ColdMerge ("ColdMerge", "we", "us") is a tool for sending cold-email outreach through your own Gmail or Google Workspace account and detecting the replies to it. This policy explains, plainly and specifically, what data we handle, why, what we deliberately do not keep, and the choices you have. It is written to describe how this product actually works, not from a generic template.
Three kinds of people are covered here: the person who signs in and connects a Google account (our customer, "you"), the people that customer chooses to email (their "contacts"), and anyone who visits this website, coldmerge.com. Sections below say which is which where it matters.
1. Google account data and scopes
When you connect a Google account, we ask Google for a specific, minimal set of permissions (OAuth scopes). We request only what the product needs to work, and never more. You see and approve these on Google's own consent screen.
| Scope | What we use it for |
|---|---|
gmail.send |
To send your outreach and follow-ups from your own Gmail account, as you. |
gmail.readonly |
To read incoming mail solely to detect replies and bounces to the messages this product sent, so a sequence stops when someone replies and a permanent bounce suppresses that address. See the "match-or-drop" rule below. |
openid, userinfo.email |
To identify which Google mailbox you connected (its email address). |
userinfo.profile |
To use your name as the sender's display name, so your messages go out as "Your Name <[email protected]>" rather than a bare address. This one is optional; decline it and your mail simply sends from the address alone. |
Workspace customers who choose to run domain-deliverability diagnostics may additionally be asked for a read-only Google Postmaster Tools scope, only at that point and never at connect. It is never requested from free Gmail users, who cannot use it.
The match-or-drop rule. The mailbox watch sees your whole inbox, including your entirely personal mail. An incoming message is recorded and acted on only if it belongs to a conversation this product started (matched by the Gmail thread identifier of a message we sent). Everything else is dropped, unread, and never stored. This is the hard line that keeps reply detection from being mailbox reading.
2. Limited Use commitments
ColdMerge's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In concrete terms:
- We use Google user data only to provide and improve the user-facing features described here (sending your mail, detecting your replies and bounces).
- We do not transfer Google user data to others except as needed to provide those features, for security or legal reasons, or as part of a merger you are notified of.
- We do not use Google user data for advertising of any kind, and we never sell it or provide it to data brokers.
- No human at ColdMerge reads the content of your Gmail messages. Reply and bounce classification is fully automated. The narrow exceptions Google allows (your explicit agreement, security, or a legal requirement) are the only times a person would look at specific data.
3. What we store and do not store
The most important fact about ColdMerge is how little of your mail it keeps. Gmail stays the system of record for your message content; we keep the minimum needed to run and account for your campaigns.
Outgoing messages
For each message sent we store correlation keys (the Gmail message and thread identifiers), which account and contact it involved, the rendered subject line, the outcome, and timestamps. We do not store the message body. The full message already sits in your own Gmail Sent folder, under your own retention policy, and we do not fetch it back.
Incoming messages (replies and bounces)
For an incoming message that matches a conversation we started, we store correlation keys, the sender, a short snippet, and a timestamp, and no body. Non-matching mail is never stored (the match-or-drop rule above).
Your Google credentials
Your OAuth tokens are encrypted at rest using envelope encryption, with the wrapping key held in Google Cloud Key Management Service in production. They live in a separate, access-controlled store, not alongside ordinary account data. Disconnecting an account destroys the stored token and requests revocation of Google's grant.
Account and billing
We store your login identity and organization details, and the minimum billing facts (which plan, its status, a Stripe customer reference, the period end). We never store card numbers or payment details; our payment processor holds those.
4. Data about the people you email
When you import contacts, that data (names, email addresses, and any fields you upload) belongs to you and is stored in isolation for your organization only. We process it on your behalf to send your campaigns and personalize your messages. We do not use your contact lists for our own purposes, do not share them between customers, and do not sell them.
Optionally, you may check whether an uploaded address is likely deliverable. That check sends the address to an email-verification provider and stores the resulting verdict so the same address is not re-checked needlessly.
Every send honors your workspace's suppression list. Unsubscribes cannot be removed from that list. Hard bounces and manual suppressions also block sending while recorded; removing those records is restricted and audited. Suppression records belong to that workspace, are retained while it exists, and are deleted with it. A new workspace does not inherit the deleted list.
5. How we use data
- To send the outreach and follow-ups you create, from your account.
