Seed monitor privacy policy
How we handle the information used to monitor our email delivery.
This policy explains how The Cuckoo Camp handles information through Cuckoo Camp seed monitor, our private email placement and sender-reputation monitoring tool. Contact: [email protected].
Accounts and information we access
The app connects only to accounts authorised for monitoring by their owner or an authorised administrator.
For Gmail, it uses the gmail.modify permission. It searches for recent messages from our configured digest sender, including messages in spam and trash, reads message metadata and headers, and may read message text to match a test identifier. It reads labels and creates or changes monitoring labels, marks matched messages as read, removes spam labels when configured, and moves older messages under its monitoring labels to trash.
This permission applies to the whole mailbox and technically permits sending mail. The app’s monitoring workflow targets our test messages; it is not designed to read personal correspondence or send messages using the Gmail API. Please use a dedicated seed mailbox rather than a personal mailbox.
For Google Postmaster Tools, the app requests postmaster.readonly and postmaster.traffic.readonly to retrieve available aggregate sender statistics and compliance information for configured domains the account can access. These permissions do not grant access to Gmail messages.
Other configured seed providers supply equivalent message placement and diagnostic information through their APIs or IMAP. Microsoft SNDS supplies reputation information for our relay IP addresses.
Information we store and why
We store monitoring mailbox addresses, message identifiers and subjects, timestamps, folder or label information, received headers, authentication results, delivering IP addresses, spam verdicts, bounce details and operational errors. Headers and diagnostics can contain email addresses, IP addresses and other information about the delivery path.
We also store domain and IP reputation statistics, compliance results, alert history and operational state. We use this information to diagnose delivery problems, compare sending routes, maintain the service and notify authorised operators.
Message text may be processed to match a test message, but complete received message bodies are not stored as a separate field in the monitoring database. Messages remain in the seed provider’s mailbox until filed or removed through the housekeeping process and the provider’s own deletion policies.
On-demand test content
Where this feature is enabled, an authorised operator may submit a test subject and plain-text or HTML content. We store the submitted subject and body encrypted in the live monitoring database, using the service’s encryption key. We also store the test name, operator identity, content fingerprints, selected routes and seeds, timestamps, dispatch state and outcomes as operational metadata. This does not mean that all diagnostic metadata, mailbox copies or backups use the same encryption.
Creating a preview saves a draft and sends nothing. Explicitly sending a test transfers its content, with monitoring references and unsubscribe information, through the selected sending services to the selected seed mailbox providers. Stored content is visible only to authorised test operators or applications with the separate test-write credential. Other authorised dashboard readers may view report metadata and outcomes without access to the submitted content.
Use synthetic or non-confidential example content. Do not include customer personal information, credentials or unrelated private correspondence. The dashboard shows HTML as escaped source rather than executing scripts or loading remote images; this is not a preview of how every mail client renders a message.
OAuth refresh tokens and mailbox credentials enable ongoing access. Initial credentials are held in the service’s secret configuration. When a provider rotates a refresh token, the app can store its replacement encrypted in the local database. Access tokens are cached in process memory. This token encryption does not mean that all monitoring database contents or backups are encrypted.
Access, sharing and service providers
Monitoring results are available to authorised operators through a protected dashboard and API. Authorised administrators may access monitoring data to investigate delivery or security issues, maintain the service, or respond to a support request.
The app exchanges data with the mailbox and reputation providers needed to perform the monitoring. Cloudflare provides the configured dashboard access and tunnel services and delivers operational email notifications. Notifications contain relevant monitoring results and diagnostics. If push notifications are enabled, the configured push provider also processes their contents. Infrastructure and backup services may process stored monitoring data as part of hosting and recovery. Content-test completion notices contain test identifiers, outcome counts and a private report link, rather than the submitted subject or body.
We do not sell Google user data, use it for advertising, or use it to train general-purpose artificial intelligence or machine-learning models. We do not share it for unrelated purposes. We may disclose information where required by applicable law.
Retention and deletion
With the default configuration, routine housekeeping deletes per-message monitoring records after 400 days and reputation-fetch logs after 90 days. It moves messages older than 30 days in the designated seed housekeeping folders or labels to trash or deleted items. The mailbox provider controls subsequent permanent deletion. These tasks depend on the service running successfully.
For on-demand tests, draft content becomes unavailable after seven days. Sending or resuming a test sets a 30-day content expiry; the next successful housekeeping pass clears expired encrypted content from live records. Operators can also request deletion of stored test content earlier. Test metadata and outcomes generally follow the default 400-day operational retention policy. Deleting a content field does not remove already-delivered messages, terminal captures, database journal/free-page remnants or existing backups.
Reputation history, alert history and some operational records do not currently have automatic expiry. They remain until an administrator deletes them or retires the service. Credentials are retained while needed for the authorised connection. Backups and delivered notifications may contain copies after deletion from the live database; deleting a live record does not immediately remove these copies.
To request removal of an account connection or associated stored data, email [email protected]. We will confirm your authority over the account and arrange deletion of relevant live records and credentials, explaining any backup or other retained copies that cannot be removed immediately.
Your controls
You can revoke the app’s Google access at Google Account connections. Revocation stops future authorised access once existing access tokens cease to work; it does not automatically delete data already stored by the monitor. Contact us separately to request deletion.
Authorised operators can cancel unsent test recipients and delete stored test content. Cancelling cannot recall a message already accepted by a sending service; deleting content does not automatically delete retained outcome reports or provider mailbox copies.
A test message’s unsubscribe link pauses further monitoring sends to that seed. It does not revoke OAuth permissions or erase existing records.
Google API Services User Data Policy
Cuckoo Camp seed monitor’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
This public website
These information pages use the company website’s shared hosting and analytics. See the website privacy notice for details about website visits.
Changes
We will update this page when the app’s data practices change. Questions about this policy can be sent to [email protected].