Privacy Policy

What this page covers

Sable is a free beta that reads order and shipping mail you connect, then shows those orders, packages, and expenses in one ledger. The live service is at sabletracker.com. Pro is not yet live, and Sable does not take a card.

This page says what the beta stores, who else receives it, and how you can export or delete it. The Terms of Service covers use of the service. Questions go to support@sabletracker.com.

Account information

When you create an account, Sable stores:

• Your email address and display name.
• A password hash, if you use email and password. The password itself is not stored. The hash is bcrypt with 12 rounds.
• Your time zone, the date the account was created, and the plan field. New accounts are stored as free.
• Whether your email has been verified, and a hash of a one-time verification or password-reset link. The raw link is not stored. A verification link lasts 24 hours. A reset link lasts 1 hour.
• When an invite code is required, a hash of that code, whether it has been used, and the account that used it. The code itself is not stored.
• If you turn on an authenticator code, an encrypted copy of that secret. Backup codes inside it are stored as hashes.

Email and password sign-in asks you to verify the email before the first sign-in. Verification and password-reset mail is sent by Sable through Purelymail. That mail comes from Sable, not from a retailer, and it does not send mail from a mailbox you connect.

Google and Discord sign-in

You can also sign in with Google or Discord. Apple sign-in is not turned on in this beta.

Google sign-in asks for the openid, email, and profile scopes. Sable uses the Google user id, the verified email, and the name on that account. It does not keep the Google sign-in access token. Gmail access is a separate step, described below.

Discord sign-in asks for the identify and email scopes. Sable uses the Discord user id, the verified email, and the display name Discord returns (the global name, or the username). The Discord access token is used once to read that profile and is not stored.

Sable keeps an identity row for the provider: the provider name, the provider's user id, and the email. A short-lived cookie named sable_oauth_state is set during the handoff so the return can be matched. It is httpOnly, SameSite=Lax, marked Secure in production, lasts about 10 minutes, and is deleted when the handoff finishes.

Mailboxes you choose to connect

Connecting a mailbox is optional. Sable does not read a mailbox until you connect it. Three connections are offered:

• Gmail. The only scope requested is https://www.googleapis.com/auth/gmail.readonly. Sable refuses the connection if Google returns a scope that can send, delete, or change mail. The refresh token and access token are encrypted before they are stored.
• IMAP. You enter the host, port 993, the full email address, and an app password. The connection uses TLS, opens INBOX read-only, and downloads with BODY.PEEK. Sable has no IMAP call that sets flags, moves mail, or deletes mail. The app password is encrypted before it is stored. Purelymail (imap.purelymail.com) is one host you can use. Other IMAP hosts on port 993 can be used the same way.
• Outlook, when you choose it. The requested Microsoft scopes are offline_access, User.Read, and Mail.Read. Sable refuses Mail.ReadWrite and Mail.Send. The tokens are encrypted the same way as Gmail tokens.

A sync looks back about 90 days on the first run and reads up to about 400 messages in one pass. Later syncs read newer mail. A scheduled job on Vercel can run that sync, and you can also run it yourself.

Gmail search is aimed at recent order, shipping, and tracking mail, including common retailers and subjects that look like an order update. Mail that matches can still be something other than an order. IMAP does not use that keyword filter. It reads INBOX messages in the same recent window, so ordinary mail in that window can be downloaded too.

What a sync stores from mail

For each message it downloads, Sable stores a copy so it can parse and reparse: sender, subject, date, headers, and the text and HTML, each trimmed at about 150,000 characters. That copy can include a message that never becomes an order.

If the parser is unsure, Sable can also store a review note: sender, subject, a reason, and a short snippet of the body.

From mail it treats as an order or shipment, the ledger can store the retailer, order number, dates, status, amounts, item names, quantities, prices, a ship-to line, the recipient address on the message, tracking numbers, carrier links found in the message, and package events described in the mail. Product images may be kept as a URL. When Vercel Blob storage is configured, image bytes pulled from the message can be stored there. When it is not configured, Sable keeps the URL and does not write the file.

Sable does not call a carrier's tracking API. Status and tracking numbers come from the mail. A link may point at UPS, USPS, FedEx, or DHL. Opening that link leaves Sable and is between you and that site.

Disconnecting Gmail asks Google to revoke the token when Google accepts that call, and then deletes the stored copy. Disconnecting IMAP or Outlook deletes the stored credential from Sable. You can also remove Sable in your Google or Microsoft account. Orders already imported stay until you clear them, remove that inbox's imported data, or delete the account.

What you add in the ledger

The ledger also stores things you type or edit: named shipping addresses (houses), fee rates, expenses, shipments, resale numbers, product names you combine, and in-app notifications. A sale you log is stored as an order row.

Discord webhooks

Discord alerts are optional. If you save a webhook URL, Sable stores that URL as text with your account. It is not in the encrypted mailbox field. When an order status changes, Sable can POST a message to the URL you saved. The message includes the order title, the status, a short detail line, and the tracking number when there is one. A test ping says it is a test and does not change an order.

If the deployment has its own Discord webhook configured, the same status text can also be posted there. A demo deployment does not call Discord.

Feedback

The in-app feedback form stores the note you write, the page path, and an email if you type one. That note is not tied to your user id. Deleting the account does not delete it. Email support@sabletracker.com if you want a feedback note removed.

