Privacy notice

Last updated: 6 November 2026

The short version: Remailit schedules follow-up reminders from email metadata only. It never receives the body or attachments of your messages. It does not sell data or run advertising or analytics trackers.

1. Who this notice covers

Remailit is a hosted service for Microsoft 365 / Outlook accounts. This notice describes how Remailit handles information when you connect a mailbox. Remailit operates the servers and holds the data described below. Privacy requests can be made through the support channel in the Remailit app.

2. What Remailit accesses

When you connect an Outlook account, Remailit requests these Microsoft Graph permissions:

Mail.ReadBasic — message headers and categories only: subject, To/Cc recipients, sent date, categories, conversation ID, and a link back to the message. It does not include message bodies, previews, attachments, or extended properties.
MailboxSettings.ReadWrite — to create the remailit … categories you use to flag a message.
Calendars.ReadWrite — to create, reschedule, and delete follow-up events on your calendar.
User.Read — to identify the signed-in account (name and email address).
offline_access — to keep the connection working between sessions using a refresh token.

Remailit does not request access to message content. Because Mail.ReadBasic does not expose the body or attachments, this is a technical limit, not only a policy choice.

3. What Remailit stores

On its servers, Remailit keeps the minimum needed to track a follow-up:

Your account's name and email address, and which organization (tenant) your seat belongs to.
For each flagged thread: the subject, To/Cc recipient addresses, sent time, the label you applied, the computed due time, the tracking status, and which recipients have replied.
Identifiers and links for the related Outlook message and calendar event, plus a log of reminders that fired.
The OAuth token cache needed to call Microsoft Graph, encrypted at rest with AES-256-GCM.

BCC recipients and message bodies are never stored. Remailit does not use third-party advertising, behavioral analytics, or data brokers.

Waitlist. If you join the Gmail or Microsoft 365 waitlist without connecting an account, Remailit stores only the email address you provide, the platform you picked, and the date you joined. That address is used only to contact you about Remailit — never sold, rented, or used for advertising — and you can ask for it to be deleted at any time.

4. How the information is used

Only to operate the reminder feature: detecting flagged sent messages, creating and updating calendar events, checking whether a reply has arrived, and closing the follow-up when it has. Metadata is not used to profile you, train models, or for any unrelated purpose.

5. Sharing

Remailit does not sell or rent personal data. Data is stored on infrastructure operated by Remailit, except for the calls made to Microsoft Graph to read metadata and manage categories and calendar events, which are governed by Microsoft's terms. Infrastructure providers used by Remailit may process data on its behalf.

6. Retention and deletion

Follow-up records are kept while they are useful for tracking and for Remailit's records. You can stop a specific follow-up at any time by removing its category or marking it done. To request deletion of your account data, use the support channel in the Remailit app. Deletion requests are carried out by Remailit; a confirmation is sent once completed. Revoking Remailit's access from your Microsoft account stops further access immediately.

7. Security

OAuth tokens are encrypted at rest; client secrets and signing keys are kept in server configuration, not in the database.
Access to the servers is limited to authorized Remailit personnel. Transport to Microsoft Graph uses HTTPS.
No system is perfectly secure. If you believe your data has been compromised, contact Remailit promptly through the app.

8. Your choices

Remove a label/category to stop tracking a thread.
Revoke the app's access in your Microsoft account security settings.
Ask for a copy or deletion of the metadata associated with your account.

9. Changes to this notice

If this notice changes materially, the updated version will be posted on this page with a new "last updated" date.