Privacy Policy
Effective date: 14 October 2026
Service: invitenight.us (Papilee Mail)
Website: https://invitenight.us/
Papilee Mail is a privately operated web application that lets an authorised user access and manage Gmail accounts through Google's OAuth authorisation system. This policy explains what information the service handles, why it handles it, how it is stored, when information may be transmitted to other services, and the choices available to users.
1. Scope and responsibility
This policy applies to Papilee Mail and its website at invitenight.us. It covers information handled when a user signs in to Papilee Mail, connects a Google account, uses mailbox features, configures optional notifications, or contacts the service operator.
Papilee Mail is an independently operated application and is not a Google product. Gmail and Google account services remain subject to Google's own terms and privacy disclosures.
2. Information we handle
Depending on the features you use, Papilee Mail may handle the following:
- Application sign-in information: the application username and the credentials or authentication information needed to verify your sign-in to Papilee Mail.
- Google account information: the connected Gmail account address and account information returned during Google authorisation where available.
- Email and mailbox information: message identifiers, sender and recipient details, subject lines, dates, message content, labels, read/unread state, and other message metadata needed to display or perform an action you request. The information actually returned depends on the feature used and the data available from Gmail.
- Contacts: contact details retrieved from Gmail when you use the contacts feature, including when you view or export contacts.
- OAuth authorisation data: access credentials and refresh tokens issued through Google's OAuth process. These allow the application to obtain authorised access without asking you to enter your Google password into Papilee Mail.
- Application settings: preferences associated with your application profile, including optional Telegram notification settings.
- Technical information: information that may be processed by the web server, hosting provider, browser, or security infrastructure when requests are made, such as request details and diagnostic information. The precise information retained depends on the relevant server and hosting configuration.
3. Google Gmail access and permissions
Papilee Mail requests Google OAuth permissions for Gmail read access, sending email, and modifying mailbox state. These permissions support the following user-requested features:
- Displaying and searching mailbox messages.
- Opening and reading messages and their available details.
- Composing, sending, and replying to email.
- Performing supported mailbox actions, including archiving, moving messages to trash, and changing read/unread state.
- Viewing contacts through the contacts feature, where supported by the connected Google account and the application's implementation.
The application uses Google APIs to provide these features. It does not need or ask you to provide your Google account password directly to Papilee Mail. Google handles the authorisation and issues the tokens used for authorised API access.
Connecting an account does not mean that every possible action is automatically performed. Email is sent and mailbox state is changed when the corresponding application feature is used. Actions taken in Papilee Mail may affect the connected Gmail account.
4. How Google user data is used
Google user data is used to provide the mailbox and contact features requested by the user, maintain an authorised connection to the selected Google account, execute user-requested email and mailbox operations, and diagnose or recover from authorisation failures.
Papilee Mail does not sell Google user data. Google user data is not used to serve advertising, build advertising profiles, or determine eligibility for credit, insurance, employment, or other unrelated decisions. The application is not intended to use Gmail data for purposes unrelated to providing its stated email functionality.
Papilee Mail does not claim ownership of your email or contacts. You retain your rights in the content held in your Google account.
5. OAuth tokens and account connections
After you approve Google access, Papilee Mail stores the OAuth authorisation information needed to maintain the connection. The application implementation stores account tokens in token files and sets owner-only permissions on those files. File permissions are a security measure, but they are not the same as encryption.
Access tokens may expire and be refreshed using a refresh token when Google permits it. Tokens are sensitive credentials: anyone who obtains a usable token may be able to exercise the access it grants. The server operator must therefore protect the server, application files, backups, configuration, and administrative access.
Papilee Mail does not request your Google password as a substitute for OAuth. Do not share your application password, server credentials, token files, or notification bot credentials with other people.
6. Optional Telegram notifications
Papilee Mail supports optional Telegram notifications configured by an application profile. When configured and enabled, the application may send a notice when a Gmail account is connected or when a stored token fails to refresh. The notification may include the connected mailbox address, event details, and an authorisation failure reason.
