Sortfully Privacy Policy

This policy explains what personal data Sortfully collects, why, and what rights you have. The defining feature of Sortfully is what it doesn't collect: we never read the content of your emails - not the body, not attachments, and not the subject line unless the detailed filing log is on (it's on by default, and you can turn it off at any time). This isn't just a promise; it's enforced in our code. See "What we never access" below.

1. Who we are

Sortfully is a trading name of Harman AJ Ltd, a company registered in England and Wales (company number 17412886), with its registered office at Office 1575, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW. We are the "data controller" for the personal data described in this policy, except where we act as a "data processor" for business customers (see Section 11).

• Contact / privacy questions: dpo@sortfully.app
• Postal address: available on request by emailing dpo@sortfully.app.
• Payments: purchases are sold by Paddle.com as our merchant of record; Paddle's company details and address appear on your invoice and at checkout.

2. What Sortfully does

Sortfully connects to your Microsoft Outlook / Microsoft 365 mailbox and automatically files incoming mail into folders (or applies colour-coded category labels) grouped by the sender's organisation domain. To do this, it reads only routing metadata about your messages - who sent them and when - never their content.

a. Account information

• Your email address and display name.
• Your Microsoft account identifiers (object ID and user principal name), used to identify your mailbox.
• Passkeys, if you add one: its public key, the name you give it, and when it was added and last used. The private key stays on your device.
• Sign-in codes we email you, stored only as a hash for the 10 minutes they work.

There are no Sortfully passwords: you sign in with Microsoft, a passkey or an emailed code.

b. Mailbox routing metadata

For each message we file, we process only the following fields, and no others:

• Message ID and internet message ID (to locate and undo moves)
• Sender address and domain (to decide the destination folder)
• Folder the message is in
• Date/time received
• Outlook categories (your own labels) and read/unread status
• Conversation (thread) identifier - a thread ID, not message content, used to group a conversation and to check for an open unsent reply (see below)

From the sender domain and destination of filed messages we also keep your mailbox's learned sorting rules: each sender domain, the folder or category it's filed to, and a count. They let Sortfully keep filing and show your rules; see Section 9 for how long they're kept.

If you turn on sender subfolders, we also keep a count of filed emails per sender within each organisation, so Sortfully knows when several people there email you regularly and can give each a subfolder. Each sender is stored as a one-way keyed code derived from their address, never the address itself, and nothing is counted while sender subfolders are off.

When "only move after read" is on (the default), we wait a short grace period after you read a message before moving it, so the move doesn't close a reply you've just opened. During that wait we check whether your mailbox holds an unsent reply draft in that conversation - we read only that a draft exists (its ID), never its content - and hold off filing while one is open. The delay (and the whole "after read" behaviour) is configurable in Settings.

We hold a connection ("refresh") token to your mailbox so filing can run in the background. It is encrypted at rest and is never written to logs.

c. Optional detailed filing log ("enhanced audit")

This is on by default - it's the recommended setting - and you can turn it off at any time. You're offered the choice during setup, before you connect your mailbox, so if you switch it off first, nothing beyond routing metadata is ever logged. (Your organisation's admin can also set this for everyone.) While it's on, your filing log also records the subject line and sender address of filed messages, so you can see exactly what was moved. They are stored encrypted, in our database and its backups, and so are your folder names, sorting rules and the sender domains in your log. (The times messages arrived and were filed are not encrypted.) Even so, message bodies and attachments are still never accessed.

d. Billing information

Payments are handled by our payment provider, Paddle, which acts as the merchant of record. We store your subscription status, plan, seat count, and Paddle customer/subscription identifiers. We do not store your full card details - Paddle does.

e. Anti-abuse fingerprint

To enforce our "one free trial per person" rule, when a trial ends we keep a one-way cryptographic fingerprint (HMAC) of your email address and of the Microsoft mailbox you connected - never the plaintext address or mailbox, and with no link back to your account. This lets us recognise a repeat trial without keeping your details in readable form. We keep it for 180 days after your trial ends, then delete it - so if you come back later you can start a fresh trial.

f. Technical and security data

Standard server and security logs (e.g. IP address, timestamps, error diagnostics) used to operate the service, prevent abuse, and debug problems.

g. Advertising cookies on our website (only if you accept them)

If you click Accept on the cookie banner on sortfully.app or our sign-up page, we load Google's advertising tag (Google Ads). It stores an identifier for the Google ad you clicked, if any, and if you then create an account it tells Google that a sign-up happened, so we can see which of our ads work. Google also receives the technical details any web request carries, such as your IP address, browser type and the page address. We don't send Google your name, your email address, or anything about your account or mailbox, and we don't use it for remarketing or personalised ads. If you click Reject, or make no choice, the tag never loads. You can change your mind at any time with Cookie settings in our website footer.

h. Where you found us

If you reach our website through a link that carries a short tag in its address, such as ?ref=producthunt, the sign-up links on that page carry the tag on to our sign-up page, and if you then create an account we save the tag with your account. It tells us which places people found us through. It is not shared with anyone, sets no cookie of its own, and only ever holds the name of the site the link came from, never anything about you or your mailbox.

4. What we never access

This is enforced in our code, not just our policy. Every read of your mailbox passes through a single component that is hard-coded to request only the metadata fields listed in Section 3(b)/(c). It will refuse - and our automated build will fail - if any code ever tries to request:

• the body or body preview of a message
• the subject line (except through the single reviewed path used for the detailed filing log)

We cannot read your email content, and we do not sell your data.

