Privacy Policy
Last updated October 13, 2026
Courtside works inside your Gmail, so we hold some of the most personal data there is. This policy explains, in plain language, exactly what we collect, why, who else touches it, how long we keep it, and how you stay in control. The short version: we use your email only to provide Courtside to you, we never sell it, never use it for advertising, and never use it to train AI models.
1. Who we are
Courtside ("Courtside", "we", "us") is operated by the founder of Courtside, a sole proprietor based in India. For the purposes of data protection law, we are the controller (GDPR) and the Data Fiduciary (India's Digital Personal Data Protection Act, 2023) for the personal data described here.
Contact for anything in this policy, including requests and complaints: support@courtsidepay.com. Grievances go to our Grievance Officer, Courtside, at the same address.
2. What we collect
| Data | What exactly | Where it comes from |
|---|---|---|
| Account | Your Google account ID, name, email address and profile picture URL. | Google sign-in |
| Gmail access | OAuth access and refresh tokens, encrypted with AES-256-GCM. They let Courtside read, label, draft and send in your Gmail. | Google sign-in |
| Email metadata | For emails Courtside sorts: sender, subject, a short snippet, date, thread ID, category, priority, a one-line AI summary, action items and any deadline. | Your Gmail |
| Email content | Read from Gmail when needed (to sort, draft or show an email) and not stored. Drafts Courtside writes, and your edits to them, are stored so drafts can learn your style. | Your Gmail, you |
| Follow-ups and invoices | For emails you sent that ask a question or for payment, and invoices a tool like Stripe or Zoho sent for you: recipient, subject, snippet, date, invoice amount and any part payments. For invoices you add yourself: client email and name, invoice number, amount, due date and payment link. | Your Gmail, you |
| Preferences | Settings, writing-style choices, a short style summary learned from your sent mail (if you turn that on), filing rules and your clients list. | You, your Gmail |
| Promises | Commitments you made in emails you sent (for example "Send the quote", due Friday), with the recipient and subject, so they show up as your to-dos. | Your Gmail |
| Usage | A daily count of AI drafts and sorted emails, for plan limits and the usage chart. | Courtside |
| Billing | Your plan, subscription status and renewal date, and the customer and subscription IDs from our payment provider. We never see or store card, UPI or bank details. | Dodo Payments |
| Technical | Error reports (message, page, code location) and server logs, which can include your account ID and IP address. | Your browser, our servers |
Attachments you add to a reply are passed straight to Gmail when you send and are never stored by Courtside. We don't collect your contacts list, calendar, location or any data from other apps.
3. Google user data and the Limited Use policy
Courtside asks Google for your basic profile (name, email, picture) and one Gmail permission, gmail.modify. It lets Courtside read your email (to sort it, find invoices you've sent and notice replies and payments), add labels, create drafts and send the replies and reminders you approve (and, if you turn it on, invoice reminders by themselves after a 24-hour hold). It cannot permanently delete email. You can remove this access at any time in your Google account, and deleting your Courtside account hands it back to Google.
Courtside's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, that means:
- We use Gmail data only to provide and improve the features you see in Courtside.
- We don't use it for advertising, and we don't sell it or give it to data brokers.
- We don't use it to train or improve general AI or machine-learning models, ours or anyone else's. It is sent to an AI service only to produce your own sorting and drafts (see section 5).
- No person at Courtside reads your email, except with your explicit permission for a specific support request, when required for security (for example, investigating abuse), or when required by law.
4. How we use your data, and our legal basis
| Purpose | Legal basis (GDPR) / ground (DPDP) |
|---|---|
| Sorting, summarising and labelling your email; drafting replies and follow-ups you ask for | Performing our contract with you / your consent |
| Tracking replies you're waiting on and unpaid invoices | Performing our contract / your consent |
| The morning briefing email to your own inbox | Performing our contract (on by default; turn it off in Settings any time) |
| Learning your writing style from sent mail | Performing our contract / legitimate interests (on by default; turn off "Also match how I write" any time) |
| Billing, plan limits and preventing repeat free trials | Performing our contract / legitimate interests |
| Security, fraud and abuse prevention, error fixing | Legitimate interests / legal obligation |
| Complying with law, tax and accounting rules | Legal obligation |
Where we rely on consent, you can withdraw it at any time in Settings or by deleting your account, as easily as you gave it. Withdrawing doesn't affect processing that happened before. Where we rely on legitimate interests, you can object (section 10).
We do not use your data for advertising, profiling for marketing, or selling to anyone.
5. AI processing
To sort an email or write a draft, the relevant email text (and, for sorting, the names and descriptions of any categories you created; for drafts, a few earlier messages in the thread and short summaries of recent emails with that person) is sent to an AI model run by Cloudflare Workers AI. The models are open models (currently OpenAI's gpt-oss-120b, with Meta's Llama 3.3 as a fallback) hosted by Cloudflare. Cloudflare processes this only to return the result to us and does not use it to train models. Obvious newsletters, receipts and senders you've filed before are sorted without AI at all.
