MCP to Email

Privacy

Effective 30 October 2026 · MCPTO, the operator of mcpto.email

MCP to Email lets you connect a mailbox, and optionally other Google services, to an AI assistant that speaks MCP. This policy describes what we access, what we store, and who receives it. The same page is linked from the app and from the Google consent screen.

Who we are

The service at mcpto.email is operated by MCPTO. Privacy questions and deletion requests go to mcptoco@gmail.com. Product mail is sent from noreply@mcpto.email and is transactional only: account confirmation, invites, sign-in, and password resets.

What the service does

You sign in to MCP to Email, connect a mailbox, and then connect an MCP client (the AI assistant you choose). When that client calls a tool, our servers use your grant to fetch or change data at Google or at your mail provider, and return the result to that client. We do not operate the assistant’s model.

Google data we request

Connecting Gmail always requests these scopes:

• https://www.googleapis.com/auth/gmail.modify — read mail, change labels, create drafts, send, and move messages to trash. Permanent delete of Gmail messages is not a product feature.
• openid, email, and profile — identify the Google account you connected.

Other services are requested only if you leave them checked on the connect screen, or later turn them on and apply the change:

• Contacts: contacts, contacts.other.readonly, and directory.readonly (Workspace directory lookup; a consumer Gmail account has no directory).
• Calendar: calendar.events, calendar.calendarlist.readonly, and calendar.freebusy.
• Gmail settings: gmail.settings.basic and gmail.settings.sharing (vacation settings, send-as, filters, and forwarding).
• Drive: https://www.googleapis.com/auth/drive. Docs, Sheets, and Slides also need this scope, plus documents, spreadsheets, or presentations.
• Tasks: tasks.
• Meet: meetings.space.created and meetings.space.readonly.

You can uncheck a service before you connect, or disconnect the mailbox later. Google shows the exact scopes on the consent screen.

How we use Google user data

We use Google user data only to provide the mailbox and Google features you turned on, to keep the service secure, and to comply with law. That includes returning tool results to the MCP client you connected.

Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements:

• We do not sell Google user data.
• We do not use it for advertising, and we do not allow humans to use it for advertising.
• We do not use it to train, or to improve, generalized or foundational AI models.
• We do not transfer it to others, except to provide the feature you asked for (the MCP client you connected), for security, to comply with law, or as part of a merger with notice to you.
• We do not allow humans to read Google user data unless you ask us to for support, we need to for security or abuse, we are required to by law, or the data is aggregated and cannot be tied back to you.

We use the data only in the ways this policy describes.

What we store

• Your MCP to Email account: email address, sign-in identity, and account status. Passwords are held by our authentication provider, not in the mailbox record.
• Mailbox metadata: address, provider, connection status, which Google services you enabled, and the scopes Google granted.
• Credentials: Gmail OAuth tokens, and IMAP or SMTP passwords if you connect a non-Gmail mailbox. These live in AWS Secrets Manager, encrypted with AWS KMS. They are not returned to the MCP client.
• MCP personal access tokens: we store a hash. The raw token is shown once when you create it.
• Attachments you upload or download through the app: files in a private AWS S3 bucket, encrypted, and deleted after 48 hours.
• Audit records: action, tool name, account id, a hash of the IP address, and short operational metadata. They do not include message bodies or file contents. They are kept for 18 months.

We do not keep a separate copy of your mailbox or Drive. Message and file contents are fetched when a tool runs and are returned in that response. The MCP client you connected then holds whatever it chooses to keep. Read that client’s privacy policy before you connect it.

Who else processes data

• Google, when we call Gmail, Drive, Docs, Sheets, Slides, Calendar, People, Tasks, or Meet on your behalf.
• Amazon Web Services, in us-west-2, for the application, database, secrets, attachment storage, and transactional email.
• The MCP client you configure. Tool results can include email, contacts, calendar events, and file contents. That transfer is what the connection is for.

Other mailboxes

If you connect IMAP and SMTP instead of Gmail, we store those credentials the same way and use them only to perform the mail actions you request through the service. This Google policy section does not apply to that mailbox. The rest of this policy does.

Security

The site is served over HTTPS. Secrets are encrypted with a customer-managed key. The database is encrypted with a customer-managed key. Attachment storage is encrypted, not public, and rejects non-HTTPS access. Access to production systems is limited to the people who operate the service.

How long we keep it, and how to delete it

Disconnecting a mailbox in the app deletes our record of that connection and the stored credentials. For a Gmail mailbox we also ask Google to revoke the grant. If Google does not accept that request, you can revoke MCP to Email at Google Account permissions.

To delete your MCP to Email account, open Profile and choose Delete my account. That deletes the sign-in account, connected mailboxes, stored credentials, personal access tokens, and attachment files we still hold, and asks Google to revoke each connected Gmail grant. We do not keep message contents, files, or mailbox passwords after that. We do keep the account email, when the account was created and deleted, the addresses of mailboxes that were connected, and the usage log (tool names and times, not message contents) for 18 months, so we can show that the service was used if a card payment is disputed. When the service charges a card, the billing identity for that charge is kept with the same record. The last owner of the service cannot delete that account from the app. Email mcptoco@gmail.com from the address on the account if you cannot use the button.

Children

The service is not directed at children under 13, and we do not knowingly collect their information.

Changes

If we change this policy, we will update this page and the effective date. If a change materially expands how we use Google user data, we will ask you to reconnect before we rely on that change.