Desktop application
Outgoing message data is written to a local per-user queue and displayed for review. When you confirm Send, the app sends the message directly to the Gmail API. SendArc does not operate a relay and does not request inbox-reading permission.
OAuth tokens are stored in Windows Credential Manager. Local logs are designed to exclude message bodies, recipient addresses, attachment contents, and tokens.
SendArc’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, used for advertising, or used to train general-purpose AI models.
Business Beta data
The website form stores work email, company, seat range, current workflow, an optional note, coarse campaign labels and submission timestamps in Cloudflare D1. Do not submit message content, recipients, credentials, or confidential attachments. Data is used only to evaluate and contact beta participants. Records expire 12 months after the latest form submission, or earlier on a verified deletion request.
Minimal website events
Cloudflare Pages and Pages Functions host the product site. Our first-party events contain an allowlisted event name, a known public page path, a referrer hostname and coarse campaign labels. They do not include full referrer URLs, arbitrary URL parameters, message data, cookies or visitor identifiers. Event records expire after 90 days. A beta-submission event is recorded only when the form is successfully saved.
For rate limiting, a separate table stores a secret-keyed hash derived from the connecting IP, endpoint and current hour. This value changes each hour, is not included in events or lead records, and expires after 24 hours measured from its hourly window. Raw IP addresses and user-agent strings are not copied into these tables.
Deletion and service providers
A scheduled maintenance task removes expired records every 15 minutes, including when nobody visits the site. Deletion can be delayed by a service outage. Cloudflare’s recovery history may retain deleted data for up to seven further days on the current free plan; it is not used for marketing or routine analytics.
Cloudflare processes normal website delivery and security metadata under its own policies. Google provides OAuth and Gmail delivery. GitHub hosts source code, releases, support issues and the KaPaPi brand site. The product site uses locally hosted fonts; the KaPaPi brand pages load fonts from Google Fonts. These providers may process ordinary request metadata when you use their services.
Your choices
Ask to access or delete a beta record by emailing maxtop9843@gmail.com from the submitted address. The operator is 장형진.