Sortfully staff. Our tools stop our staff from reaching your mailbox through Microsoft, or opening your folder names, sorting rules, or the senders and subject lines in your filing log, unless you allow support access in Settings. You'd do that if you've asked us to look into a problem. It lasts 72 hours, you can end it sooner (which stops our tools straight away), and we email you when it starts. Even with support access, our tools can never open message bodies or attachments. Every look through them is recorded in our internal audit log, and we'll give you that record if you ask. Without it, our tools show staff only your account details, counts and the state of the service.

5. Why we use your data, and our legal basis

6. Microsoft permissions we request

When you connect your mailbox, Microsoft asks you to consent to these permissions. We request the minimum needed to file mail:

• Mail.ReadWrite (and Mail.ReadWrite.Shared for shared mailboxes) - to read message metadata and move messages between folders
• MailboxSettings.Read - to read (never change) your existing Outlook inbox rules, so filing can coexist with them
• offline_access - to keep filing running in the background
• openid / profile / email - to identify your account at sign-in

You can revoke Sortfully's access at any time from your Microsoft account, which stops all filing.

7. Who we share data with (our processors)

We share data only with service providers who help us run Sortfully, under contract and only as needed:

• Microsoft - your mailbox provider; we act on the metadata it exposes.
• Paddle - payment processing and invoicing (merchant of record).
• Microsoft (Microsoft 365 / Graph) - to send service emails such as sign-in codes and billing notices, from our own Microsoft 365 tenant.
• Hetzner Online GmbH (Germany) - to run our servers and databases within the EU.
• Backblaze (B2 Cloud Storage, EU region) - to hold encrypted off-site backups of our database, stored within the EU.

If you accept advertising cookies on our website, Google (Google Ads) receives the data described in Section 3(g). Google uses it as an independent controller under its own privacy policy (policies.google.com/privacy), not as our processor.

We do not sell personal data, and your account and mailbox data are never shared for advertising.

8. Where your data is stored

Your data is stored on servers in the European Union. Some of our service providers may process limited data outside the EU - for example Paddle (payment processing) operates internationally. Where personal data is transferred outside the EU/EEA, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses. Our hosting (Hetzner, Germany), our encrypted database backups (Backblaze B2, EU region), and our service-email delivery (Microsoft 365) are all within the EU. If you accept advertising cookies, Google may process that data in the United States; Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension.

9. How long we keep your data

• Filing logs: kept for a rolling window, then automatically deleted. 30 days for individual (Standard) accounts; business organisations default to 90 days, configurable by an admin (minimum 30).
• Account, mailbox and billing data: kept while your account is active.
• Sorting rules: your rules, including the ones Sortfully learns automatically (which sender domain is filed to which folder, and how many times), are part of your mailbox's setup rather than its filing log. They're kept while the mailbox is connected and deleted when you disconnect it or delete your data.
• Sender counts (only with sender subfolders on): kept and deleted on the same basis as your sorting rules.
• After cancellation: your account is disconnected and your data is scheduled for deletion after a 30-day grace period, during which you can recover everything by re-subscribing. You can also choose to delete immediately. After the grace period a daily process permanently and irreversibly purges your data.
• Anti-abuse fingerprint: the one-way fingerprint (Section 3(e)) is kept for 180 days after the trial ends - including after account deletion, within that window - then automatically purged.

10. Your rights

Depending on where you live, you have rights over your personal data. Under UK and EU GDPR you can request to access, correct, delete, restrict, port, or object to processing, and withdraw consent at any time. Under the California CCPA/CPRA you can request to know, delete, and correct your data and to opt out of "sale"/"sharing" (we do neither).

Some of these are built into the product already:

• Access / portability: export your filing log as a CSV from your dashboard.
• Erasure: delete your account and data from settings (immediately, or at the end of the 30-day grace).
• Turn it off: switch the detailed filing log off at any time - including during setup, before you connect your mailbox.
• Withdraw cookie consent: use Cookie settings in our website footer (or on the sign-up page) and click Reject. This also deletes the Google advertising cookies.

To make any other request, contact us at dpo@sortfully.app. We respond within one month (UK/EU) or 45 days (California); we may extend this for complex requests and will tell you if we do. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Note on email metadata about other people: your filing log contains the domains/addresses of people who emailed you. We process this on your behalf and cannot identify or contact those senders ourselves; you control this data through your retention setting and by exporting or deleting your log.

11. Business customers: when we act as a processor

If your organisation connects its members' mailboxes and sets an organisation-wide retention policy, your organisation is the data controller for that mailbox metadata and Sortfully acts as your data processor, processing it on your instructions. A Data Processing Agreement is available - contact us at dpo@sortfully.app. (For account and billing data, and for individual accounts, Sortfully is the controller.)

12. Children

Sortfully is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us at dpo@sortfully.app and we will delete it.

13. Cookies

Necessary cookies keep the service working and are always on, so they don't need your consent:

Our checkout is provided by Paddle, which may set its own necessary cookies while you pay.

Advertising cookies are only set if you click Accept on our cookie banner (see Section 3(g)):

You can change your choice at any time with Cookie settings in our website footer. Rejecting deletes these cookies.

Our websites also remember your light or dark theme choice in your browser's local storage; it never leaves your device. Our public website (sortfully.app and docs.sortfully.app) uses Cloudflare Web Analytics to count page views. It sets no cookies, stores nothing on your device, and does not track you across sites; we see aggregate figures such as page views and referring sites, not individual visitors. Cloudflare's own notice for this service is at cloudflare.com/web-analytics. The sign-up tag in Section 3(h) needs no cookie of its own: our sign-up page keeps it in your existing session until your account is created.

14. Changes to this policy

We'll update this policy as the product changes and post the new version here with a revised "last updated" date. For significant changes we'll notify you by email or in the app.