Frequently asked questions

Inboxy is a privacy-first email assistant made by Nexlla Creative Agency. It brings all of your mail accounts into one inbox, sorts mail with automatic labels and priorities, flags phishing, tells you which messages need a reply and which are waiting on someone else, and writes reply drafts in your own voice. It also helps with bulk unsubscribing, Inbox Zero plans, signatures and finding free slots in your calendar.

Inboxy is an assistant, not an autopilot: it suggests and drafts, and you decide what happens to your mail.

Link to this answer

Anyone who spends too long in email: freelancers and founders juggling several addresses, professionals with a work and a personal account, and people who simply want a calmer inbox without handing their mail to an ad-funded service. You must meet the minimum age in our Terms of Service (16).

Link to this answer

• Web — in any modern browser, and installable as an app (PWA) from https://inboxy.nexlla.com/app/.
• Desktop — apps for macOS and Windows.
• Mobile — apps for iPhone and Android.
• Chat — a Slack app (the /inboxy command, with Send, Edit and Archive buttons) and a Telegram bot for summaries on the go.

Your accounts, rules, signatures and settings follow you across all of them.

Link to this answer

Inboxy is currently free. There are no in-app purchases and no ads. Paid plans may be introduced in the future; if they are, prices and terms will be shown before you buy, and nothing will be charged without your explicit agreement. See Pricing and billing.

Link to this answer

We never sell your data, never show ads and never use your email for advertising or profiling. Inboxy is built by Nexlla Creative Agency; in future we may offer paid plans for advanced features or heavier use. Our business depends on you trusting us with your inbox, not on monetising it. The Privacy Policy sets out exactly what we process and why.

Link to this answer

No. Your mail stays with your provider (Google, Microsoft, Apple, Proton and so on). Inboxy connects to it, works alongside it, and you can keep using your provider’s own apps at the same time. Labels, read status and archiving sync back to your provider where it supports them.

Link to this answer

Gmail and Google Workspace, Outlook and Microsoft 365, iCloud Mail, Yahoo Mail, Fastmail, Proton Mail (through Proton Mail Bridge) and any other provider that supports standard IMAP and SMTP. You can also connect Google, Microsoft and CalDAV calendars (iCloud, Fastmail, Nextcloud) for free-slot suggestions.

Inboxy is independent and is not affiliated with or endorsed by any of these providers.

Link to this answer

As many as you need. They all land in one unified inbox, and you can filter by account at any time. We may apply fair-use limits to protect the service; if a limit ever applies to you, the app will tell you.

Link to this answer

No. Gmail and Outlook connect with OAuth 2.0: you sign in on Google’s or Microsoft’s own page, approve the permissions, and they give Inboxy a revocable access token. We never see or store your Google or Microsoft password.

We ask for the minimum permissions needed to read, organise and send mail on your behalf. For Gmail that is the gmail.modify scope, which lets Inboxy apply labels and archive messages; it does not allow permanent deletion. You can revoke access at any time from your Google or Microsoft account settings, or by removing the account in Inboxy. Our use of Google data follows the Limited Use requirements described in the Privacy Policy.

Link to this answer

These providers use IMAP and SMTP with an app-specific password — a separate password you create in your provider’s account settings just for Inboxy. Your main password is never used.

• iCloud: sign in at account.apple.com, open Sign-In and Security → App-Specific Passwords, and create one. Two-factor authentication must be on.
• Yahoo: open Account Security and choose Generate app password.
• Fastmail: open Settings → Privacy & Security → Manage app passwords, and create one with IMAP and SMTP access.

Then choose the provider in Inboxy and paste the app password. Inboxy stores it encrypted in your personal vault. To cut off access, revoke the app password at your provider. Provider menus change from time to time; if a step doesn’t match, search your provider’s help pages for “app password”.

Link to this answer

Yes. Choose “Other (IMAP/SMTP)” and enter your address. Inboxy tries to discover the server settings automatically; if it can’t, enter the IMAP and SMTP host names, ports and security settings from your provider’s help pages. Connections must use TLS, and for your protection Inboxy will not connect to private or internal network addresses.

Link to this answer

Proton Mail encrypts your mailbox so that only you can read it, which means no outside service can read it directly. Proton’s official answer is Proton Mail Bridge, an app that runs on your computer, decrypts mail locally and makes it available over IMAP and SMTP on 127.0.0.1 (your own machine).

1. Install Proton Mail Bridge from Proton (a paid Proton plan is required) and sign in to it.
2. Copy the Bridge password and port numbers that Bridge shows you.
3. In Inboxy, choose Proton Mail and enter them.