How the information is used

• To run the account: sign-in, email verification, password reset, an optional authenticator code, and rate limits on signup and sign-in.
• To read the mailboxes you connect and turn order and shipping mail into a ledger.
• To show orders, packages, expenses, and the tracking details parsed from that mail.
• To post status messages to Discord webhooks you save, and to a deployment webhook if one is configured.
• To send the account email described above through Purelymail.
• To keep a security log: the action, a hash of the IP address when one was available, and a short note. The raw IP address is not stored in that log. The web session row does not store the IP hash.
• To read feedback you send.

Sable does not send, delete, or modify mail in a connected mailbox. It does not use the mail to place orders. It does not sell the information, and it does not share it for advertising.

Cookies, sessions, and app tokens

Sable does not use an advertising cookie, and it does not store the account in browser local storage. Cookies it does set:

• sable_session. This is the sign-in cookie. It holds a random token. The database stores a hash of that token, the expiry, the last-seen time, and a user agent trimmed to about 200 characters. The cookie is httpOnly and SameSite=Lax, and it is marked Secure in production. It lasts 14 days. Sign out deletes that session. Sign out everywhere deletes the account's sessions and refresh tokens.
• sable_oauth_state. Used only during Google, Discord, or Gmail connect, as described above.
• sable_invite. Set only after an invite code is checked, so Google or Discord sign-in can finish creating an account. It is httpOnly, SameSite=Lax, marked Secure in production, lasts about 15 minutes, and holds a signed hash of the code rather than the code itself.
• sable-source. Set if you switch the ledger between inbox orders and sample orders. The value is inbox or sample. It is not httpOnly, it is SameSite=Lax, and it can last up to a year. It does not hold mail.
• sable-demo. Only on a deployment with demo mode turned on. The live beta does not set it unless that mode is on.

An app or other API client can use the same account. It receives a short-lived access token, about 15 minutes, and a refresh token, about 30 days. The refresh token is stored as a hash and is rotated when it is used. Reuse of an old refresh token revokes that token family.

Who else receives information

These services process information so Sable can run. Sable does not sell the information to them.

• Vercel hosts the app, runs the scheduled sync, and can store product-image files in Vercel Blob when that storage is configured.
• Neon hosts the Postgres database that holds the account, the ledger, and the saved mail copies.
• Purelymail sends Sable's verification and password-reset email. You can also connect a Purelymail mailbox over IMAP if you choose that host.
• Google receives the sign-in handoff, and, if you connect Gmail, the read-only mailbox requests.
• Discord receives the sign-in handoff if you use Discord, and it receives the status message if you save a Discord webhook or if the deployment webhook is set.
• Microsoft receives the mailbox handoff only if you connect Outlook.

If an error-reporting address is configured, Sable can send a short error message to Sentry after stripping email addresses and token-like strings from that message. Reporting stays off when no address is set. This page does not assume that it is on.

Carrier sites receive a visit only if you open a tracking link. Sable does not send your ledger to them.

How secrets are stored

Mailbox refresh tokens, IMAP app passwords, and authenticator secrets are encrypted with AES-256-GCM before they are written to the database. The key lives in the server environment, not in the database row. New ciphertext is labeled with a key id so an older key can still decrypt older rows. Session tokens, refresh tokens, and email links are stored as hashes. Passwords are stored as bcrypt hashes.

Discord webhook URLs are stored as the text you paste. Treat a webhook URL like a secret, because anyone with it can post into that channel.

The app also sets browser headers that block framing, send a no-referrer policy, and include a transport-security header. Cookie-based changes are checked for a cross-site origin. These are ordinary controls. They are not a certification, and they do not mean a compromise is impossible.

How long it stays, and how you take it out

Sable does not run a job that deletes orders or saved mail after a fixed number of days. They stay until you remove them. Sessions, refresh tokens, and email links expire on the timers above. There is no separate backup schedule in the app. The host may keep its own operational copies. This page does not set a date for those.

In Settings you can:

• Export a JSON file. It includes the profile (no password hash and no mailbox secret), connected inbox metadata, orders with items and package events, named addresses, fee rates, webhook URLs, expenses, shipments, and in-app notifications. It does not include saved message bodies, review snippets, or tokens. The webhook URLs you saved are in the file.
• Clear order data. That deletes orders and named shipping addresses. Inboxes stay connected. Saved message copies are not removed by this action.
• Delete the account. Sable tries to revoke connected Gmail tokens, then deletes the user. Orders, inboxes, saved messages, webhooks, sessions, and the other records tied to that user go with it, and the sign-in cookie is cleared.

Disconnecting an inbox deletes the stored token or app password and leaves imported orders in place. A separate remove action deletes that inbox's orders, saved messages, and review notes, and deletes the credential.

Feedback notes are not removed by account deletion, as described above. A deletion event can remain in the operator audit log without being tied to the deleted user row. Email support@sabletracker.com if you need help with a copy that those controls do not remove.

Selling personal information

Sable does not sell personal information. The code does not send it to advertisers or data brokers. The only recipients are the services and connections listed on this page, including a Discord webhook you choose to save.

Children

Sable does not ask for a date of birth and is not built as a children's service. If you believe a child has created an account, email support@sabletracker.com and ask for it to be deleted.

Changes and contact

If this page changes, the date at the top changes with it. The Terms of Service is the companion page.

Email support@sabletracker.com for privacy questions, an export you cannot download, or a deletion the in-app controls do not cover.

This page describes how the Sable beta works on November 5, 2026. It is a product description. It is not a security certification, and it is not legal advice.