Privacy policy

Last updated: 9 November 2026

This page explains what Spambo reads, what it keeps and for how long, who helps run it, and how to delete everything. Spambo is run by NueForm Inc. (“we”). Questions go to spambo@spambo.ai.

The short version

Spambo never stores the emails in your Gmail: not their text, not their subjects, not their attachments.
Spambo never deletes anything. It moves unwanted mail into Spambo folders in your Gmail, where you can always find it.
Spambo never sells your data and shows no ads.
Nobody at Spambo reads your mail.
If you’re a member of a Spambo family, the person who manages it gets copies of the scam emails Spambo catches for you and of the other kinds of email they asked for, as you agreed when you joined (see “Spambo Family”).
You can delete your account and almost everything Spambo knows about you with one email. What’s kept is listed below.

Who runs Spambo

Spambo is a product of NueForm Inc.

NueForm, Inc., 5005 W Laurel Ave, Suite 100, #1028, Tampa, FL 33607

NueForm Inc. is responsible for the data described here. The one address for everything, privacy included, is spambo@spambo.ai.

What Spambo asks Google for

When you connect your Gmail, Google asks you to give Spambo these permissions:

Read, compose and send email in your Gmail (Google’s gmail.modify permission). Spambo uses it to read new mail, move unwanted mail into folders under “Spambo”, add labels and put short warning notes from Spambo in your mailbox. It can’t permanently delete mail, and Spambo never deletes anything. This permission also lets Spambo send email from your address. It does that only to ask someone you’ve never emailed what their email is about, to ask again when their answer isn’t clear, to tell them they’re through, and, when you copy Spambo on your reply to someone’s request, to ask that person what they need. It never sends anything else from your address.
See your Google Contacts. Used to learn who you know, so their mail reaches you.
Your Google address and name. Used to know which mailbox is yours, to greet you, and to introduce Spambo when it writes to a stranger for you (“Hi, I’m Spambo, Sam’s email bodyguard”). Spambo keeps only your first name. You can change it or turn it off by writing “call me Sam” or “don’t use my name”.

To stop Spambo writing from your address, email spambo@spambo.ai and say so in your own words, like “stop writing to strangers from my address”. From then on Spambo sends nothing from your address, email from someone new that it would have asked about stays in your inbox, and email still waiting in Cold pitches for someone’s answer goes back to your inbox. Write “start asking strangers again” to turn it back on.

What Spambo reads, and why

New mail in your inbox. Its headers (who sent it, to whom, the reply-to address, subject, date, list and unsubscribe details, and the results of the sender checks Gmail ran), its Gmail labels, and Gmail’s short preview of its text, which Spambo checks for security codes, receipts and the like so they are never hidden. When Spambo needs to look closer, it reads the whole email, without opening attachments, and gives the AI its text cut to 6,000 characters, with every link reduced to its domain. This is how it decides where the email belongs.
New mail Gmail puts in its Spam folder. Spambo reads its headers but uses only the sender and Gmail’s sender checks. If it’s from someone you know and the checks pass, Spambo reads it once to check it isn’t a scam and, if it’s clean, moves it back to your inbox with the Spambo/Rescued label. Everything else in Spam stays where it is, and its text is never read. Right after you connect, Spambo does the same once for the mail already in Spam (Gmail keeps at most 30 days of it), and the day-one email tells you what it moved back.
Your Sent mail, across your whole history. Spambo asks Gmail only for the To and Cc lines and the conversation each email belongs to, to learn who you write to and which threads are yours. Gmail’s answer also includes a short preview of each email, which Spambo ignores and never keeps. During the day-one cleanup, Spambo also searches your Sent mail for each sender, Bcc included.
Your Google Contacts. Names and email addresses, checked again every day.
The last 90 days of your inbox, once, right after you connect: each email’s sender, subject and unsubscribe details, so Spambo can offer to clear out the junk that’s already there. Nothing in your inbox moves unless you reply yes.
Whether you read a sender’s mail. Before filing a newsletter or a marketing email, Spambo counts how many of that sender’s emails from the last 90 days you opened or starred. It counts them; it doesn’t read them. A newsletter or marketing email from a sender you read stays in your inbox. Spambo counts the same way when the AI first calls an email a scam and its sender passes Gmail’s sender checks, before deciding whether it goes in Spambo/Scams, and the AI is then told whether you regularly open mail from that exact address.
Mail you send, as you send it. Spambo reads its To and Cc lines, as above, and its subject. The subject is only compared, at that moment, with the subjects of Spambo’s own invite and weekly report, to notice when you forward one to a friend. It is never kept.
Your Sent folder, to check a command. When you email Spambo, it looks for that exact email in your Sent folder, to make sure it really came from you.
Your own moves. When you drag mail out of a Spambo folder or out of Gmail’s Spam into your inbox, Spambo reads its headers for the sender and treats them as someone you know. When you move mail into Gmail’s Spam, it reads the sender the same way and files their mail in Spambo/Blocked from then on. When you move mail into one of the Spambo folders, it reads the sender the same way and files their later mail there (in Spambo/Blocked after a move into Spambo/Scams). A folder you make yourself under “Spambo” counts as one of them.
When you add a rule. Spambo looks at your last 7 days of mail (not Spam, Trash or Sent) and reads the sender and subject of up to 25 emails, to tell you which ones the rule would have caught. It keeps none of it.
When you forward an email to Spambo. It finds the original in your Gmail, by its id or by its sender, subject and date, so it can move it or tell you what happened to it.
Summaries and reports. When you ask what Spambo did, and for the weekly report, it reads the sender names of the mail it filed at that moment, and keeps none.
Threads. Before it hides an email, or asks its sender what they need, Spambo may read the headers of the email’s thread to see whether you wrote in it.