Inboxy only ever sees the Bridge password, never your Proton password or keys. Bridge only accepts connections from the computer it runs on, so the hosted Inboxy service at inboxy.nexlla.com can’t reach it — for your security, our servers never connect to addresses inside your private network. Proton Mail is therefore supported when Inboxy is self-hosted on the same computer or private network as Bridge. When Bridge is closed or that computer is asleep, the account pauses and catches up when Bridge is back.

Link to this answer

Yes, if your organisation allows it. Many Google Workspace and Microsoft 365 organisations require an administrator to approve third-party apps. If you see “Need admin approval”, “This app is blocked” or a similar message, ask your IT administrator to review and allow Inboxy. Please check your employer’s policies before connecting work mail; you are responsible for having permission to use Inboxy with it.

Link to this answer

Inboxy has lost permission to reach that mailbox. Common causes: you changed your password, revoked access at your provider, an app password was deleted, a work admin changed policies, or the provider expired the token. Tap Reconnect and sign in again; your synced mail, labels and settings are kept.

Inboxy never removes an account because of a sync error — it waits for you to reconnect.

Link to this answer

Removing an account stops syncing straight away. For 7 days you can restore it from Settings with everything intact, in case you removed it by mistake. After that, the mail and data Inboxy synced from that account are permanently deleted from Inboxy, and for Google accounts we also revoke the access grant.

Removing an account from Inboxy never deletes anything from your provider — your mail stays in your mailbox.

Link to this answer

Yes. Inboxy replies from the address a message was sent to by default, and you can change the “From” address in the composer to any connected account or alias. Aliases must be set up and verified with your provider first (for example “Send mail as” in Gmail), otherwise the provider may reject or rewrite the sender.

Link to this answer

No. Your email is never used to train AI models — ours or anyone else’s. Our cloud AI provider processes requests on our behalf under commercial terms that do not allow training on the data we send. See AI processing in the Privacy Policy.

Link to this answer

You choose one in Settings, and can change it at any time:

• Cloud AI — the best quality. Text is redacted first and then processed by Anthropic’s Claude API, acting as our processor.
• On-device AI — runs a model with Ollama on your own computer. No email text goes to an AI provider.
• AI off — no language model at all. Labels, priorities, phishing checks, Inbox Zero plans and template drafts still work.

Link to this answer

Before any text leaves for the AI provider, Inboxy replaces sensitive details with placeholder tokens such as ⟦EMAIL_1⟧. This covers email addresses, phone numbers, payment card numbers, IBANs, government ID numbers, API keys and tokens, passwords and signed links. When the answer comes back, Inboxy puts the real values back on our side, so the AI provider never sees them.

Redaction is automated and pattern-based, so it cannot recognise every kind of personal information (names and free-text details, for example, may remain). If that matters for a particular account, use on-device AI or turn AI off.

Link to this answer

Install Ollama on your computer, download a supported model, and choose On-device AI in Inboxy’s AI settings. Inboxy will check that Ollama is reachable and which models are installed. Results depend on the model and your hardware: smaller models are faster but less accurate, and a recent computer with plenty of memory gives the best experience.

Link to this answer

Yes. Choose AI off. The core of Inboxy — unified inbox, rule-based labels, priorities, phishing warnings, Needs Reply tracking, bulk unsubscribe and template drafts — runs without a language model. Features that need AI, such as voice-matched drafts and one-line summaries, are simply hidden.

Link to this answer

No. Inboxy writes drafts; you decide what gets sent. Nothing leaves your outbox until you press send (or tap Send in Slack). The AI is instructed never to agree to payments or share credentials, and Inboxy’s automations never act on AI output alone. Always read a draft before you send it — you are responsible for what you send.

Link to this answer

Inboxy analyses your sent mail to build a voice profile: statistics such as how you usually greet people, how you sign off, how formal you are and how long your replies tend to be. Drafts follow that profile. Your raw sent mail is not used as a prompt collection, and the profile is stored encrypted in your vault. You can review or reset it in Settings.

Link to this answer

Usually very good, but never perfect. AI can misread tone, miss details, or state something confidently that isn’t true. Treat summaries as a guide, check drafts before sending, and don’t rely on Inboxy alone for legal, financial, medical or other important decisions. Open “Why this label?” to see why a message was sorted, and correct it — Inboxy learns from your corrections and your plain-English rules. See AI features in the Terms.

Link to this answer

Cloud AI reads and writes most widely used languages and normally replies in the language of the message. Quality is best in English and other major languages. On-device quality depends on the model you install. The Inboxy apps for iPhone and Android are available in English and Arabic (with full right-to-left layout); the web and desktop apps are currently in English.

Link to this answer

Sign in to Inboxy on the new device and everything is already there: every connected account, signature, rule and setting. You don’t need to reconnect your mail accounts.

Link to this answer

On a device where you’re already signed in, open Settings → Devices and choose Pair a device. Scan the QR code with the new device, or type the short code. Each code works once and expires after five minutes. Only pair devices you own, and never share a pairing code with anyone — including anyone claiming to be from Inboxy support.

