Privacy policy
What Proxell stores, why, and how to make it stop.
Written in plain language and kept in step with the code. If a sentence here is not true of the product, that is a bug and we want to hear about it.
Who we are
Proxell is operated by Third Coast Films, LLC, 1606 Headway Cir, Austin, TX 78754, United States. Questions about this policy go to wes@thirdcoastfilms.com. A person reads that inbox.
What Proxell does
Proxell finds companies that show a public sign of needing what you sell, reads their public website, writes a one-off email draft, and waits for you to approve it. It sends approved email from a mailbox you connect with an app password, and checks that mailbox for replies from the people it wrote to, so a reply ends their sequence. Nothing is sent without a person clicking approve.
Information about you, the account holder
When you sign in with Google we receive your email address and name. We store them to create your workspace and to know who approved what. If you pay through Stripe, Stripe sends us the email address you paid with, your Stripe customer and subscription ids, and the plan. We never see your card number. A workspace is created the moment you sign in with Google, and nothing is billed until you upgrade it to a plan.
If you paste writing samples under "Your voice", we store up to ten of your own emails as text so the drafter can match how you write.
Your mailbox
To send, you connect a Google Workspace or Gmail mailbox with an app password you create in your Google account. Proxell checks that password with Google's mail server when you connect, stores it encrypted with AES-256-GCM under a key that lives only in our hosting environment, and uses it for two things. The first is handing an email to Google's mail server after you approved it in the review queue. The second is checking for replies: about every fifteen minutes Proxell signs in to the mailbox over IMAP to see whether anyone it emailed for you has written back. It asks Google only for recent messages from the people Proxell emailed from that mailbox, for 30 days after the last email to their company, and reads who sent each one, when Google received it, and whether it was an automatic reply, never the subject or the body. A message sent before Proxell first wrote to their company is set aside and not kept. It opens the mailbox read-only, so nothing in it is marked read, moved, labelled or deleted. A reply ends that person's sequence; an automatic reply such as an out-of-office does not. The password is used only for your workspace, never for advertising, profiling, training models, or anything unrelated to sending the email you approved and checking for replies to it, and it is never sold or shared. It is never shown again, in the app, in an email, or in our logs.
An app password opens the whole Google account, so treat it like one: create it only for Proxell, and delete it at https://myaccount.google.com/apppasswords whenever you want. Disconnecting the mailbox in Settings deletes the stored password at once and pauses the mailbox; deleting the app password at Google makes the stored copy useless the same minute.
Your Google account
Signing in with Google gives us your email address and name, nothing else. Every mailbox, our own included, connects with an app password. Proxell no longer connects any mailbox through the Gmail API, so it does not label, draft in, or delete anything in your Gmail. The only reading it does is the reply check described under Your mailbox, which uses the app password, not your Google sign-in.
Proxell's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove Proxell's sign-in access at any time at https://myaccount.google.com/permissions.
Information about the people you write to
Proxell collects business contact information from public sources: job postings, company websites and careers pages, public LinkedIn posts, Google Maps listings, funding announcements, and email-finding services. For each prospect we may store the company name, website, city, the public signal that triggered the draft with its source URL, a summary of the company's own website, and a work email address with its verification status. When someone Proxell wrote to writes back, we record that a reply came, from which address and when, never what it says, and Proxell stops writing to that person and to anyone else it had on file at the same company.
Every email Proxell sends carries the sender's physical mailing address, a visible opt-out line, and one-click unsubscribe headers. A recipient who opts out is added to a suppression list that every workspace on Proxell honours, and we keep that entry so the address is never written to again. Addresses that bounce are suppressed the same way.
If you are a recipient and want to know what Proxell holds about you or want it deleted, email wes@thirdcoastfilms.com from the address in question. We answer within ten business days.
Who processes data on our behalf
- Vercel, hosting and serverless functions.
- Supabase, the database.
- Anthropic, whose Claude models score prospects and write drafts. The public company information, the signal, your pitch context and your writing samples are sent to them for that purpose. Under Anthropic's commercial terms they do not train models on that content.
- Google, for sign-in, and Google's mail servers, which carry the email you approved from your own mailbox and answer the reply check.
- Stripe, for billing.
- Apify, which runs the public-source scrapers. Hunter, which finds and verifies work email addresses.
- GitHub, whose scheduled actions start the hourly pipeline.
- RB2B, only if you turn on site tracking, to identify business visitors to your own website.
How long we keep it
Account, prospect and email records are kept while your workspace exists and until you ask us to delete them. Suppression entries are kept indefinitely, because they exist to stop mail. To delete your workspace, or any data in it, email wes@thirdcoastfilms.com from the address on the account.
Security
Data is stored in Supabase with access limited to the application's server-side functions. Mailbox app passwords and tokens are encrypted with AES-256-GCM. Traffic is HTTPS only. There is no password reset flow to phish: sign-in is Google or a single operator password.
Children
Proxell is a business tool for adults. We do not knowingly collect information from anyone under 18.
Changes
When this policy changes, the date above changes with it, and the change is noted in the dated log on the home page.