MOSbox Email Policy#

Last updated: October 16, 2026

This policy explains exactly how MOSbox handles email: what happens when a studio connects its mailbox, what MOSbox sends and reads, what it stores, who can see it, and the rules for sending. It's part of our Terms and works alongside our Privacy Policy.

MOSbox is operated by Joseph Pedreira Jr., a sole proprietor doing business as MOSbox, in Louisiana, United States. Questions: [email protected].

1. The short version — for everyone#

• Emails to clients come from the studio's own address, not from MOSbox.
• MOSbox never sends its own marketing emails to a studio's clients.
• Gmail is send-only. MOSbox never reads a Gmail inbox.
• Outlook and other providers: MOSbox checks new mail only for replies from the studio's clients. Everything else is left alone and never stored.
• Mailbox credentials are encrypted. A studio can disconnect at any time, and disconnecting deletes them right away.
• Clients can stop automated emails with the unsubscribe link in them.

2. Connecting a mailbox — for studios#

A studio connects its mailbox in Settings → Integrations. What MOSbox gets depends on the provider:

An app password is a separate password your provider makes just for MOSbox. It isn't your main password, and you can delete it at your provider at any time, which cuts MOSbox off immediately. If your provider doesn't offer app passwords, MOSbox uses your email password instead, encrypted the same way. Changing that password cuts MOSbox off.

3. What MOSbox sends — for studios and their clients#

• Emails the studio writes: proposals, contracts, invoices, gallery deliveries and messages.
• Emails the studio schedules or switches on: payment reminders, follow-ups and automations. The studio chooses these; MOSbox never adds its own.
• Notices to the studio itself, such as "wedding in a week" or a double-booked date. These go from the studio's own address to itself.

All of these go out through the studio's own mailbox, so they come from the studio's address.

• If no mailbox is connected, MOSbox doesn't send the email. It tells the studio instead.
• The only emails MOSbox itself sends are sign-in links and account emails, such as password resets. Our sign-in provider sends them.

4. What MOSbox reads — for studios and their clients#

• Gmail: nothing.
• Outlook and other providers: MOSbox looks at new incoming messages to find replies from the studio's clients. It matches them by the conversation they belong to, or by the sender being one of the studio's clients in MOSbox.
  • Matching replies are copied into the right project.
  • Everything else is left in the mailbox, untouched, and is never stored by MOSbox.
• Reply address. Emails MOSbox sends may use a MOSbox reply address, so a client's reply lands in the right project. It only accepts email from the client's addresses on that project, and the studio's answers from its connected mailbox. Every reply from a client that comes in this way is also forwarded to the studio's own inbox, with its attachments, so the studio keeps the full conversation either way. When the studio answers that copy from its inbox, the answer goes back through MOSbox, which files it on the project and sends it to the client from the studio's own address. Automatic replies, such as out-of-office notices, are noted on the project instead.

5. What MOSbox stores — for everyone#

• Emails sent and received through MOSbox, with the project they belong to: subject, text, sender, recipients and dates.
• A reply that comes in through a reply address, or a studio's answer sent back through it, is kept whole, with its attachments, only until it has been passed on (to the studio's inbox, or to the client), and never longer than 30 days. Its text stays with the project.
• Mailbox credentials (access tokens, app passwords, and email passwords where a provider has no app passwords), encrypted with AES-256-GCM. The key is kept outside the database.

MOSbox never sells email content, never uses it for advertising, and never uses it to train artificial-intelligence models.

6. Who can see emails — for everyone#

• The studio, and the team members it allows.
• The client, who sees their own conversation with the studio in their portal.
• MOSbox support staff, only with the studio's permission, to investigate a security problem, or where the law requires it.

Studios never see each other's email.

7. For clients#

• Emails from a studio come from that studio's own address.
• When you reply, your reply goes to the studio and is filed with your project.
• You can also message the studio from your portal.
• To stop automated emails such as reminders, use the unsubscribe link in them. You'll still receive emails the studio writes to you personally.
• You never need to connect your own mailbox to MOSbox.

8. Sending rules — for studios#

Studios agree to:

• email only their own clients, and people who contacted them
• never send spam, use bought or scraped lists, or disguise who an email is from
• follow the laws on commercial email, including honoring unsubscribe requests (MOSbox does this automatically for automated emails)
• keep what they send lawful and respectful

MOSbox may pause sending from a studio that breaks these rules, and will tell the studio why.

9. Keeping and deleting email — for everyone#

• Emails stay with their project until the studio deletes the project or closes its account. The retention rules in our Privacy Policy still apply.
• Disconnecting a mailbox in Settings deletes its stored credentials right away.
• You can also cut off access at the source:
  • Google: myaccount.google.com/permissions
  • Microsoft: your account's app permissions
  • Other providers: delete the app password

10. Security — for everyone#

• Encrypted connections everywhere.
• Encrypted credentials.
• Each studio's email walled off from every other studio's at the database level.

11. Google and Microsoft — for studios#

MOSbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our Privacy Policy has a full section on Google user data. Microsoft access is used only for the sending and reply-finding described above.

12. Changes to this policy — for everyone#

We give notice before important changes take effect.

• Studios get a notification in MOSbox, plus a banner.
• Clients see a banner in their portal or Vault.

You can read what changed, accept, or dismiss the notice. We keep a record of who accepted which version.

13. Contact — for everyone#

MOSbox — Joseph Pedreira Jr., doing business as MOSbox, Louisiana, United States
[email protected]