- To detect replies and bounces and stop or suppress accordingly.
- To personalize your messages using the fields you provide.
- To show you your campaigns, results, and reply notifications.
- To send you a short series of trial-tips emails during your trial, which you can turn off from the link in any of them.
- To operate, secure, support, and bill for the service.
- To understand how people use the app and this website, and occasionally to ask you what is getting in your way.
We do not use your data, or your recipients' data, for advertising, profiling, resale, or training unrelated systems.
6. Who we share data with
We use a small set of sub-processors to run the service. Each receives only what it needs for its job:
| Provider | Purpose |
|---|---|
| Gmail sending and reply detection, sign-in, key management (Cloud KMS), and reply push notifications (Cloud Pub/Sub). | |
| Stripe | Payment processing and billing. Card and payment data go directly to Stripe and never touch our servers. |
| MillionVerifier | Optional email-address verification of addresses you upload. |
| Resend | Sending our own email to you: account mail (for example sign-in verification, password reset, and reply notifications) and, during a trial, a short series of trial-tips emails. Every trial-tips email carries a one-click link to turn the series off. Account mail cannot be turned off, because it is how the service talks to you. |
| PostHog |
Product analytics, so we can see which features are used and where people get
stuck. Hosted on PostHog's EU cloud (eu.i.posthog.com). Events carry
your account's internal identifier only, never your email address, name, contacts,
or message content.
We also record sessions. PostHog reconstructs what was on your screen while you used the app, so we can see where people get stuck rather than guess. Anything you type is masked, including your password and the details you enter when signing up, and we never record the contents of network requests. The page itself is not masked, which means a recording made while you are looking at your contacts, your suppression list or your messages shows the contact details displayed on that screen. Recordings are kept for 30 days and then deleted by PostHog. Email [email protected] and we will delete the recordings we hold for your account. We may ask you one question. If you connected a Gmail account at least three days ago and have not sent a campaign yet, the app may show you a short survey asking what is stopping you. It is shown to you once and you can close it. Your answer is stored in PostHog with your account's internal identifier. Before it leaves your browser we remove anything that looks like an email address or an access token, but please do not type other people's details into it. On this website. PostHog also counts visits to coldmerge.com and records which pages were viewed, which links and buttons were clicked, and where on a page people click and scroll, so we can see which pages help people decide. It runs in cookieless mode: nothing is stored on your device, your IP address is not kept, and a visitor is told apart only by a code PostHog works out from the IP address and browser, which changes every day. We keep a page's address and any campaign tags on the link, never the rest of the link. The website uses a separate PostHog project from the app, and your visits here are not joined to your account. The one thing that crosses over: when you follow a sign-up link, the app records which of our pages the link was on (for example the pricing page). |
| Sentry | Error monitoring for our application and background worker, so we learn about a failure before you do. Receives error messages, stack traces, request identifiers, and your account's internal identifier only. Never your email address, contacts, message content, or subject lines. Kept for 90 days, Sentry's default retention. |
| tawk.to | Customer support: the chat window in the app and our support inbox. When you are signed in, the chat window receives your name and email address, so we know who we are talking to, and tawk.to records your IP address, location, and the app pages you view while you are signed in. It keeps what you write in a chat, any files you attach, and email you send to [email protected]. The app page addresses it sees include any search you run, so a name or email address you search for among your contacts reaches tawk.to that way. Otherwise it never receives your contacts, campaigns, or messages unless you paste them into a chat. It sets its own cookies and browser storage (see section 10). The chat window is not shown on the sign-in, sign-up, or password pages. |
| Cloudflare | DNS, TLS, and proxying for our domains, and hosting for this site. |
| Railway | Hosting for the application, its background worker, and the database, in Railway's EU West region (Amsterdam, Netherlands). |
Limited server-side analytics events, such as creating an account, connecting Gmail, or sending a first campaign, do not use browser storage and continue when optional browser analytics is refused. They carry internal account identifiers and never carry message or contact content.
We keep an internal record of the data-processing agreement in place with each of these providers, reviewed annually.
We may also disclose data if required by law, or to protect the rights, safety, and security of ColdMerge, our customers, or the public. If ColdMerge is ever involved in a merger or acquisition, we will notify affected customers as required.
