Privacy Policy

Last updated: September 29, 2026

This Privacy Policy describes how Ziftwo handles personal information. Ziftwo is operated by ZJ van de Weg, an individual based in Danville, California, USA ("Ziftwo", "we", "us" or "our"). It covers the Ziftwo website and web application at ziftwo.com, the emails Ziftwo sends, and the connection between Ziftwo and your Gmail account (together, the "Service").

Ziftwo holds email from unknown senders out of a user's Gmail inbox until the sender buys a stamp. That means we handle information about two groups of people: users, who sign in to Ziftwo to protect their own inbox or who buy stamps, and senders, who email a Ziftwo user without having an account. This policy covers both.

Personal information we collect

When you sign in with Google. We receive your Google account identifier and email address, and whether Google has verified that email address. We use these to create and identify your Ziftwo account. We also store your stamp balance and whether your account has been approved to connect Gmail.

When you connect Gmail. If you choose to protect your inbox, you give Ziftwo access to your Gmail and Google Contacts. See How we use Google user data below for exactly what we access and why.

When you request access. The email address you enter and any note you add.

When you pay from a stamp request. The link in a stamp request identifies the address it was sent to, so you can pay without signing in. We create an account for that email address to hold your stamps, which you can later take over by signing in with Google using the same address.

When you buy stamps. Payments are handled by Stripe. We never see or store your full card details. We store your Stripe customer identifier, and for each purchase the Stripe checkout session identifier, the amount paid, the number of stamps, and which Ziftwo inbox the purchase was for.

When you email a Ziftwo user (senders). When a message from you reaches a Ziftwo user's inbox, we process your email address and the message's headers (such as the subject line, date and message identifiers) to decide whether you're someone that user already knows. If you're not, we store your email address together with identifiers of the Gmail thread, and send you one email from Ziftwo's own address, on that user's behalf, explaining how to get your message delivered. We only send it if Google has verified that your message really comes from your domain. We don't store the content of your message.

Activity records. We keep a log of what Ziftwo does on each user's behalf: for example that a thread was held, released or expired, or that a sender was emailed. These records include the email addresses and Gmail identifiers involved, and are there so users (and we) can see and check what happened.

Automatically collected data. Our hosting provider may log technical information about requests to the Service, such as IP addresses, browser type and request times, for security and to keep the Service running.

Cookies. We use only the cookies the Service needs to work: one that keeps you signed in (for up to 30 days) and a short-lived one that protects the Google sign-in step (10 minutes). We don't use analytics, advertising or tracking cookies, and we don't use web beacons.

How we use Google user data

Ziftwo requests the following Google permissions, only when you choose to connect Gmail:

Read and modify your Gmail (gmail.modify): to read the headers of incoming messages, search your sent mail, move held threads out of your inbox onto a Ziftwo/Held label and back again, and move unresolved held threads to Trash.
See your contacts (contacts.readonly): to check whether a sender is already one of your Google Contacts.

Specifically, when a message arrives in your inbox, Ziftwo:

reads its headers, including the sender's address and Google's authentication results (which tell us whether a message really comes from the domain it claims);
checks whether you've emailed the sender before, by searching your sent mail for their address;
checks whether the sender is in your Google Contacts, by comparing their address with your contacts' email addresses;
if the sender is unknown, moves the thread to the Ziftwo/Held label, and Ziftwo emails the sender once from its own address. Ziftwo never sends email from your Gmail account.

Ziftwo is also notified when you send a message, so that replying in a held thread delivers it straight away. For those messages it looks only at which thread they belong to.

Ziftwo asks Gmail only for a message's headers, never its body or a preview of it, so the content of your messages never reaches Ziftwo. The results of the sent-mail search and the contacts check are used for the decision and then discarded. We store only what's described in Personal information we collect. Your Google access tokens are stored encrypted, and Gmail notifies Ziftwo of new mail through Google Cloud Pub/Sub. Those notifications contain only your email address and a mailbox change number, and are sent when your inbox or sent mail changes.

Limited Use. Ziftwo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

use Google user data only to provide and improve Ziftwo's user-facing features described in this policy;
don't sell it, and don't use or transfer it for advertising, for credit-worthiness or lending decisions, or to data brokers;
don't use it to develop, improve or train generalized artificial intelligence or machine learning models;
don't allow humans to read it, unless you give us your explicit permission for specific messages, it's necessary for security purposes such as investigating abuse, it's needed to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

You can disconnect Gmail at any time from your Ziftwo account page, which deletes your stored Google tokens and revokes Ziftwo's access with Google. You can also remove Ziftwo's access at myaccount.google.com/permissions.

