:
- For emails that match our offer filters: sender name and address, subject, date, message text, Gmail message and thread identifiers, and the filter reasons.
- Resized copies of those emails' photos (preview and thumbnail sizes), kept in a cache that is automatically trimmed.
- For offers we approved: later messages in the same conversation, so the conversation can be shown.
- Replies sent through SwipeMail, our review decisions (approved / declined / skipped, by whom and when), message templates, filter settings, and files we chose to attach to a reply.
- The OAuth refresh token for the connected mailbox, encrypted before it is stored.
Emails that do not match the filters are not stored. The filter preview evaluates recent emails in memory only.
4. How the data is used, and what we don't do
- Data is used only to provide SwipeMail's features described above, for Beyo's own purchasing work.
- We do not sell Gmail data or share it with anyone else, use it for advertising, or use it to build or train AI or machine-learning models.
- No person reads email data except allowlisted Beyo staff using SwipeMail for the purposes above, or where needed for security, to comply with law, or to investigate a technical problem. Application logs never contain email bodies, attachments or tokens; email addresses in logs are replaced by one-way hashes.
SwipeMail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Where the data is kept and how it is protected
- SwipeMail runs on a dedicated, isolated Amazon Web Services account in the EU (Stockholm region, eu-north-1). Storage volumes and backups are encrypted.
- All traffic uses HTTPS. Every page and API, including photos, requires signing in with an allowlisted Google account. Sessions use secure, HTTP-only cookies with CSRF protection.
- OAuth tokens are encrypted at rest and never sent to the browser. Application secrets are held in AWS Systems Manager Parameter Store as encrypted parameters.
- Daily encrypted database backups are kept for 30 days.
6. Retention and deletion
- Data is kept while it is needed for our purchasing work. Cached photos are deleted automatically as the cache fills. Backups expire after 30 days.
- The mailbox owner can disconnect Gmail at any time in SwipeMail's settings. This revokes SwipeMail's access with Google and deletes the stored token. Access can also be removed at any time at myaccount.google.com/permissions.
- On request, we delete the stored data relating to a person's emails from SwipeMail's database. Emails in Gmail itself are not affected by SwipeMail.
7. People who email us
If you emailed Beyo an offer, your message is in our Gmail mailbox like any other email. SwipeMail only helps us review it. To ask about or remove your data, reply to any email you received from us.
8. Changes
If this policy changes, we will update this page and the date above.
9. Contact
SwipeMail is operated by Beyo. For questions about this policy or your data, reply to any email you received from us through SwipeMail, or write to the Beyo mailbox that contacted you.