7. Retention, deletion, and erasure
We keep data for as long as your account is active and you need it to run your campaigns, then no longer than necessary. The table below is the retention schedule by category:
| Data | How long we keep it |
|---|---|
| Gmail tokens | Until you disconnect the account or delete it; disconnecting destroys the stored token immediately. |
| Campaign and message metadata | Until you delete the campaign or contact it belongs to. |
| Message bodies | Never stored. We never keep the text of a sent or received message. |
| Staged import rows | 30 days from upload, removed by a daily sweep once the import's outcome has been recorded. |
| Workspace suppression records | While the workspace exists. The record can hold a normalized email address for display and a hash for matching. On erasure, the display address is removed and only the hash remains to prevent sending from that workspace. Workspace deletion deletes the suppression list, including these hashes. See "Erasure" below. |
| Invite requests | Until an invite is minted from the request, or 12 months from submission, whichever comes first. |
| Delivery records for our own email to you | 90 days. For account-holder email, such as a reply alert, a failed-payment notice or a setup tip, we record the recipient, email type, provider identifier and provider delivery outcome. This record contains no subject or message body. We use it to investigate delivery and stop sending to addresses that reject it. It concerns ColdMerge's own email, not campaigns sent through your Gmail account. Stripe sends payment and refund receipts; those receipts are not recorded in this delivery log. |
| Blocked addresses | Indefinitely, by design. If your mail server permanently rejects mail we send you, or you report one of our emails as spam, we record the address so we stop sending to it. Expiring that record would mean rediscovering the same rejection by trying again. Tell us and we will clear it. |
| Error reports | 90 days, Sentry's default retention (see Sentry's row in section 6). A report carries the error message and its stack trace, alongside identifiers such as a request identifier and your account's internal identifier. It never carries your email address, contacts, message content, or subject lines. |
| Support chats and email | Kept in tawk.to's inbox (see tawk.to's row in section 6) under tawk.to's own retention, which sets no fixed period. Email [email protected] and we will delete your support conversations. |
| Product analytics | Events, including survey answers and website visits: 7 years. Session recordings: 30 days. Both are PostHog's retention on our plan, checked 15 September 2026. Email [email protected] and we will delete the analytics we hold for your account sooner. |
When you delete a contact, their messages and history are removed with them. Because we never store message bodies, there is no hidden archive to scrub.
Erasure (right to be forgotten). On a valid erasure request we delete the person's contact data and history. To honor an opt-out in the sender's existing workspace, we retain a one-way hash of the email address on that workspace's suppression list. We remove the plaintext address from that record. The retained hash prevents further sending from that workspace; it is not described as anonymous data. Deleting the workspace deletes its suppression list and the retained hash.
Subscription cancellation and automatic workspace deletion
Cancelling a subscription does not immediately delete its workspace. If a subscription lapses and is not restarted, we keep the workspace for at least 180 days before automatic deletion. Once it has been lapsed for at least 166 days, we begin attempting a deletion-warning email to its owner.
Automatic deletion waits until both the 180-day hold has elapsed and at least 14 full days have elapsed since our email provider successfully accepted the warning for sending. Failed, blocked or unaccepted attempts do not start that countdown. We retry eligible unsent warnings, so delayed sending can extend retention beyond 180 days. Previously accepted agreements may extend retention until the applicable material-change notice period ends.
The warning states the earliest date before which we will not delete the data. We use the later of that date and 14 full days after successful provider acceptance; actual deletion may happen later. Provider acceptance does not mean inbox delivery or that anyone read the email. Earlier schedules without a qualifying accepted warning receive a fresh warning and full grace period. Restarting the subscription cancels that deletion cycle. Automatic deletion removes the workspace and its suppression list, but does not itself delete your login. You can explicitly delete a workspace sooner from the app.
8. Your choices and rights
Depending on where you live (for example under the GDPR or UK GDPR), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:
- Disconnect a Google account at any time from within the app.
- Ask us to access, correct, or delete your personal data by emailing [email protected].
- Manage or revoke ColdMerge's access to your Google account directly at your Google account permissions page.
- Turn off our trial-tips emails with the link at the bottom of any of them. The one notice we send the day before your trial ends still arrives, because it is about your plan and billing rather than a tip.
- Allow or refuse optional browser analytics and session replay when the app asks. You can change that choice at any time under Settings → Account → Privacy.
