Your data, treated like our own.

What we collect

• Account basics — username, email, password (hashed), plan, daily cap
• Provider tokens — Gmail / Outlook OAuth refresh + access tokens, encrypted
• Recipient lists you upload (CSV / XLSX / Sheets)
• Send activity — timestamps, recipient, subject, status, opens, clicks, replies, bounces
• Audit events — sign-in attempts, IP, user-agent, ID-mismatch flags
• Operational logs — error traces, request IDs (kept ≤ 30 days)

Third parties & sub-processors

• DigitalOcean — application hosting (containerised, BLR1 region)
• PostgreSQL — managed database on the same private network
• Google & Microsoft — OAuth providers (you authorise scope)
• Let's Encrypt — TLS certificates for HTTPS

We use no analytics, no ad networks, no session-replay tools.

Cookies

• session — keeps you signed in (HttpOnly, Secure, SameSite=Lax)
• csrf — anti-CSRF token for write actions
• mm-theme — local-storage only, your colour preference

That's the entire cookie list. No tracking, no advertising IDs.

Your rights

• Access — export every row tied to your account
• Correction — fix inaccuracies in profile, contacts, settings
• Deletion — wipe your account & all derived data within 7 days
• Portability — JSON / CSV export of campaigns & recipients
• Objection — stop processing anytime by signing out / cancelling

Reach: info@codeftech.com

Data retention

• Active account — kept while you use the service
• Cancelled account — full wipe within 7 days, including backups
• Audit log — 24 months (regulatory traceability)
• Operational error logs — 30 days, anonymised IPs

Google user data — Limited Use

Flick MailMerge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• gmail.send / gmail.compose — to send and draft your personalised campaign emails from your own mailbox
• gmail.readonly — to read delivery status and detect replies/bounces for your campaigns
• spreadsheets.readonly — to import recipient lists you choose from Google Sheets

Your Google data is used only to provide these features — never for advertising, never sold or transferred to third parties. No human reads your Gmail content; access is automated, except with your consent (e.g. support), for security/abuse investigation, or to comply with law.

Encryption at rest

OAuth tokens, refresh tokens, SMTP passwords and any user-uploaded credentials are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) using a per-deployment key held outside the database.

• Postgres column-level encrypted blobs
• Per-deployment master key, rotated yearly
• Backups inherit the same encryption

Encryption in transit

TLS 1.3 only, on every endpoint, with HSTS preloaded. We refuse old ciphers, refuse plain HTTP, and refuse mixed content.

• Cloudflare TLS termination
• HTTP → HTTPS at the edge
• HSTS · max-age 1 year

Single-session enforcement

One active login per ID. Signing in elsewhere kicks the previous session immediately — and the audit log records both events with IP and user-agent.

• Session tokens · server-stored · invalidated on rotate
• ID-match rule — connected mailbox must equal assigned email

Idle auto-logout

5-minute inactivity timer with a 60-second warning. Tab visibility checks fire on return so a session left open overnight is killed before you blink twice.

• Client + server enforced (heartbeat every 20s)
• Graceful warning UI, "Stay signed in" recovery

Audit log

Every authentication event, password change, OAuth connect/disconnect, and impersonation request is appended to an immutable activity log with IP, user-agent, and detail string.

• 24-month retention
• Visible to admins for forensics

Operational hardening

• Auth-storm circuit breaker (rate-limit on /login)
• Auto-purge of stale OAuth tokens
• Bcrypt password hashing (Werkzeug default rounds)
• CSRF tokens on every write endpoint
• Postgres-only architecture (no shared file state)