What Spambo never does

It never stores the emails in your Gmail: not their text, their subjects or their attachments. It reads, decides, and keeps only the result (below).
It never deletes mail, and never puts mail in Gmail’s Spam or Trash.
It never sells your data, and your mail is never used for advertising.
It never uses your mail to train AI models.
Nobody at Spambo reads your mail, and no screen or tool shows it. To run Spambo and to answer you, NueForm’s operators can see your account’s settings and your rules. When you write to Spambo asking for help, a person reads what you wrote.
It never shares your rules, or who you allow or block, with other Spambo users.

Google’s Limited Use requirements

Spambo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

What Spambo keeps, and for how long

Spambo keeps facts, not mail. To remember the people who email you, it keeps a keyed hash: a scrambled fingerprint of their address, made with a secret key, that can’t be turned back into the address.

Your account: your email address, your first name (from Google, or the one you chose), your language and time zone, your settings, who invited you, your own invitation code, and whether you get the weekly report. Until you delete your account.
Your Gmail connection: Google’s id for your account, your Gmail address, the permissions you gave and when, Google’s marker for the next contacts check, and Google’s access keys, encrypted. Until you delete your account.
Your rules: your own words and Spambo’s summary of each rule, encrypted, because rules often name other people, and keyed hashes of the senders or domains they cover. Until you delete your account. A rule you remove is switched off, not erased, so “undo” can bring it back.
Your folders: the names of folders you asked for (like “Jobs”), and of folders you made under “Spambo” once you moved mail into one or named it in a rule. Until you delete your account.
People you know: keyed hashes of the addresses and names of the people you write to, your contacts, senders whose mail you moved back to your inbox, and strangers who answered Spambo’s question, and of their domains. Until you delete your account, or 90 days after your plan or gift ends.
Senders of security codes, password resets, receipts and similar mail: a keyed hash, so that mail is never hidden. One year after their last such email.
Email threads you wrote in: Gmail’s ids for those threads only, and the date you last wrote in each, so replies to you are never hidden. Until you delete your account.
Introductions: Gmail’s ids for threads that someone you know started or copied you on, so the others on them aren’t asked what they need. 180 days.
Decisions: for each email Spambo handles, Gmail’s ids for the message and its thread, and codes for what Spambo decided and why (the folder, the kind of email, how sure the AI was, a reason code, the AI model used, any scam warning signs, the sender’s language and, for a question to a stranger, which opening line it used). No content. 90 days.
Warnings: the ids of emails Spambo warned you about, with reason codes. 90 days.
A sender’s remembered verdict: a keyed hash and the coded verdict, so Spambo doesn’t judge the same sender twice. Up to 30 days.
Whether you read a sender’s mail: a keyed hash of the sender and a yes or no. 30 days.
Senders you said were fine: when you tell Spambo that an email is fine, to let its sender through, or to let everyone at a domain through, a keyed hash of the sender’s address and of its domain, and whether it covers their whole organisation, so their later emails that really come from them reach your inbox with no warning. Never the email itself. Until you say one of their emails is a scam, you block them or take the rule back, or you delete your account, or 90 days after your plan or gift ends.
Spambo’s own moves and messages: message and label ids, so Spambo never mistakes its own moves for yours. Moves, up to 14 days; the notes it put in your mailbox and the emails it sent from your address, 180 days.
The day-one cleanup: message ids grouped by a keyed hash of each sender, and the folder each would go to. 30 days if you don’t accept the offer; 90 days after it runs, so “undo” works.
Sudden floods of mail: counts and times only. 90 days.
Campaigns in your mailbox: a fingerprint, keyed hashes of their domains and the verdict, 180 days after last seen; which campaigns reached you, 90 days.
Shared spam fingerprints: when any Spambo inbox catches a new scam or spam campaign, Spambo keeps a fingerprint of it, keyed hashes of up to 20 of its domains and sending addresses, counts of how many inboxes got it and how many people moved it back, and the coded verdict, so every Spambo inbox blocks it. Never email text, never your rules, and never which inbox it came from. It is shared only when Spambo’s own judgement made it, with no rule of yours involved, from a sender you don’t know and in an email that isn’t a code, receipt or alert. On its own it never hides mail from someone you know or a protected email, never blocks mail from another real sender that copied its text, and on a public mail service such as gmail.com it matches the same address only, never everyone there. 180 days after the campaign was last seen.
