Privacy Policy

Last updated: October 9, 2026

This Privacy Policy explains how Mass Outreach (https://mass-outreach.com) accesses, uses, stores, shares, protects, and deletes your information, including information we receive from your Google account. Mass Outreach is developed and operated by Leo Karpel ("we", "us"). Mass Outreach is a web app that helps job seekers send personalized emails about job openings from their own Gmail account.

Google user data we access

When you click Sign in with Google, Google asks you to approve three permissions. Here is exactly what each one gives us:

We do not request permission to read, search, label, modify, or delete your email. Mass Outreach cannot see your inbox, your sent mail, your contacts, your calendar, or your files.

Other information we collect

• What you enter in the app. Job details, recipient names and email addresses, your message, and any resume you attach. We use this only to build and send the emails you ask us to send. It is held in your active session and is never saved to our database.
• Free trial count. How many of your 10 free emails you have used.
• Payment information. Stripe collects your card details directly on its own checkout page. We never see or store your card number. Stripe tells us whether your subscription is active.
• Phone number (only if phone verification is turned on). If the app asks you to verify a phone number for the free trial, the number is sent to Twilio to deliver a code, and we store only a one-way scrambled version (a hash) that cannot be turned back into your number.

How we use Google user data

We use Google user data only to provide and improve the user-facing features of Mass Outreach:

• To sign you in and show which account you are using.
• To send the emails you compose, preview, and approve, from your Gmail account, to the recipients you choose. Nothing is sent without you clicking Send.
• To count your free-trial emails and check whether you have an active subscription.
• To respond when you contact us for support.

We do not use Google user data for any other purpose. Specifically, we never use it for, or transfer it for:

• targeted, personalized, retargeted, or interest-based advertising;
• selling to data brokers or information resellers;
• determining credit-worthiness or for lending purposes;
• creating databases or profiles of users or of the people they email;
• developing, improving, or training generalized or non-personalized artificial intelligence or machine learning models. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models.

Limited Use disclosure

Mass Outreach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No person at Mass Outreach reads your Google user data unless you give us explicit permission for a specific message (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, or it is required to comply with law.

How we share, transfer, or disclose data

We do not sell your data, and we do not share Google user data with anyone except the following service providers, only as needed to run Mass Outreach. Each one processes data only to provide its service to us:

We may also disclose information if required by law, to protect the rights or safety of users or others, or as part of a merger or sale of the service, in which case we will notify you first and this policy will continue to apply to your data.

How we protect your data

• All connections to Mass Outreach, Google, Stripe, and our database are encrypted with HTTPS (TLS).
• Your Google sign-in token is kept only in server memory for your current session. It is never written to our database, saved to disk, or logged.
• Our database is stored encrypted at rest by Supabase. Public access is blocked, and only our server can reach it using a secret key.
• Secret keys are stored as protected server settings and are never included in our code.
• Access to production systems is limited to the operator of Mass Outreach.
• Card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1.

Data retention and deletion

• Google sign-in token: deleted when you sign out, close the app, or your session ends.
• Emails, recipient lists, and resumes: not stored. They are discarded when your session ends. Copies of the emails you send stay in your own Gmail Sent folder, which you control.
• Email address and free-trial count: kept while you use Mass Outreach. When you ask us to delete your data, we delete your email address within 30 days. We keep only a one-way scrambled marker that the free trial was used, so the free trial cannot be claimed again.
• Payment records: kept by Stripe for as long as tax and financial laws require.

To delete your data, email leokarpel98@gmail.com from the Gmail address you signed in with. To remove Mass Outreach's access to your Google account at any time, go to myaccount.google.com/permissions. After you remove it, we can no longer send email from your account. To cancel a subscription, click Manage or cancel subscription in the app.

Children

Mass Outreach is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

If we change this policy, we will update the date at the top. If we change how Mass Outreach accesses, uses, stores, or shares Google user data, we will notify you in the app and by email before the change takes effect, and we will ask for your consent before using your data in a new way.

Contact

Mass Outreach is operated by Leo Karpel. Questions about this policy or your data: leokarpel98@gmail.com