Automated processing. Sorting and drafting are automated, but they don't produce decisions with legal or similarly significant effects on you: no email goes to anyone unless you press Send or turn on automatic invoice reminders, each of which waits a day for you to edit or stop it, and you can move any email to another category, which Courtside then learns from.
7. International transfers
We're based in India, and our providers process data in India, the United States and other countries. When personal data from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on our providers' Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework where they're certified. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies.
8. How long we keep it
| Data | Kept for |
|---|---|
| Email metadata for finished (archived or replied) emails | 30 days |
| All other email metadata | 90 days |
| Discarded drafts | 7 days |
| Other drafts and your edits | 90 days |
| Follow-ups | Until answered or dismissed, then 30 days (at most 180 days in all) |
| Invoices you sent (who to, amount, due date, when paid) | While unpaid (at most 180 days), then 12 months after payment for your money report |
| Your own categories (name, description, senders you list) | Until you delete them or your account |
| Invoicing tool keys | Until you disconnect the tool or delete your account; disconnecting also removes its open invoices |
| Promises | Until done or removed, then 30 days (at most 180 days in all) |
| Daily usage counts | 60 days |
| IDs of emails the 90-day invoice scan has read (no content) | Up to 120 days, so a repeat scan doesn't count anything twice |
| Account, settings, rules, clients, billing references | Until you delete your account |
| Server logs and error reports | Up to 7 days (Cloudflare Workers Logs) |
| A one-way, keyed fingerprint (HMAC-SHA-256) of your email address | After account deletion, to stop repeat free trials. It isn't linked to anything else and can't be reversed or matched without our secret key. |
| Payment and tax records | Held by Dodo Payments as merchant of record, for as long as tax and accounting law requires |
When you delete your account (Settings → Account → Delete account and data), we revoke Courtside's access to your Google account and immediately and permanently delete everything above except the fingerprint. The only copies left are server logs, which expire within 7 days, and encrypted database backups held by Cloudflare, which roll off within 30 days. Labels and drafts Courtside created in your Gmail stay in Gmail until you remove them.
9. How we protect it
- All traffic uses HTTPS (TLS). Google tokens are encrypted at rest with AES-256-GCM.
- Sign-in uses Google OAuth with PKCE. Sessions are signed, HttpOnly cookies, and signing out ends every session on every device.
- Email content isn't stored. Email HTML is shown in a sandbox with scripts disabled and remote images (tracking pixels) blocked until you allow them.
- Outgoing email is checked so it can't be altered to add hidden recipients, and nothing is sent unless you press Send or switch on automatic invoice reminders (off by default).
- Access to production systems is limited to the operator, protected by multi-factor authentication.
10. Your rights and how to use them
Wherever you live, you can:
- Get a copy of your data in a machine-readable file: Settings → Account → Download my data.
- Delete everything: Settings → Account → Delete account and data. This also revokes our Google access. You can revoke it yourself at myaccount.google.com/permissions.
- Correct your data (most of it lives in Gmail; settings, rules and clients are editable in Settings), withdraw consent, object to or restrict processing, by emailing support@courtsidepay.com.
European Economic Area, UK and Switzerland
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can also complain to your local data protection authority (in the UK, the ICO). We reply within one month.
India
Under the DPDP Act you can request a summary of your data and the processing, correction, completion, updating and erasure, withdraw consent, and nominate another person to exercise your rights if you die or become incapacitated (email us with their details). For grievances, contact our grievance officer first; we respond within 90 days, and you may then complain to the Data Protection Board of India.
United States (California and other states)
You can request to know, access, correct and delete your personal information, and you won't be treated differently for exercising these rights. We don't sell or share personal information, so there is nothing to opt out of. You may use an authorised agent; we may verify your request via your Google sign-in. We reply within 45 days.
We may need to confirm it's you before acting on a request, usually by asking you to send it from the email address on your account.
12. Children
Courtside is for adults using email for work. You must be at least 18 to use it, and we don't knowingly collect data from anyone younger. If you believe a child has used Courtside, contact us and we'll delete the account.
13. If something goes wrong
If a personal data breach affects you, we'll tell you without undue delay, with what happened, what data was involved, what we've done and what you can do. We'll also notify regulators where the law requires it, including the Data Protection Board of India and, for EU/UK users, the relevant authority within 72 hours.
14. Changes to this policy
We'll update the date at the top for any change. For material changes, such as a new type of data, a new purpose or a new provider that sees your email, we'll email you at least 14 days before they take effect, and ask for your consent again where the law requires it.
15. Contact
Questions, requests or complaints: support@courtsidepay.com. Grievance Officer, Courtside, same address. Operator: the founder of Courtside, a sole proprietor based in India.