If you are a recipient of email sent through ColdMerge and want to stop hearing from a sender, use the unsubscribe option in their message; that adds you to that sender's workspace suppression list. The sender cannot remove that unsubscribe. The record is kept while the workspace exists and is deleted with it. You may also contact us at the address below.
9. How we protect data
Google credentials are encrypted at rest with per-record data keys wrapped by a managed key service, and every use of that key is logged and revocable. Each customer's data is isolated to their own organization. Access to production systems is limited and need-based. No system is perfectly secure, but we design to keep the most sensitive data (your tokens and your recipients' details) tightly held and minimally retained.
10. Cookies and local storage
The app at app.coldmerge.com sets a small number of cookies to run the service, and the support chat sets a few more of its own. This site (coldmerge.com) sets none. We do not run advertising or cross-site tracking of any kind.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Secure-better-auth.session_token |
Keeps you signed in. Set when you sign in; HTTP-only and sent only over HTTPS. | Seven days from your last activity, or until you sign out. |
__Host-oauth_flow |
Carries the state of a Google connect attempt from the moment you click Connect until Google sends you back, so the return can be tied to the account and organization that started it. | Ten minutes, or until the connect completes. |
__Host-login_invite |
During invite-only sign-up, carries your invite code across the "Continue with Google" redirect. | Ten minutes, or until sign-up completes. |
twk_uuid_<id> |
Set by the tawk.to support chat (section 6) so it recognises you as the same visitor across pages and visits. Scoped to coldmerge.com, so your browser also sends it to this site, which does not read it. | Six months. |
twk_idm_key, TawkConnectionTime |
Set by the tawk.to support chat to manage its connection across your tabs. | Until you close the browser. |
Local storage. The app also keeps a few preferences in your browser's
local storage (for example whether the sidebar is collapsed and how many rows a table
shows). Those never leave your browser. The app also remembers whether you allowed or
refused optional browser analytics. Until you choose Allow analytics, PostHog capture,
local storage, and session replay remain disabled. If you allow them, PostHog stores an
identifier in local storage under a key beginning with ph_; it sets no
cookies. Analytics on this website stores nothing on your device at all, neither a
cookie nor anything in local storage. While you are signed in, the tawk.to support chat
also keeps its visitor details and session token in local storage (keys beginning with
twk_) and, for the current tab only, the last page you viewed.
The first three cookies above are strictly necessary to run the service. The support chat's cookies and storage are set whenever you are signed in, whether or not you open the chat, so that help is one click away; they are not needed for anything else in the service. The marketing website uses cookieless analytics and stores nothing on your device, so it does not show a cookie banner. The signed-in app asks before enabling optional browser analytics and session replay. Refusing does not limit the service, and the Account setting lets you withdraw that choice later.
11. Where data is processed
Our application, its background worker, and our database run on Railway, in Railway's EU West region (Amsterdam, Netherlands). Product analytics stays in the EU on PostHog's EU cloud. Google, Stripe, Resend, MillionVerifier, Cloudflare, and Railway itself operate globally and may process data in other countries under their own safeguards, including the standard contractual clauses in their data processing terms for providers established outside the EU and UK. Support chats and support email are processed by tawk.to, mainly in the United States (its data processing addendum also lists Ireland), under the EU-U.S. Data Privacy Framework and the standard contractual clauses in tawk.to's data processing addendum. By using ColdMerge you understand your data may be processed in the locations these providers operate.
12. Children
ColdMerge is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.
13. Changes to this policy
We may update this policy as the product changes. When we do, we revise the "last updated" date above, and for material changes we will take reasonable steps to let account holders know.
14. Contact us
Questions about this policy or your data, or to make a privacy request, email [email protected]. For anything else, reach us at [email protected].
Version and effective date
When this revision applies. This policy is published with Terms version 2026-10-05. New customers accept this pair when signing up. Customers with no recorded acceptance are asked to accept this pair. For customers who accepted an earlier pair, it takes effect no earlier than 30 full days after advance notice is displayed to them in the app. Until then, their previously accepted pair continues to apply. The preceding pair remains available as the 30 September privacy archive and 30 September Terms. The revision clarifies workspace deletion, suppression retention and our own email delivery records. It also describes the successful-send warning period for automatic deletion. Provider acceptance means accepted for sending, not received or read.