These notices are sent through the Telegram Bot API to the chat or channel configured by the user. Telegram therefore receives the information contained in the notification and processes it under its own terms and privacy practices. Do not configure a chat or channel that you do not control or trust.
The notification implementation is designed not to include the Google OAuth refresh token in notification messages. Telegram notifications are optional and can be disabled or removed in the application's notification settings.
7. When information may be shared
Papilee Mail does not sell or rent personal information. Information is transmitted to the following services only as needed for the relevant feature or operation:
- Google: Google receives OAuth authorisation requests and API requests required to access Gmail, send email, or perform supported mailbox operations.
- Telegram: if optional notifications are configured and enabled, notification details are sent to Telegram through its Bot API.
- Hosting and infrastructure providers: the server and network providers may process technical request data as part of delivering and securing the website.
- Legal and security circumstances: information may need to be disclosed to comply with applicable law, respond to valid legal process, protect the rights or security of users, or investigate abuse or attacks, where legally permitted or required.
Papilee Mail does not authorise third parties to use Google user data for independent advertising or unrelated purposes. Where a third-party service is used, its own handling of information is governed by its applicable policies and settings.
8. Storage and retention
Papilee Mail stores OAuth token files and application settings on the server where the application is deployed. Messages and contacts are retrieved from Google when the application needs them for a feature. This policy does not promise that every message or contact is stored permanently or that all temporary copies are immediately erased after each request.
OAuth token files remain stored while they are needed for an authorised account connection and until they are removed by the application's account-removal process or the server operator. Application settings may remain until changed or cleared. Technical logs and backups, if enabled by the server or hosting provider, may have separate retention periods determined by that configuration.
Papilee Mail does not state a fixed retention period for all technical logs or backups because these depend on the deployment configuration. The operator should configure those systems to retain information only as long as necessary for operational, security, and legal purposes.
9. Security practices and limitations
The application uses OAuth rather than collecting Google passwords directly and applies restrictive file permissions to stored token files. The website is intended to be accessed over HTTPS. These measures reduce certain risks but cannot guarantee that a system is completely secure.
Security also depends on server administration, operating-system updates, account password strength, access controls, backups, the hosting environment, and the protection of configuration secrets. Users should sign out on shared devices and keep their application credentials confidential.
No method of transmission or storage is completely secure. If a security incident affecting personal information is identified, the operator will assess the incident and take steps appropriate to the circumstances and applicable law.
10. Your choices and how to disconnect Google
You can take the following steps to manage your information:
- Stop using Papilee Mail: sign out and stop accessing the application.
- Remove a connected account: use the account-removal feature in Papilee Mail, where available, to remove the stored authorisation for that mailbox.
- Revoke Google access: review third-party access in your Google Account security settings and revoke Papilee Mail's access. Revocation prevents future access through the revoked grant, subject to Google's processing and any remaining locally stored files.
- Clear optional notifications: use the application's settings to disable notifications or clear the configured Telegram bot token and chat ID.
- Request assistance: contact the application operator to ask about access, correction, or deletion of information held by the service, subject to applicable law and legitimate security or recordkeeping requirements.
Removing a token from Papilee Mail does not delete the underlying emails or contacts from Gmail. Deleting an email or changing mailbox state through the application may affect the Google account itself. Google data held by Google is subject to Google's own account and deletion processes.
11. Children's privacy
Papilee Mail is a general email utility and is not designed to collect personal information from children. If you believe a child has provided personal information to the service inappropriately, contact the operator so the concern can be reviewed.
12. International processing
The application is hosted on a server and uses third-party services whose infrastructure may be located in different countries. As a result, information may be processed in jurisdictions other than the country where the user resides. Applicable protections may vary by jurisdiction.
13. Changes to this policy
This policy may be updated when the application's features, data handling, security practices, or legal requirements change. The updated policy will be published on this page with a revised effective date. Users should review this page periodically.
14. Contact and privacy requests
For privacy questions, data requests, or concerns about how Papilee Mail handles information, contact the operator of invitenight.us.
Please do not include your Google password, OAuth tokens, email contents, or other sensitive credentials in a privacy request.