Shared answers about domains: some decisions depend on what kind of domain an email or a link comes from, for example whether anyone can get an address there, as at gmail.com, or whether a link goes to a well-established site. For those, Spambo asks the AI about the domain’s name alone, with no email and nothing about you, and keeps the answer for every Spambo inbox: a keyed hash of the domain (never the domain itself), the answer as a code, and when it was asked. No mailbox, sender or account is part of it. A clear answer is kept 180 days, an unsure one 7 days, and a check that failed 10 minutes.
Counts: daily and weekly numbers of what Spambo did, for your weekly report and for Spambo’s costs. 400 days.
Logs: ids and codes, never content. 30 days; errors 90 days.
Invitation links: yours for the life of your account; the one in each question Spambo sends a stranger, 1 year.
Friends you invite: when you ask Spambo to set someone up, or forward Spambo’s invite or weekly report from your Gmail, a keyed hash of each address you sent it to, with your account, so their signup counts as your referral without a code. Until they join, 90 days after you last invited them, or until you delete your account.
Renewal reminders sent: a record of each, 2 years.
Gifts: who gave it, the recipient’s address, the years, the payment and the dates, for as long as the giver’s account exists (if the giver deletes their account, until 90 days after the gift ends). The giver’s note is encrypted and deleted once the recipient connects. The gift email shows the giver’s name and address, so the recipient can tell it’s real.
Recovery phone (optional): if you add one, the number, encrypted, until you remove it or delete your account; a scrambled copy of each texted code, for a day.
Short-lived records: the links Spambo sends (7 days after they expire), Google sign-in attempts (1 day), open email conversations with Spambo (they close within 30 days, 48 hours for a question about letting a whole domain through, and are deleted 7 days later) and background tasks (7 days after they finish).
The beta list: if you asked to join, your address, how you found Spambo, and where you are in line. Until Spambo leaves the beta. A person at NueForm also gets an email with your request, including what you wrote.
Spambo Family: for each membership, from the ask on, the manager’s and the member’s accounts, the member’s email address (encrypted) and a keyed hash of it, the name the manager gave the member and the kinds of email the manager asked for copies of (the manager’s words and Spambo’s summary, with the date each starts), both encrypted; whether scam copies are on, the id of the member’s folder in the manager’s Gmail (under Spambo/Family), the status and its dates, the member’s age group and, for a member under 18, when the manager confirmed being their parent or legal guardian, and a count of copies Spambo couldn’t deliver. While the membership lasts: deleted when it ends, or at once when either of them deletes their account. One that never starts ends too: 30 days after the ask if nobody answered yes, or 30 days after the yes if the manager never paid.
A family member’s agreement: which version of Spambo’s page explaining what the manager sees they agreed to and when, the language the page was shown in, who agreed (the member, or the parent or guardian of a child under 13), the manager’s and the member’s account ids, a keyed hash of the member’s email address, the age group, the parent-or-guardian confirmation and, for a child under 13, the id and date of the parent’s first card payment. 3 years, or 1 year after the membership ended if that’s longer, even after a deletion.
Copies for a family manager: for each copy or notice Spambo put in a manager’s Gmail, the member’s message id (or the notice’s kind) and whether it was delivered: ids only, no content. 180 days.
Asks by address: when a user gives Spambo someone’s email address to set them up or add them to their Spambo family, a keyed hash of that address with the user’s account and the dates, so the same user can’t have Spambo ask them again while the ask is open. 30 days.
The website’s sign-up form: for each address entered in it, a keyed hash of the address, the Google ad click it came with (if any) and the page’s language, so the same address isn’t emailed twice in a day or more than 3 times in 30 days, and Spambo can count which ads bring people. 90 days. If that person signs up, the ad click is kept with their account until they delete it, and is added to their customer record at Stripe (see Stripe, below).
Payments reported to Google Ads: for each payment Spambo reports (see “Cookies and ads”), its kind, amount, date and Stripe id, the ad click id if there was one, whether Google accepted it, and a SHA-256 hash of the payer’s email address. That hash is a plain one, not keyed, so that Google can match it with the addresses it knows. Until the payer deletes their account.
Payments: see Stripe, below.

