Trust & security
CraftNudge asks for access to the account you send from. That deserves plain language, not a policy PDF. If anything below is not specific enough for you, write to us before you connect anything.
The app password for each inbox you connect, and any key or token you give it, such as your model key for assisted or a HubSpot or Pipedrive token. Each is encrypted with AES-256-GCM before it is written to the database, and none is returned by any API or shown on any screen again. Your own password and your API keys are kept only as hashes.
The worker reads your inbox over IMAP for one purpose: to detect replies and bounces so it can stop a sequence and classify a failure. It stores the sender, subject, a short snippet and the delivery status. It does not scan, mine, or repurpose the body of your conversations.
No. Your contacts, your copy and your replies are yours. They are not used to train models, and they are not shared with or sold to anyone.
A Google OAuth app that sends mail needs a restricted-scope security assessment and a single shared client that Google can suspend for the whole platform at once. App passwords keep each credential yours: you create it, you can revoke it in one click, and one account’s problem never touches another’s.
Two ways. Revoke the app password in your Google account, which cuts us off at the source at once, even if you never open CraftNudge again. Or delete the inbox inside CraftNudge, which drops the stored credential. An inbox that sent in the last day can be deleted the next day, since that mail still counts against its domain. Pause it and it stops sending straight away.
On a single server we operate, in one Postgres database, with every workspace isolated by an ID that scopes every query. Delete a campaign or an inbox and the associated rows go with it. An owner can download every inbox, lead, send, reply and blocklist entry as CSV files in one zip, from Settings, on the Workspace tab. On the same tab, an owner can delete the whole workspace by typing its name. Its campaigns pause at once, and after seven days it is deleted with everything in it, unless an owner changes their mind first.
Yours, and that is by design. Mail leaves Google’s servers from your domain, signed with your DKIM. We are the thing that decides when to send and that reads back the result. We do not sit in the sending path with shared IPs, so one sender can never drag another down, except through the tracking link domain, which is why per-workspace tracking domains keep even that isolated.
No sending tool can make bad practice safe. If you send irrelevant mail to people who did not ask for it, Google will throttle and eventually suspend your account, and no software prevents that. CraftNudge gives you the earliest possible warning when it starts to happen. It cannot send for you and protect you from yourself at the same time.