How we use your personal information

Service delivery. We use your personal information to:

provide and operate the Service: screen incoming mail, hold, release and expire threads, email held senders as described above, and process stamp purchases;
communicate with you about the Service, including access approvals, security alerts, and support and administrative messages;
provide support for the Service, and respond to your requests, questions and feedback.

Research and development. We may use aggregated, de-identified information, such as how many threads are held or released overall, to understand and improve the Service. De-identified data can't reasonably be used to identify you.

Compliance and protection. We may use your personal information to:

comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
enforce the terms and conditions that govern the Service; and
prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

We don't send marketing emails, and we don't sell personal information or share it for cross-context behavioral advertising.

We share personal information only with the following parties, and only as needed for the purposes in this policy.

Service providers. Companies that run parts of the Service for us:

Fly.io, which hosts the Service and its database in the United States;
Google, for sign-in, the Gmail and People APIs, and Cloud Pub/Sub notifications;
Stripe, which processes stamp payments under its own privacy policy;
Cloudflare, which provides DNS for ziftwo.com and delivers the emails Ziftwo sends from its own address;
Sentry, which receives reports of errors in the Service so we notice when something breaks, and stores them in the United States. Reports describe the error, not you: we remove email addresses from them before they're sent, and they never include email content or Google data.

The people you email, and who email you. Using the Service involves the other party by design. A held sender receives an email from Ziftwo that names the receiving user's email address, and a sender's address appears on the receiving user's dashboard. When a sender pays, the receiving user can see that a stamp pack was bought to reach them.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquirers and other relevant participants in business transactions (or negotiations and diligence for such transactions) involving a merger, acquisition, sale or other transfer of all or part of Ziftwo. Any successor must keep treating Google user data as this policy describes.

How long we keep it

Google access tokens are deleted as soon as you disconnect Gmail.
Your account, held-thread records and activity records are kept while your account exists, and deleted when you ask us to delete your account.
Access requests are kept while your request or account is open, and deleted on request.
Stamp purchase records are kept as long as we need them for accounting, tax and legal purposes, even after an account is deleted.
Technical logs kept by our hosting provider are kept for a limited period for security and operations.
Error reports sent to Sentry are deleted after 30 days.

Your choices and rights

Disconnect Gmail. Disconnect at any time from your account page, as described in How we use Google user data.

Access, correction, deletion and export. You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it, by contacting us. This includes senders who don't have an account: we can tell you which Ziftwo records contain your email address, and delete them. We may need to verify your identity first, and we may keep information where the law requires us to.

California residents. You have the right to know what personal information we collect, use and disclose; to request deletion or correction of it; and not to be discriminated against for exercising these rights. We don't sell your personal information or share it for cross-context behavioral advertising.

Residents of the European Economic Area and the United Kingdom. You also have the right to object to or restrict our processing of your personal information, to data portability, and to lodge a complaint with your local data protection authority. We process users' information to perform our agreement with them. We process senders' information because of our users' legitimate interest in managing unsolicited email, which we balance against senders' interests by storing only an address and message identifiers, and deleting them on request.

Cookies. Most browser settings let you delete and reject cookies placed by websites. Because we use only essential cookies, you won't be able to sign in if you block them.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We don't track you across other sites, so these signals don't change anything on the Service.

Declining to provide information. We need certain personal information to provide the Service. For example, we can't screen your inbox without Gmail access, or process a stamp purchase without the details Stripe needs.

Other sites and services

The Service may contain links to websites and online services operated by third parties, such as Stripe's checkout pages. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. We encourage you to read their privacy policies.

Security

We employ technical and organizational safeguards designed to protect the personal information we collect. For example, Google access tokens are encrypted at rest, all connections to the Service use HTTPS, and we store a secure hash of each session rather than the session itself. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

International data transfer

Ziftwo is operated from the United States, and the Service and its data are hosted in the United States. If you use the Service from elsewhere, your personal information will be transferred to the United States, where privacy laws may not be as protective as those in your state, province, or country.

Children

The Service is not intended for use by children under 16 years of age. If we learn that we have collected personal information through the Service from a child under 16 without the consent of the child's parent or guardian as required by law, we will delete it. We encourage parents or guardians with concerns to contact us.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. If required by law we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). We won't use Google user data in new ways without first asking for your consent.

How to contact us

Email: zj@ziftwo.com
Operator: ZJ van de Weg, Danville, California, USA