How Spambo protects your data

Everything travels over encrypted connections. Google’s access keys, your rules and your own words, a recovery phone number, a gift note and any free text in an open conversation are encrypted in the database (AES-256-GCM). The addresses and names of the people who email you are kept as keyed hashes, or encrypted while a conversation about them is open. Logs hold ids and codes, never content. Only NueForm’s operators can reach Spambo’s systems, and every account at the services that run Spambo uses two-step sign-in. Spambo’s database runs on its own cluster, apart from NueForm’s other products. Before Spambo leaves its beta, it completes the independent security assessment Google requires of apps that read Gmail, and repeats it every year.

Email to and from Spambo

You talk to Spambo by email, at spambo@spambo.ai. Spambo reads your words, works out what you want, does it and replies.
Spambo’s database keeps no copy of your emails to it. For each one it keeps a short record: a hash of the email’s Message-ID, which account sent it, Postmark’s id for it (so it can fetch it again from Postmark if something fails), whether it passed its checks, what kind of request it was and what Spambo did. After 30 days only the hash and the date it arrived are left, for 2 years, so an old email can’t be sent again as a new command.
When you forward an email to Spambo, the forwarded part is evidence, never instructions.
When you ask for help, Spambo forwards your address, whether you have a Spambo account, your language, your subject and your own words (never the forwarded part) to a person at NueForm, who replies from their own email. That email stays in NueForm’s support mailbox for up to a year.
Mail that fails its sender checks gets no reply.

People who email a Spambo user

Spambo reads mail sent to its users only to decide where it goes, keeps none of its content, and remembers senders only as keyed hashes.

If the person you wrote to is a member of a Spambo family, your email may be copied to the person who manages their family: when it looks like a scam, or when it’s a kind of email the manager asked for (see “Spambo Family”).

When someone the user has never emailed writes to them, and Spambo can’t tell what they need, Spambo may reply from the user’s address and ask what it’s about. If you got one of these emails:

Spambo wrote only to the address your email came from, and only because your email passed its sender checks. For the same Spambo user, it asks you at most once every 30 days.
The email came from the Spambo user’s own address and named them by first name, unless they chose no name.
Spambo reads your answer, with the AI service below, to decide whether to pass your email on. Your answer stays in the Gmail thread of the person you wrote to.
Spambo keeps a record of the exchange: a keyed hash of your address, Gmail’s ids for the thread and the messages, your language, the outcome and the dates. 90 days after the exchange ends. If you pass, that user’s Spambo remembers you, as a keyed hash, so you aren’t asked again.
The email may invite you to try Spambo. If you sign up that way, the person you wrote to may earn a free month.

Spambo may also email you if a Spambo user copies Spambo on an email to you (to ask what you need, or to offer to set you up) or copies you on an email to Spambo (to offer to set you up), if a Spambo user gives Spambo your email address (to offer to set you up, or to ask whether you’d like to join their Spambo family; Spambo then writes to you from its own address, with that user copied, at most once while that ask is open), if someone forwards a scam email to you with Spambo copied (to explain why it’s a scam), or if someone gives you Spambo as a gift. Spambo uses your address for that exchange. It keeps it encrypted in the open conversation, which is deleted 7 days after it closes; for a gift, it’s kept with the gift’s order record. When the person who started it isn’t a Spambo user, Spambo writes to you at most once every 30 days. If you answer no when Spambo offers to set you up, it keeps a keyed hash of your address for 30 days, so nobody can have it ask you again in that time. If you answer “no thanks, don’t email me again”, it keeps that keyed hash for good instead, so nobody can ever have it offer to set you up or ask you to join their Spambo family again. If you join after someone invited you, Spambo records who invited you, so they get their free month.

