Your certificate data stays on your device.

MailMyCertificate is developed by Akshat Thakur and follows a local-first architecture. Certificate templates, participant data, generated PDFs, and workflow progress are processed directly inside your browser whenever possible.

Unlike many traditional SaaS tools, MailMyCertificate is intentionally designed to reduce dependency on external cloud storage for core certificate generation workflows.

Complete Local Processing

• Certificate templates are stored locally inside your browser storage.
• CSV and Google Sheets imports are processed 100% on the client side.
• PDF generation occurs exclusively within your browser using client-side processing.
• Generated certificates remain on your device until you manually send them.
• All data is deleted immediately when your browser tab closes.

What We Do Not Do

• We never upload participant data to external servers.
• We never permanently store certificate generation logs.
• We never access or cache your Google Sheets or Gmail after the immediate operation.
• We never use Workspace API data for any analytics or secondary purposes.

MailMyCertificate does not intentionally collect or sell participant information.

Some limited technical information may be collected automatically for operational and security purposes, including:

• Browser type and version
• Device information
• Error logs and crash diagnostics
• Basic anonymous usage analytics

Any monitoring or diagnostics services used by the platform are configured to avoid intentionally storing Personally Identifiable Information (PII) wherever reasonably possible.

MailMyCertificate may store temporary workflow data locally inside your browser using technologies such as IndexedDB or Local Storage.

This may include:

• Uploaded certificate templates
• Participant lists
• Generated certificate references
• Workflow progress and session recovery data

This local data exists only on your device and can typically be removed by clearing your browser storage.

MailMyCertificate uses the following Google APIs to deliver its core functionality.

Gmail API (gmail.send scope)

• Purpose: Send personalized certificates directly through your Gmail account to event participants.
• Data Accessed: Only recipient email addresses and certificate content.
• Data Handling: Emails are sent through your Gmail account only; MailMyCertificate does not store, read, or retain emails, inbox data, or any Gmail account information.
• No Inbox Access: This application never reads, modifies, or stores any existing emails in your Gmail inbox.

Google Sheets Import (Public CSV Export — No OAuth Scope Required)

• How it works: When you paste a Google Sheets link, MailMyCertificate fetches the publicly shared sheet using Google's standard CSV export URL. No OAuth token or API scope is used for this operation.
• Requirement: The sheet must be set to "Anyone with the link can view" by you before import. We never access private or non-shared sheets.
• Data Handling: Sheet data is fetched once, processed entirely on your device, and never stored on MailMyCertificate servers.
• No Authentication Required: This feature does not request any Google Sheets API scope and does not access your Google account.

MailMyCertificate may use third-party hosting and infrastructure providers such as Vercel for website delivery, uptime, analytics, and security.

These providers may temporarily process technical request information such as IP addresses, browser metadata, and performance logs as part of normal web infrastructure operations.

However, participant certificate data is not intended to be permanently stored on these infrastructure services.

MailMyCertificate implements multiple layers of security to protect your data during the certificate generation and email delivery workflow.

Transport Security

• HTTPS only: All communication between your browser and our servers is encrypted using TLS (HTTPS). Unencrypted HTTP connections are not accepted.
• OAuth tokens in transit: Google OAuth tokens (access and refresh) are transmitted exclusively over encrypted HTTPS connections and are never exposed in URLs or client-side storage.

Session & Credential Security

• HttpOnly session cookies: OAuth credentials are stored in server-side sessions accessed only via HttpOnly, Secure, SameSite cookies — never accessible to client-side JavaScript.
• Session-scoped credentials: Google OAuth tokens are held only for the duration of your active session (maximum 1 hour) and are not written to any persistent database or file system.
• CSRF protection: All state-changing operations (sending emails, logout) are protected by cryptographic CSRF tokens validated on the server.
• OAuth state validation: The OAuth callback verifies a server-generated state parameter to prevent cross-site request forgery during login.

Access Controls

• Minimal scope principle: We request only gmail.send — the narrowest Gmail scope available. We cannot read, modify, or delete anything in your mailbox.
• No persistent storage: OAuth credentials are never stored in databases, log files, or any system that outlives your browser session.
• Production hardening: Debug endpoints and verbose error messages are disabled in production. Internal errors are sanitized before being returned to clients.

MailMyCertificate does not sell, rent, trade, or otherwise disclose Google user data to any third party except as strictly necessary to provide the service (e.g., transmitting your email through Google's own Gmail API on your behalf).

We explicitly do NOT use Google user data for:

• Advertising: No targeted, personalized, retargeted, or interest-based advertising of any kind.
• Data brokering or resale: We never sell or transfer user data to data brokers, information resellers, or any party for commercial gain.
• Credit or lending decisions: User data is never used to determine creditworthiness or for lending purposes.
• Unrelated databases: We never combine or build datasets unrelated to MailMyCertificate's user-facing certificate generation and delivery features.
• AI/ML model training: Google user data is never used to train, improve, or develop generalized or non-personalized artificial intelligence or machine learning models.
• Surveillance or tracking: We do not use Google user data for profiling, monitoring, or tracking individuals beyond what is needed to deliver the certificate email they requested.

Summary: Google user data obtained by MailMyCertificate is used solely to send certificate emails on your behalf. It is not transferred, disclosed, or repurposed for any other objective.

MailMyCertificate uses Google Tag Manager (GTM) and Google Analytics (GA4) to track anonymous usage metrics and improve the platform.

Critical: Workspace Data Exclusion

GUARANTEED: No data accessed from Google Workspace APIs (Gmail, Google Sheets, participant information, certificate content, or email addresses) is ever sent to Google Analytics, Google Tag Manager, or any third-party analytics service.

Analytics data collected is limited to:

• Anonymous visitor ID (locally generated, never linked to email or identity)
• Page path and navigation flow (no personal data)
• Feature usage (e.g., "template_uploaded", "certificate_generated") with aggregate counts only
• Browser type and device category (non-identifying)
• Error events (no PII or sensitive data included)

Participant rosters, certificate content, email addresses, and all data accessed from Workspace APIs are processed locally in your browser and never transmitted to analytics services.

Your data is handled with the highest level of transience and minimal retention.

• Certificate Generation: All PDF generation occurs exclusively in your browser.
• Participant Data: Your participant lists are never transmitted to or stored on MailMyCertificate servers.
• Session Deletion: When you close your browser tab, all temporary workflow data is automatically deleted from local browser storage.
• No Server Logs: Participant data and certificate content are not logged on MailMyCertificate infrastructure.
• Email Content: Certificate emails are sent through your Gmail account; MailMyCertificate retains no copy of sent emails or their recipients.

Requesting Data Deletion

Because MailMyCertificate does not store participant data or certificate content on its servers, there is typically nothing to delete. However, if you believe any personal data has been retained or you wish to revoke your Google OAuth authorization, you may:

• Revoke access: Visit your Google Account Permissions page and remove MailMyCertificate.
• Clear local data: Clear your browser's site data for mailmycertificate.tech, or use the "Clear Data" option in the app's Settings page.
• Contact us: Email akshatthakur22@gmail.com or use our Contact page if you have any data deletion concerns. We will respond within 7 days.

MailMyCertificate is an open-source project.

Transparency is important for tools that process participant information and certificate workflows. Users may inspect the public source code repository to better understand how the application works.

This Privacy Policy may be updated from time to time to reflect technical improvements, legal requirements, or workflow changes.

Material privacy-related changes will be reflected on this page.