Novel · Privacy
How verification mail is handled.
Novel is owner-operated desktop software. Its optional Gmail connection helps the local session worker finish account registrations that the operator has approved for an exact target.
Access requested
Novel requests Google's gmail.readonly permission. Google describes this permission as access to view email messages and settings across the authorized mailbox. The permission itself is not limited to Novel aliases. Novel's worker searches for mail to the exact generated alias, checks the original recipient and issue time, and reads candidate message headers and bodies to extract a verification code or link.
How the data is used
The worker uses a matched code or link in an isolated browser to complete an operator-approved registration. Session MCP responses provide status and mediated browser actions; they do not include raw verification mail, codes, OAuth tokens, or target credentials. Novel does not use Gmail data for advertising or sell it.
Where data is kept
Cloudflare Email Routing forwards alias mail to the operator's Gmail mailbox. Google retains those messages under the mailbox's settings. Novel keeps the Gmail OAuth refresh token and client configuration in the local macOS Keychain. The local, owner-only session vault encrypts target credentials and registration metadata. Session cookies and browser storage are held in the owner-only vault file, but are not individually encrypted. Novel does not create a separate archive of Gmail messages.
Retention and control
The current desktop build does not automatically delete historical local session records. Revoking Novel in Google Account's connected-app settings stops future Gmail access but does not erase records already held locally. The operator can request help removing local Novel data through the contact address below.
Other services and contact
Cloudflare routes the incoming email, Google supplies the mailbox and Gmail API, and an approved target site receives its registration details and verification response. This informational site has no sign-in form, analytics script, or tracking cookie. For privacy questions or deletion help, email privacy@noventiq.dev.