When a Spambo user asks Spambo to set you up, or forwards you Spambo’s invite or weekly report from their Gmail (Spambo itself doesn’t write to you about a forward), it keeps a keyed hash of your address with that user’s account, so that if you join, it counts as their referral. It’s deleted when you join, when you answer no to Spambo’s offer to set you up, or 90 days after the last such invite. For 30 days after you answer no, and for good after “no thanks, don’t email me again”, none is kept, whoever invites you and however. You can have it deleted sooner: write “delete everything” to Spambo from your address.

Questions? Write to spambo@spambo.ai.

Spambo Family

A Spambo user, the manager, can pay for other people’s Spambo and make them part of their Spambo family. Each member has their own Spambo, connected with their own Google account, and before joining reads and agrees to Spambo’s page explaining what the manager sees, just before Google asks for permission. If you’re a member:

What your manager sees. A copy of each scam email Spambo catches in your inbox and of each email it warns you might be a scam, with a short note from Spambo, and copies of the other kinds of email your manager asked for (for example, emails about Discord). Also that you’re in the family, whether Spambo’s connection to your Gmail is working, and when you leave.
What is never copied. Sign-in codes, password resets, other sign-in emails and email with sexual content: at most, your manager gets a short note from Spambo that one came, saying only who it claims to be from. Spambo’s own emails to you are never copied.
What your manager doesn’t see. The rest of your email, who you write to, your contacts, what you open, your settings and rules, or what you ask Spambo. Your manager can’t change anything in your inbox.
How the copies get there. Spambo makes each copy as it handles the email and puts it straight into your manager’s Gmail, in a folder of your own under Spambo/Family, with its links switched off and its remote images removed, and the original attached without its own attachments. Copies are never sent through Postmark or from your Gmail, and Spambo keeps none. To decide what to copy, the AI that checks your new mail is also given Spambo’s summary of each kind of email your manager asked for (see Microsoft Azure, below).
Copies stay. Once in your manager’s Gmail, a copy is their mail. It stays there even if you leave, because Spambo never deletes mail and can’t delete mail in someone else’s Gmail.
Replies. If your manager replies to a copy, or forwards it to Spambo, that reply reaches Spambo through Postmark, which keeps it for up to 45 days, like every email to Spambo.
Changes and reminders. Your manager decides what Spambo copies and can change it. If they ask for more, Spambo tells you, and it starts 3 days later; less starts at once. At least every 30 days Spambo reminds you what your manager sees, in your weekly report or in a short note in your Gmail. The reminder can’t be turned off.
Leaving. Write “leave” to spambo@spambo.ai. Spambo emails a link to your own address; press its button, and Spambo ends your Spambo, ends its access to your Google account and deletes what it knows about you, as “delete everything” does, and tells your manager that you’re no longer in the family, without saying why. For 30 days after you leave, nobody can have Spambo ask you to join a family or set you up: Spambo keeps a keyed hash of your address for that, never the address. If your manager removes you or deletes their own account, your Spambo ends too; for a member under 18, Spambo then deletes what it knows about them.
A stopped connection. If you remove Spambo’s access in your Google Account settings, Spambo can’t tell that apart from other breaks, so your manager is told that the connection stopped, never that you removed it.

If you manage a Spambo family, what Spambo sends you about each member goes into your Gmail, in their folder under Spambo/Family. Use the copies only to help the people they’re about (see the terms).

Services that help run Spambo

Spambo shares data with the services below, only so they can help run Spambo. Otherwise it shares data only when the law requires it (for example a valid court order), to protect Spambo’s users or systems from abuse, or, if Spambo or NueForm is sold or merged, with the new owner, and anything that came from your Google account only after asking you first.

Each of these gets only what it needs. They may process data in the United States and other countries.

