MailFiler — last updated 6 September 2026
MailFiler is a personal utility with a single user: its author. It is not offered to anyone else. This policy describes how it handles that one person's data.
MailFiler requests one Google permission:
https://www.googleapis.com/auth/gmail.readonly. This grants
read-only access to the authorising account's Gmail. It is the narrowest
scope that allows reading an attachment.
It cannot send email, delete email, modify email, change labels, or mark messages as read. This is enforced by Google, not merely by the application's own code.
Once per day it searches the mailbox for PDF attachments from a fixed, manually maintained list of financial institutions. For messages matching that list, it downloads the PDF attachment, renames it, and writes it to private storage hardware owned by the user, on the user's own home network.
Messages from senders not on that list are never opened and their attachments are never downloaded.
The OAuth refresh token is stored on the user's own hardware, readable only by the system account that runs the application. It is never transmitted anywhere except to Google, to obtain access tokens.
Downloaded documents are retained on the user's private storage for as long as the user chooses, exactly as if they had saved the attachment by hand. The application keeps a local record of which attachments it has already filed, so that it does not save duplicates. It stores no copy of message bodies.
Access can be withdrawn at any time from Google Account permissions. The application then simply stops working. Files already saved to private storage are unaffected, as they belong to the user.
MailFiler's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This application has one user, who is also its author and can be reached at the address given on the Google consent screen.