Privacy policy

Categories of personal data we collect

We store the following when you use the service:

• Account identifiers — Cooper account id and created time.
• API key hashes — SHA-256 of coop_live_ keys, plus key id, name, prefix, created time, and last-used time. The plaintext key is shown once and is not stored.
• OAuth tokens and client ids — OAuth client_id, redirect URIs, hashed client secret if one was issued, hashed authorization codes, hashed access tokens (coop_at_), hashed refresh tokens, scope, resource URL, and expiry. Plaintext tokens are not stored.
• Inbox addresses — username, full email (username@cooperemail.com), optional display name, inbox id, created time.
• Message content and metadata — From, To, Cc, Bcc, Reply-To, Subject, text body, HTML body, extracted_text / extracted_html (quoted history stripped), preview, In-Reply-To, References, labels, direction, status, thread id, client_id, created time, and which sending path was used (cloudflare, resend, or inbound). Attachment files plus filename, content type, size, content_id, and disposition.
• Internal mail headers — RFC822 headers (including Message-ID) are stored so inbound identity and threading work. They are not returned on the API or MCP tools.
• Webhooks — callback URL, event names, and a signing secret.
• IP and request logs — Cooper does not write client IP addresses into the mail database. Vercel (hosting) and Cloudflare (email and workers) may record IP, User-Agent, URL, and status in their own operational logs for abuse prevention and reliability.

Purposes of use

• Email API and MCP — create inboxes, send and receive mail, list and search messages, and register webhooks from ChatGPT, Claude, Cursor, or HTTP clients.
• Authentication — verify API keys and OAuth access tokens; record last-used time on keys.
• Deliver mail — send outbound Internet mail and accept inbound Internet mail for your inbox.
• Search — index subject, extracted_text, and addresses so tools can find messages.
• Abuse prevention and operations — keep the service running, debug delivery failures internally, and stop abuse. Operator access is limited to running the service.

Categories of recipients

We share data with the processors the code actually uses, only to operate Cooper Email:

• Vercel — hosts the website and API (cooperemail.com).
• Turso / libSQL — production database for accounts, hashed keys, OAuth records, inboxes, messages, attachments, and webhooks.
• Cloudflare Email Routing — receives inbound Internet mail for *@cooperemail.com.
• Cloudflare Workers — the cooper-inbound-email Worker forwards inbound mail to Cooper.
• Cloudflare Email Sending — default outbound send path.
• Resend — outbound fallback when Cloudflare Email Sending is unavailable or when the operator sets Cooper to send via Resend.
• Webhook URLs you register — Cooper POSTs message.received / message.sent events (sanitized message fields, not raw headers or provider ids) to the HTTPS URL you provide.
• OpenAI, Anthropic, Cursor, or other clients you connect — receive only the tool inputs you supply and the minimized tool outputs described below, after you connect the plugin or paste an API key.

We do not sell personal data. We do not use mailbox contents for advertising.

Retention

• Messages, attachments, inboxes, webhooks, and API key hashes — kept until you ask us to delete the account, or until we delete an inbox at your request.
• OAuth access tokens — hashed tokens expire after 30 days. Refresh replaces the previous hashed pair. Authorization codes expire after 10 minutes.
• OAuth client registrations — kept while the connector remains registered.
• Platform logs — Vercel and Cloudflare keep operational logs for their own short platform-defined periods. Cooper does not keep a separate IP table.

Your controls

• Delete — email ops@avatar33.com and we will delete your account, inboxes, messages, attachments, keys, tokens, and webhooks.
• Rotate API keys — POST /api/v1/keys with your current Bearer key issues a new key. Email us to revoke an old key hash.
• Revoke OAuth — disconnect Cooper in ChatGPT / Claude / Cursor, and email us to delete stored hashed tokens and the client registration.

MCP / API tool inputs and outputs

The hosted MCP at /mcp uses these tools. Tools do not request chat history, raw transcripts, location, or extra profile fields. Responses omit diagnostic fields (session / trace / request ids, stacks, raw provider payloads, RFC822 headers, delivery flags, and account ids on messages).

cooper_onboard

Input: username, optional display_name. Output: account_id, api_key (once), api_key_id, inbox (id, username, email, display_name, created_at). Write; creates a public address.

cooper_create_inbox

Input: username, optional display_name. Output: the new inbox fields above. Write.

cooper_list_inboxes

Input: none. Output: list of inbox fields above. Read-only.

cooper_send_message

Input: inbox_id, to[], subject, optional text, html, attachments (filename, content_type, content_base64, content_id), client_id. Output: stored message (id, inbox_id, thread_id, direction, status, from, to, cc, bcc, reply_to, subject, text, html, extracted_text, extracted_html, preview, in_reply_to, references, client_id, labels, created_at, provider, optional idempotent, attachment metadata). Write; sends mail on the public Internet.

cooper_list_messages

Input: optional inbox_id, optional limit. Output: summaries (id, inbox_id, thread_id, direction, status, from, to, subject, preview, created_at, labels, attachment filename / type / size). Read-only.

cooper_get_message

Input: inbox_id, message_id. Output: the stored message fields listed under send. Read-only.

cooper_search

Input: q, optional limit. Output: matching summaries plus extracted_text. Read-only.

cooper_inject_inbound

Input: inbox_id, from, optional subject, text, html, attachments, client_id. Output: stored message fields. Write (test injector).

cooper_register_webhook

Input: url, optional events. Output: id, url, events, secret, created_at. Write.

The HTTP API at /api/v1 returns the same public message and inbox fields. It does not return headers, provider_id, delivery, account_id on messages/inboxes, key prefixes, or operator hints.

What we do not do

• We do not sell mailbox contents.
• We do not receive Claude or ChatGPT passwords.
• We do not ask MCP tools for full chat history or raw transcripts.
• We do not return session ids, trace ids, request ids, stack traces, raw provider payloads, or debug blobs in tool or API JSON.

Contact

Questions or deletion requests: ops@avatar33.com. Human docs: /docs · MCP: /docs/mcp.