You can see and sign out every paired device from Settings → Devices.

Link to this answer

• iPhone: App Store
• Android: Google Play
• macOS: download for Mac
• Windows: download for Windows

Only install Inboxy from these official sources.

Link to this answer

Partly. The apps keep a local cache of recent mail so you can read and draft without a connection. Sending, syncing, search across your whole mailbox and cloud AI need a connection; anything you queue is sent when you’re back online. If you share a computer, sign out when you’re done so the local cache isn’t left behind.

Link to this answer

By default only short summaries — never full email bodies. You link each chat account with a one-time code from Inboxy, and you can disconnect it at any time from Settings. Messages you see in Slack or Telegram are also stored by those services under their own terms, so think about what you route there, especially for work mail.

Link to this answer

By default, new mail that Inboxy rates as important or that needs a reply from you, plus security alerts such as a likely phishing message or a new sign-in. Newsletters, promotions and other low-priority mail don’t buzz your phone. You can fine-tune this per account in Settings → Notifications.

Link to this answer

You choose the privacy level:

• None — a generic “New email” message with no details.
• Summary (default) — the sender and a one-line AI summary.
• Full — the subject and a short snippet of the message.

Notifications are delivered through Google’s Firebase Cloud Messaging and, on iPhone, Apple’s push service, so the content you choose passes through those services. Notifications can also show on your lock screen; use “None” or your phone’s lock-screen settings if others can see your device.

Link to this answer

In Inboxy, open Settings → Notifications and switch them off for an account or for everything. You can also turn them off in your phone’s or browser’s system settings. Signing out of a device removes its push token from your account.

Link to this answer

See Push notifications aren’t arriving in Troubleshooting.

Link to this answer

Yes. Inboxy is currently free to use, with no ads and no in-app purchases. We don’t ask for payment details.

Link to this answer

Paid plans may be introduced. If they are, prices and terms will be shown before you buy, and you will never be moved onto a paid plan without choosing it. We will give notice of material changes as described in the Terms of Service.

Link to this answer

There is nothing to refund while Inboxy is free. If paid plans are introduced, refunds will be handled as set out in the Terms of Service and the terms shown at purchase, and in line with mandatory consumer law that applies to you. Purchases made through the App Store or Google Play are also subject to Apple’s or Google’s refund processes.

Link to this answer

All traffic uses HTTPS/TLS. At rest, your data lives in your own vault: a separate encrypted store for each user, encrypted with AES-256-GCM using a data key unique to you. Your data key is itself encrypted with a master key held outside the database. Each encrypted value is bound to you and to where it is stored, so it can’t be copied into someone else’s account. Backups are encrypted too. The Security page has the details.

Link to this answer

Instead of keeping everyone’s mail in one big shared database, Inboxy gives every user an isolated, encrypted vault. Our main database holds only sign-in identities. No part of our API accepts another person’s user ID, and we routinely test that one account cannot reach another’s data. It also means that deleting your account can destroy your data cleanly — see crypto-shredding.

Link to this answer

Yes, and we recommend it. In Settings → Security you can add a passkey (Face ID, Touch ID, Windows Hello or a security key) and turn on two-factor authentication with an authenticator app. When you turn on 2FA you get ten single-use recovery codes — store them somewhere safe, because they are the way back in if you lose your phone. Sensitive actions, such as deleting your account, ask you to confirm your identity again.

Settings → Security also shows recent security events for your account, such as sign-ins and changes to 2FA.

Link to this answer

No human at Inboxy reads your mail, except in three narrow cases: you explicitly ask us to (for example, to investigate a support issue, and only the messages you point us to); it is necessary to investigate a security incident or abuse of the service; or we are required to by law. Access in those cases is limited, logged and kept to what is strictly necessary. Our Privacy Policy describes this in full.

Link to this answer

Yes. Remote images are blocked by default and load only when you ask. When they do load, they go through Inboxy’s image proxy, which strips cookies and referrer information so senders can’t easily tell when or where you opened their email. Email HTML is also cleaned and shown in a locked-down frame so it can’t run scripts.

Link to this answer

Inboxy checks each message for warning signs: a sender pretending to be a well-known brand, failed SPF, DKIM or DMARC authentication, a Reply-To address that doesn’t match the sender, and pressure language such as “urgent payment” or “verify your account now”. Suspicious messages get a clear warning explaining why.

No filter catches everything, and some legitimate mail may be flagged. Never enter passwords or payment details from an email link you weren’t expecting — go to the website directly instead.

Link to this answer

Thank you. Please email [email protected] and follow the guidance in Reporting a vulnerability. Don’t access other people’s data or disrupt the service while testing, and give us a reasonable chance to fix the issue before disclosing it.

