Trust & security
CraftNudge asks for access to the account you send from. That deserves plain language, not a policy PDF. If anything below is not specific enough for you, write to us before you connect anything.
One thing: the app password for each inbox you connect. It is encrypted with AES-256-GCM before it is written to the database, and it is never returned by any API or shown on any screen again. Nothing else about your inboxes is secret, so nothing else is encrypted.
The worker reads your inbox over IMAP for one purpose: to detect replies and bounces so it can stop a sequence and classify a failure. It stores the sender, subject, a short snippet and the delivery status. It does not scan, mine, or repurpose the body of your conversations.
No. Your contacts, your copy and your replies are yours. They are not used to train models, and they are not shared with or sold to anyone.
A Google OAuth app that sends mail needs a restricted-scope security assessment and a single shared client that Google can suspend for the whole platform at once. App passwords keep each credential yours: you create it, you can revoke it in one click, and one account’s problem never touches another’s.
Two ways, both instant. Delete the inbox inside CraftNudge, which drops the stored credential. Or revoke the app password from your Google account, which cuts us off at the source even if you never open CraftNudge again.
On a single server we operate, in one Postgres database, with every workspace isolated by an ID that scopes every query. Delete a campaign, an inbox or your workspace and the associated rows go with it.
Yours, and that is by design. Mail leaves Google’s servers from your domain, signed with your DKIM. We are the thing that decides when to send and that reads back the result. We do not sit in the sending path with shared IPs, so one sender can never drag another down — except through the tracking link domain, which is why per-workspace tracking domains keep even that isolated.
No sending tool can make bad practice safe. If you send irrelevant mail to people who did not ask for it, Google will throttle and eventually suspend your account, and no software prevents that. CraftNudge gives you the earliest possible warning when it starts to happen. It cannot send for you and protect you from yourself at the same time.