Privacy policy

N.O.T Privacy Policy

Last updated: 3 October 2026

This policy covers the N.O.T app (the software package is still named rollcall). It is operated by Danny Idelzon. Privacy contact: danncosmic@gmail.com. No postal address is given in this draft.

What N.O.T does

N.O.T reads a mailbox and lists the registrations it can find: paid subscriptions, free accounts, and newsletters. One-off purchases stay off the list unless the message also says an account was created. Each card shows the service name, the kind (subscription, account, or newsletter), the date of the last related email, and a cancel action. An amount and a next renewal date appear only when an email states them.

The built-in fictional mailbox appears only when Gmail is not set up. That demo is not your mail. When Gmail is set up and there is no connection, the Connect Gmail screen is shown, and a saved scan is not returned. A mailbox with no saved scan of its own, and no scan running, stays on Connect Gmail. View demo mailbox opens the demo.

The access you grant

Connecting Gmail requests one permission, Gmail read-only (https://www.googleapis.com/auth/gmail.readonly). N.O.T does not request permission to change your mail, send mail, or read your Google profile. It does not ask for your Gmail address, and it does not store it.

With that access N.O.T:

• Lists messages that match a signup search (subscriptions, receipts, welcomes, unsubscribe, and the Hebrew equivalents), 100 at a time. That call returns message ids, not bodies.
• Opens a matching message and reads the plain-text and HTML parts. HTML is reduced to text, and the text used for parsing is cut at 20,000 characters. It also reads the From, Subject, and Date headers, List-Unsubscribe, and List-Unsubscribe-Post, and collects https links from that text.
• On a lighter pass, reads only the date and the sender domain.

N.O.T does not decode or store attachments. It does not read Gmail labels. A sender address is reduced to the sender's domain. The raw message is not kept as a stored field. It is used in memory to classify the mail and to pick a cancel link, then dropped.

What is saved

There is no N.O.T account and no database.

• A file on the server, data/gmail-scan.json, holds the registration cards and the Gmail message ids used to continue a scan. A card can include the service name, kind, sender domain, last email date, a Gmail message id, and, only when the mail states them, an amount (USD, EUR, GBP, or ILS), a renewal date, and whether Apple or Google Play billed it. A cancel action can include an https or mailto link, where that link came from, and the service's own deletion or unsubscribe address. This file is the store for the mailbox that produced it, not one store for the whole running app and not one store shared by every Google account. Another mailbox is stored in its own file under data/mailboxes and does not read this one.
• An encrypted cookie in your browser, named rollcall_gmail, holds the Google access token and, when Google provides one, a refresh token, plus when the access token expires. The cookie is HttpOnly, lasts 30 days, and is marked Secure only when the app is running in production. Your email address is not in the cookie.
• Your language choice (English or Hebrew) is stored in this browser only, under the key rollcall-lang.

Server logs record a failure code when Gmail rejects a call. They are written so they do not include the token or the message body. A cancel-link repair log can include a domain and a path, not the full link.

N.O.T does not run an analytics service and does not sell personal data. It does not take payment.

Cancel

Cancel does not sign in to the other service and does not finish the cancellation. It opens the right page in a new tab, or prepares an email in your mail app when a real address exists. If a newsletter offers one-click unsubscribe, the card says so, and N.O.T does not send that request. Marking a card canceled only flags that row. The row stays on the list. N.O.T does not contact the other service.

Where the mail says Apple or Google Play billed it, the link is that store's subscription page. Otherwise N.O.T matches the sender domain to a bundled copy of the JustDelete.me catalog. Your mailbox is not sent to JustDelete.me.

Who else processes data

• Google, when you connect Gmail: Google's sign-in, token exchange, and the Gmail API, under Google's terms.
• The site or mailbox you open from a cancel link. That is the other service, Apple, or Google Play. N.O.T does not control what they do next.

No hosting provider is set in the current app. Before a public server is turned on, this policy will name the host here: [hosting provider]. Fonts ship with the app. There is no analytics script.

How long it is kept

The token cookie expires after 30 days. Nothing in the app deletes the scan file on a timer. Disconnect deletes the saved scan for that mailbox and clears the token cookie. It returns to the Connect Gmail screen, not the demo. It does not revoke N.O.T's access at Google. That mailbox's saved scan does not remain on the server after you disconnect. It does not delete another mailbox's saved scan. You can remove N.O.T in your Google account settings. That stops new reads. It does not, by itself, delete a scan already saved on the server.

There is no N.O.T account to delete.

Children

N.O.T is not for anyone under 18. The app does not check age.

Changes

Danny Idelzon will post changes on this page and change the date above.

Contact

danncosmic@gmail.com

No postal address in this draft.