Google (Gmail, Google Contacts, Google sign-in and Google Cloud Pub/Sub). Your mail and contacts stay at Google; Spambo reads them through Google’s services as described above. Pub/Sub tells Spambo when new mail arrives: its messages carry your address and a number marking the change, never mail. The notes Spambo writes to strangers go out through your Gmail.
Google Ads shows Spambo’s ads on Google and measures which of them bring people. What it gets is under “Cookies and ads”.
Microsoft Azure, the cloud service that runs the AI that judges email. It receives: the sender, reply-to address, subject, date, attachment types, link domains and text (cut to 6,000 characters) of each email Spambo needs to check; your rules; for a member of a Spambo family, Spambo’s summary of each kind of email their manager asked for copies of, with the emails it checks; a manager’s words when they ask Spambo to copy more or less; your own words in emails to Spambo; any email you forward to Spambo (its sender, up to 5 recipients, subject, date and up to 2,000 characters of its text); when you add a rule, the sender and subject of up to 25 of your emails from the last 7 days, so Spambo can show what the rule would catch; a stranger’s answer to Spambo’s question and, once they are through, their later emails in that thread from the same address, to see whether they ask about Spambo; the words of anyone who asks Spambo a question about itself, a stranger in that thread included, to write the answer and to check it before it is sent; for the day-one cleanup, each sender’s name and domain with up to 5 subjects; during a sudden flood, the sender and subject of each email in it; an email you forward to warn family about a scam; for an email from a sender who passes Gmail’s sender checks, whether you regularly open mail from that exact address (a yes or no, never which emails); and the name of a domain alone, with no email and nothing about you, to ask what kind of domain it is or whether it is a well-established site (see “Shared answers about domains”). It returns codes, plus text of Spambo’s own: a summary of each rule, the sentence or two about an email in a warning or in a family manager’s copy, an answer to a question about Spambo in Spambo’s own words, written only from what Spambo says about itself on these pages, and translations of Spambo’s emails. Spambo turns off Azure’s storage of responses. Microsoft doesn’t use this data to train models and doesn’t make it available to the models’ makers or other customers. Microsoft’s automated abuse monitoring may keep a request it flags for up to 30 days, and authorized Microsoft staff may review it. Requests may be processed in any Azure region.
Postmark sends and receives Spambo’s email: the emails you send to Spambo, Spambo’s emails to you and to anyone else it writes to, and the help and beta requests it passes to people at NueForm. Spambo’s emails can include senders’ names and domains, counts and your rules, but never the subjects or text of the mail in your Gmail, and the copies Spambo makes for a family manager never go through it. When a stranger Spambo asked about their email asks about Spambo itself, Spambo answers them from its own address through Postmark: the answer is about Spambo only, never about their email or about you, and one that repeats what they wrote is not sent. Postmark keeps a copy of each for 45 days, and only NueForm’s operators can open Spambo’s copies.
Stripe takes payments. It gets your email address and the payment and billing details you enter on Stripe’s checkout page, for a card or another payment method. Spambo never sees your full card or account number. Spambo keeps the Stripe ids for you and your plan, your plan’s dates and status, and a record that you agreed to the terms at checkout, with the version of the terms you agreed to. To check a cancel request sent from another address, Spambo asks Stripe how your last charge was paid and, for a card, the card’s last four digits and expiry and the amount and date of that charge, compares them and keeps none of it. To stop a free first month being claimed twice, it checks a keyed hash of your payment method’s fingerprint, when Stripe gives the method one. It also keeps the payment ids and amounts of gifts and free months. If you came from a Google ad, Spambo adds the ad click id, its kind and when you clicked to your customer record at Stripe. Stripe emails your receipts.
Vercel runs Spambo’s servers and this website, so everything described here passes through it while Spambo works.
MongoDB Atlas stores Spambo’s database: the records listed under “What Spambo keeps”.
Redis Cloud (Redis Ltd., on Amazon Web Services in the US) holds short-lived counters, locks and caches, for example how many emails an address sent Spambo in the last hour. For now it is NueForm’s Redis, shared, with Spambo’s entries kept separate. Addresses and IP addresses are hashed before they are used there, and every entry expires on its own.
Twilio sends the texted codes for the optional recovery phone. It gets your phone number and the code.
Google Workspace runs NueForm’s own mailboxes, which hold the help and beta requests that Spambo passes to people at NueForm.

