recap.games / Mail

Mail plugin privacy

Updated 21 October 2026

Each native ChatGPT connection authorizes one Stalwart mailbox. The connector sends ChatGPT an opaque, stable mailbox profile ID and the account username as a display label. A mailbox username is included as an email address only when it is a valid email address.

Cloudflare Workers hosts the connector. Cloudflare KV stores OAuth registrations and encrypted authorization records, including Stalwart access and refresh tokens. Connector tokens and authorization codes are stored as hashes. Expiring token records are removed through Cloudflare KV expiry. OAuth client registrations are retained so existing connections can refresh without losing their client identity. Stale grant metadata can remain until administrative cleanup.

A separate Cloudflare D1 database stores a permanent mapping from Stalwart account IDs to opaque profile IDs, plus message IDs and send-attempt states to prevent duplicate sends. These records do not contain email bodies. The stable mapping and send history are retained across reconnection; contact your recap.games mail administrator to request deletion. Deleting send history removes the plugin's duplicate-send safeguard for those messages.

Email content passes between Stalwart, Cloudflare, and ChatGPT when a tool runs. Drafts and sent messages remain in Stalwart. ChatGPT conversations follow your ChatGPT data settings. The connector does not store an email archive, and request logging is disabled in its Worker configuration. Cloudflare rate limiting temporarily uses your request IP address to limit connection requests; the application does not save that address in its database.

Disconnect a native account in ChatGPT's plugin settings to stop using that connection. Revocation and token expiry invalidate access; you can additionally revoke the upstream application through your mail server's account controls where available, or ask your mail administrator. Disconnecting does not delete email, existing ChatGPT conversations, stable profile mappings, or send-attempt records.

The earlier Sites plugin and its mailbox connections remain separate during migration. Its connection page controls those older records. Connecting this native plugin does not copy credentials or mail history from Sites.

Privacy and data controls