Link to this answer

Open Settings and choose Export data. Inboxy prepares a download containing your settings, rules, signatures and other data as JSON, and synced mail in the standard mbox format, which most email apps can import. The download link is valid for one hour. The archive is streamed directly to you and is never written to disk on our servers. For your security, stored passwords and access tokens are never included.

Link to this answer

Go to Settings → Security → Delete Inboxy account, in any of the apps or on the web. You will be asked to confirm your identity. Deletion takes effect immediately and cannot be undone, so export anything you want to keep first.

Deleting your Inboxy account does not delete your mailboxes at Google, Microsoft or any other provider. You may also want to revoke Inboxy’s access in those accounts’ security settings.

Link to this answer

We use crypto-shredding: Inboxy destroys your personal data key and deletes your vault straight away, along with your sign-in records. Without the key, any remaining encrypted copy of your data is unreadable.

Encrypted backups are kept for 14 days for disaster recovery. Copies of your data in those backups can no longer be decrypted once your key is gone, and they rotate out completely within 14 days. We may keep limited records where the law requires it, as described in How long we keep data.

Link to this answer

Inboxy’s servers and your encrypted vault are hosted in [Hosting region — confirm]. Some service providers we rely on — for example the cloud AI provider when you use Cloud AI, and the push notification services — may process data in other countries. The full list is on our Subprocessors page, and the Privacy Policy explains the safeguards for international transfers.

Link to this answer

Most rights — access, export, correction and deletion — you can exercise yourself in Settings. For anything else, write to [email protected]. Your rights are explained in the Privacy Policy.

Link to this answer

• Check the account’s status in Settings → Accounts. A Reconnect banner means access needs renewing (see below).
• The first sync of a large mailbox can take a while; recent mail arrives first and older mail fills in over time.
• Pull down to refresh on mobile, or reload the web app.
• Providers sometimes limit how fast apps can sync. Inboxy backs off and retries automatically, so waiting a few minutes often solves it.
• For Proton Mail, make sure Proton Mail Bridge is running.

Link to this answer

Tap Reconnect and sign in again with the same account. For iCloud, Yahoo, Fastmail and other IMAP accounts, create a new app password if you deleted or changed the old one. If a work account keeps asking, your administrator may have changed app policies — see work accounts. Your data is kept while the account is waiting.

Link to this answer

Apps that request access to Gmail must pass Google’s OAuth verification and an independent security assessment. While that review is in progress, or if you reached a sign-in page that isn’t ours, Google may show a “Google hasn’t verified this app” notice. Only continue if the request comes from Inboxy, through https://inboxy.nexlla.com or our official apps, and the app name and developer shown match. If you’re unsure, stop and contact [email protected].

Link to this answer

• Make sure Bridge is open and signed in on the computer Inboxy is using, and that the computer isn’t asleep.
• Compare the IMAP and SMTP ports in Inboxy with the ones Bridge shows — they can change after Bridge updates.
• Use the Bridge password shown in Bridge, not your Proton password.
• Bridge listens only on your own computer (127.0.0.1), so the account must be connected from the Inboxy desktop app on that same machine.
• Security software or a firewall can block local connections; allow Bridge if needed.

Link to this answer

Check the active filters and labels — the message may have been sorted into a category, archived or marked low priority. Search for it by sender or subject. Confirm the message is still at your provider (for example, in Gmail on the web); if it was deleted there, it is removed in Inboxy too. Older mail may still be syncing on a newly connected account. If you removed and restored an account, give it a few minutes to catch up.

Link to this answer

• Check notifications are allowed for Inboxy in your phone’s or browser’s settings, and in Inboxy under Settings → Notifications.
• Focus modes, Do Not Disturb and battery-saving settings can hold notifications back — on Android, exempt Inboxy from battery optimisation.
• Only important mail triggers a notification by default; low-priority mail is silent.
• Sign out and back in on the device to register a fresh push token.
• Web push needs the browser running and, on iPhone, Inboxy installed to your Home Screen.

Link to this answer

• Make sure you downloaded it from an official link (see where to get the apps) and that your operating system is up to date.
• On macOS, if you see a warning that the app can’t be opened, move it to Applications and open it from there; check System Settings → Privacy & Security.
• On Windows, if SmartScreen shows a warning, confirm the publisher is Nexlla Creative Agency before continuing.
• Quit any running copy (check the menu bar or system tray), restart your computer and try again.
• As a last resort, uninstall and reinstall — your data is in your account, not on the device.

Link to this answer

Email [email protected] from the address you use to sign in to Inboxy. Tell us which app and device you’re using, what you expected, what happened instead and any error message. Never send us your passwords, app passwords, 2FA or recovery codes, or pairing codes — we will never ask for them.

Link to this answer