Cookies and ads

This website loads Google’s ad tag, which sets cookies, so Spambo can see which of its Google ads bring people. The tag runs on the website’s pages, its “page not found” page and the page Stripe sends you back to, never on a page whose address holds one of the private links Spambo emails you. When it loads, Google receives your IP address, your browser’s details and the page’s address, and Google’s own policy covers what Google does with them. Google may also use your visit to show you Spambo’s ads later, on its own sites and others. You can turn that off in Google’s ad settings. For visitors in the European Economic Area, the United Kingdom and Switzerland, Spambo tells the tag to start with its ad cookies and ad data switched off.

If you come from a Google ad, the page’s address carries an ad click id. The website keeps it in your browser, on your device, for 90 days, and sends it to Spambo only with the sign-up form. When the sign-up form takes your address, the page tells Google’s tag that the form was sent, with a hashed copy of that address (SHA-256), so Google can match it to an ad. When you pay for a plan, for a member of your Spambo family or for a gift, Spambo reports the payment to Google Ads: the amount, when it was paid, the ad click id if Spambo has one, and a hashed copy of your email address (SHA-256), so Google can match the payment to an ad. Renewals are never reported. The page you see after paying also tells Google’s tag the amount and Stripe’s id for the payment, with a hashed copy of your email address (SHA-256), so Google can match it to an ad.

Spambo’s own pages set one cookie: when a member of a Spambo family agrees on the page before Google’s screen, a cookie that lasts a day lets Spambo check that the same browser comes back from Google. Vercel, which serves these pages, receives your IP address and browser details like any web server. Spambo uses only a scrambled form of your IP address, for a minute at a time, to stop abuse of its link pages and its sign-up form. When one of Spambo’s pages sends you on to Google or Stripe, their own policies and cookies apply there.

Deleting everything

Write “delete everything you know about me” to spambo@spambo.ai, from any address.
Spambo emails a single-use link to your account’s own address. It works for one hour. Open it and press the button to confirm. Only someone who can read that inbox can delete the account.
Spambo then stops looking after your mailbox, ends its access to your Google account, cancels your plan straight away, deletes your account and every record tied to it. This usually takes less than 24 hours.
Your mail stays where it is in your Gmail, including everything in your Spambo folders (Spambo/Scams, Spambo/Junk, Spambo/Marketing, Spambo/Newsletters, Spambo/Cold pitches and Spambo/Blocked).
You can also remove Spambo’s access in your Google Account settings at any time. Spambo then stops and emails you. Removing access doesn’t delete your data; the email above does.

A few things are kept after deletion, and why:

the record that you agreed to the terms at checkout: 3 years, or 1 year after your plan ended if that’s longer, because California law requires it;
a keyed hash of your address and of your payment method’s fingerprint (when it has one), kept for good, so a free first month or a free day-one cleanup can’t be claimed again and again;
a hash of the Message-ID of each email you sent to Spambo, for up to 2 years, to block replays (after 30 days it can’t be linked to you);
a free month owed to whoever referred you (it holds only a hash, not your address), and a gift you gave, which keeps running until it ends;
if you were a member of a Spambo family, the record of your agreement to what your manager sees (for a child under 13, the parent’s consent), with your and your manager’s account ids and a keyed hash of your address: 3 years, or 1 year after the membership ended if that’s longer, to show what was agreed;
after you leave a Spambo family, a keyed hash of your address for 30 days, so nobody can have Spambo ask you to join a family or set you up again in that time;
after you answer “no thanks, don’t email me again”, the keyed hash of your address, kept for good, so nobody can ever have Spambo offer to set you up or ask you to join a family again;
copies already in a family manager’s Gmail, which are the manager’s mail (see “Spambo Family”);
help and beta requests you wrote, in NueForm’s mailboxes (see “Email to and from Spambo”);
Postmark’s copies of your emails, until Postmark removes them (at most 45 days);
Stripe’s own payment records, with the ad click Spambo added to your customer record there, which Stripe keeps under its own policy;
copies of the payments reported to Google Ads in the daily report files in NueForm’s Google Drive: the kind, amount, date, Stripe id and ad click id of each, never your address or its hash;
logs, which expire within 90 days, and Stripe’s event ids, within 30 days.

Children

Spambo accounts are for people 18 and over. Someone under 18 can use Spambo only as a member of a Spambo family managed by their parent or legal guardian, who confirms that they are before paying. Someone under 13 can use it only that way, and only with their parent’s or guardian’s consent.

