1. Introduction
Welcome to Icebox, a product of Whitetowers Group LLC ("Company," "we," "our," or "us"). We are committed to protecting your privacy and ensuring transparency about how we handle your personal information.
Whitetowers Group LLC is a company registered in Florida, United States, operating the Icebox service.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email client application and related services (collectively, the "Service").
By using Icebox, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.
2. Information We Collect
Account Information: When you create an account, we collect your name, email address, and authentication credentials. If you sign up using OAuth providers (Google, Microsoft), we receive basic profile information from those services.
Email Data: To provide our email services, we access and process your emails, attachments, contacts, and calendar data from connected email accounts. This data is necessary for core functionality including spam detection, categorization, and search.
Usage Information: We collect information about how you interact with our Service, including features used, actions taken, timestamps, and device information.
Technical Data: We automatically collect IP addresses, browser type, operating system, device identifiers, and similar technical information when you access our Service.
Communication Data: If you contact us for support or feedback, we retain those communications to improve our Service.
3. How We Use Your Information
Provide Services: Process and deliver your emails, detect spam, categorize messages, and enable productivity features.
AI Processing: Our AI features analyze email content locally where possible to provide spam detection, smart categorization, and priority inbox functionality. We do not use your email content to train AI models.
Improve Services: Analyze usage patterns to enhance features, fix bugs, and develop new functionality.
Security: Detect, prevent, and respond to fraud, abuse, and security incidents.
Communication: Send service-related notices, updates, and respond to your inquiries.
Legal Compliance: Comply with applicable laws, regulations, and legal processes.
4. Information Sharing
We do not sell your personal information. We may share information in the following circumstances:
Service Providers: We work with third-party companies that help us operate our Service (hosting, analytics, customer support). These providers are bound by confidentiality obligations.
Email Providers: To access your email, we connect to your email provider (Gmail, Outlook, etc.) using secure OAuth protocols.
Legal Requirements: We may disclose information if required by law, court order, or government request.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
With Your Consent: We may share information for other purposes with your explicit consent.
5. Data Security
We implement industry-standard security measures to protect your information:
• All data is transmitted using HTTPS/TLS encryption
• Authentication uses secure JWT tokens with appropriate expiration
• OAuth 2.0 with PKCE for third-party integrations
• Regular security assessments and monitoring
• Access controls limiting employee access to user data
While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
6. Data Retention
We retain your information for as long as your account is active or as needed to provide services. When you delete your account:
• Account information is deleted within 30 days
• Cached email data is purged immediately
• Anonymized analytics data may be retained for service improvement
• We may retain information as required by law or for legitimate business purposes (e.g., fraud prevention)
7. Your Rights
Depending on your location, you may have the following rights:
Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
Portability: Request your data in a portable, machine-readable format.
Opt-out: Opt out of certain data processing activities, including marketing communications.
Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
To exercise these rights, contact us at privacy@icebox.cool. We will respond within 30 days.
8. California Privacy Rights (CCPA)
California residents have additional rights under the California Consumer Privacy Act:
• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising privacy rights
To submit a request, email privacy@icebox.cool with "CCPA Request" in the subject line.
9. European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under GDPR including:
• Right of access, rectification, erasure, and data portability
• Right to restrict or object to processing
• Right to lodge a complaint with a supervisory authority
Our legal bases for processing include: contract performance, legitimate interests, consent, and legal obligations.
For data transfers outside the EEA, we use Standard Contractual Clauses approved by the European Commission.
10. Cookies and Tracking
We use cookies and similar technologies to operate our Service:
Essential Cookies: Required for authentication, security, and core functionality.
Analytics Cookies: Help us understand how users interact with our Service.
Preference Cookies: Remember your settings and preferences.
You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.
For more details, see our Cookie Policy.
11. Children's Privacy
Icebox is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.
If you believe we have collected information from a child under 16, please contact us immediately at privacy@icebox.cool and we will delete the information.
12. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.
When we transfer data internationally, we implement appropriate safeguards including Standard Contractual Clauses and ensure adequate protection as required by applicable law.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
• Posting the updated policy on our website
• Sending an email notification to registered users
• Displaying a notice within the application
Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Company: Whitetowers Group LLC (d/b/a Icebox)
Email: privacy@icebox.cool
General Inquiries: hello@icebox.cool
We aim to respond to all inquiries within 30 days.
