Skip to content
Outflare
Sign up

Legal

Privacy policy

Last updated 25 October 2026.

Who we are

Outflare is open-source software for running cold email and go-to-market work, used by people and their AI agents. This policy covers the website at outflare.ai and the hosted app at app.outflare.ai (together, "Outflare", "we", "us"). Questions about it go to[email protected].

If you run Outflare on your own server, your data stays on that server and we never see it. The only thing a self-hosted server sends us is the anonymous daily report, which contains no personal data and can be turned off.

Information we collect

  • Account information: your name, email address, a hashed password or a passkey, and the workspaces you belong to.
  • Information you add: mailboxes you connect (with their passwords or OAuth tokens, encrypted at rest), domains, leads and their contact details, sequences, the emails you send and the replies you receive, lists, projects and settings.
  • Google user data: only when you choose to connect a Google account, as described in full in the next section.
  • Data from other tools you connect: for example analytics, calendars, CRMs or mailbox suppliers, read with the access you grant.
  • Usage and device data: sign-in times, IP address, browser, the pages of the app you use and the actions you take, and a daily count of what each workspace used.
  • Messages to us: what you send to [email protected] or through a request-access form.

Google user data

Outflare only accesses Google user data when you click a "Continue with Google" or "Connect with Google" button and approve Google's consent screen. Each feature asks only for the access it needs.

What we access

  • Sign in with Google (openid, email, profile): your Google account ID, email address, name and profile picture.
  • Gmail mailboxes (https://mail.google.com/): access to the mailbox you connect, used over Gmail's SMTP and IMAP. We send the emails in your sequences (and warm-up emails, if you turn warm-up on) from it, and read new mail arriving in its inbox from the day before you connect it onward, so replies, bounces and out-of-office messages appear in your Outflare inbox. Older mail is not imported.
  • Google Analytics (analytics.readonly): the list of your Analytics properties and read-only reports on them, such as visitors, pages, traffic sources and events.
  • Google Search Console (webmasters.readonly): the list of your verified sites and read-only search performance, such as queries, clicks, impressions and positions.
  • Google Calendar (calendar.events.readonly): event titles, times and attendee email addresses, so meetings booked with your leads can be counted.

How we use it

  • Sign-in data identifies you and links your Google account to your Outflare account.
  • Gmail access sends the emails you schedule, keeps them in the same thread, and brings new inbox mail into your Outflare inbox so you can answer it there and sequences stop when someone replies.
  • Analytics and Search Console data is shown in your workspace's reports and compared across tools, and is available to you and the AI agents you connect to your workspace.
  • Calendar data is matched against your leads to report meetings booked and cost per meeting.

We use Google user data only to provide and improve these user-facing features. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models. Outflare's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

How we store and protect it

Google user data is stored in our database hosted by Railway in the United States. OAuth tokens are encrypted at rest with a key held only by the service, all traffic is encrypted in transit, and access to production systems is limited to the people who run the service. People at Outflare do not read your Google data unless you ask us to for support, it is needed to investigate abuse or a security issue, or the law requires it.

How we share it

We do not share, transfer or disclose Google user data to third parties, except to the infrastructure providers listed below that host and run the service for us under contract, when you direct us to (for example by connecting an AI agent to your workspace), or when required by law. It is never shared with advertisers or data brokers.

Retention and deletion

  • Tokens are kept until you disconnect the account in Outflare or revoke access in your Google account permissions, and are deleted when you do.
  • Emails sent through a Gmail mailbox and inbox mail read from it are kept as part of your workspace until you delete them, the mailbox or the workspace.
  • Analytics, Search Console and Calendar data is kept as history for your reports until you disconnect the tool or delete the workspace.
  • When you delete a workspace or close your account, its data, including Google user data, is deleted within 30 days. Encrypted backups roll off within a further 30 days.

To ask us to delete your Google user data at any time, email [email protected].

How we use information

We use the information above to provide the service you asked for: to sign you in, send and receive the email you set up, run your sequences, show your reports, keep the service secure and prevent abuse, understand how the product is used so we can improve it, and contact you about your account. We do not sell personal data.

Who we share it with

  • Railway hosts the app and its database in the United States.
  • Cloudflare hosts this website and our DNS, and sends account emails such as confirmations and password resets.
  • PostHog records how the app and this website are used (see below).
  • Google Analytics may measure visits to this website (see below).
  • Providers you connect, such as Google, Microsoft, a mailbox supplier or a data provider, receive what's needed for the action you take, under their own terms.

We may also disclose information if the law requires it, or to protect people and the service from fraud or abuse.

Cookies and analytics

  • This website measures visits with PostHog in cookieless mode, and may use Google Analytics through Google Tag Manager with Google's consent mode (no analytics cookies in the EEA, UK and Switzerland) and Cloudflare Web Analytics, which sets no cookies.
  • The app uses a session cookie to keep you signed in, and PostHog to understand which features are used. Text on the page, form inputs and element attributes are masked, and URLs are reduced to the page name, so the content of your workspace is not sent.

International transfers

We and our providers process data in the United States and other countries. Where the law requires, transfers are covered by the providers' standard contractual clauses.

Children

Outflare is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.

Your rights

You can see and change most of your data in the app, export it through the API, and delete mailboxes, workspaces or your account. You can also ask us to access, correct, export or delete your personal data, or object to how we use it: email [email protected] and we'll reply within 30 days. You may also complain to your local privacy regulator.

Security

Traffic is encrypted in transit, credentials and tokens are encrypted at rest, and access is limited to the people who run the service. To report a vulnerability, see our security policy.

Changes

If this policy changes in a way that matters, we'll update the date above and tell account holders by email before it takes effect.

Contact

[email protected]