How a parent consents for a child under 13. The parent or guardian pays for the child’s Spambo with their own card, then reads and accepts Spambo’s page explaining what Spambo does and what they’ll see, before the child’s Google account is connected. Together, the payment and the acceptance are the parent’s consent. A charge to the parent’s own card is a widely used way for an online service to confirm that it’s a parent who is agreeing.
What Spambo keeps about a child under 13. The same as for anyone, and nothing more: their email address and first name, their Gmail connection, their settings, and the facts listed under “What Spambo keeps”, never their emails. It also keeps their place in the family (who manages it, what the parent asked Spambo to send, and the dates), the age group the parent gave, and the record of the parent’s consent. Spambo uses a child’s data only to look after their inbox and to send the parent what this page describes. It never shows a child ads, never sells or shares their data, and never uses it to train AI.
What the parent sees. Copies, in the parent’s own Gmail, of the scam emails Spambo catches in the child’s inbox, of the emails it warns might be scams, and of the other kinds of email the parent asked for. Sign-in codes, password resets, other sign-in emails and email with sexual content are never copied: at most, the parent gets a short note that one came. The parent doesn’t see the rest of the child’s email, who the child writes to, their contacts or what they ask Spambo, and can’t change anything in the child’s inbox. Spambo keeps no copy of what it sends the parent.
The parent’s rights. The parent or guardian can ask what Spambo keeps about their child, and for a copy, by writing to spambo@spambo.ai from their own Spambo address. We answer within 30 days. They can have it deleted at any time, which also stops Spambo collecting anything more: they write “remove Timmy from my family”, with their child’s name. The child’s Spambo ends at once, and Spambo deletes what it knows about the child, as after “delete everything”. The few records listed under “Deleting everything” are kept, as for anyone, and so is the record of the parent’s consent.
A child can also leave at any time by writing “leave”, with the same result.

If you think a child under 13 is on Spambo without their parent’s consent, or someone under 18 is on Spambo outside a family managed by their parent or guardian, write to spambo@spambo.ai and we’ll delete their account.

Your rights

You can ask what Spambo holds about you, ask for a copy of it in a common format, or ask us to correct or delete it, by writing to spambo@spambo.ai. We answer within 30 days, and we never treat you differently for asking. To protect you, we first confirm the request comes from your account’s address. Someone you authorize can ask for you, with your written permission.

If you are in the European Economic Area or the United Kingdom. NueForm Inc. is the controller of your personal data. We use it to provide Spambo to you under our terms (to perform our contract with you); to keep Spambo secure, stop abuse, send the emails Spambo needs to send and see which of its Google ads bring people (our legitimate interests, which never override your rights); and to keep records the law requires, such as payment records (a legal obligation). If you’re a member of a Spambo family, the copies sent to your manager rest on your consent (for a child under 13, your parent’s or guardian’s), given when you joined; you withdraw it by leaving. You have the right to access, correct or delete your data, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you gave, without affecting what happened before. You can also complain to your data protection authority (in the UK, the Information Commissioner’s Office). Spambo and the services that help run it process data in the United States. Where the law requires a safeguard for that transfer, we rely on those services’ data processing terms, including the European Commission’s standard contractual clauses.

If you live in California. In the last 12 months Spambo collected these kinds of personal information: identifiers (your email address and first name, and the addresses of people who email you, kept as keyed hashes); commercial information (your plan and payments, through Stripe); internet activity (your IP address, scrambled, for a minute at a time, and the Google ad click that brought you, if any); and the contents of email in your Gmail, which California treats as sensitive personal information. They come from you, from your Google account with your permission, from Stripe and from the people who email you. We use them to provide Spambo, to keep it secure, to see which of Spambo’s Google ads bring people and to show Spambo’s ads, as this policy describes. We don’t sell personal information. Google’s ad tag may use your visit to this website to show you Spambo’s ads later, which California law counts as sharing; you can turn that off in Google’s ad settings. We use sensitive personal information only to provide the service you asked for. You have the right to know what we collect and how we use it, to get a copy, to correct it and to delete it, and we won’t treat you differently for using these rights. To use them, write to spambo@spambo.ai. We confirm the request comes from your account’s address and answer within 45 days.

Changes

We may change this policy. If a change matters, we’ll email you at least 30 days before it takes effect. The date at the top shows the last change.

Contact

spambo@spambo.ai, NueForm Inc.