GoodSender Privacy Policy

Last updated: October 28, 2026

1. Introduction and scope

GoodSender is a product of Joy Labs Ventures, LLC ("GoodSender", "we", "us", or "our"). GoodSender is a blog, newsletter and email service for individuals and small teams. You write on GoodSender, publish to your own blog, send email to people who have agreed to hear from you, and post to other platforms you connect.

This Privacy Policy describes how we collect, use, share and retain personal information in connection with:

• our website at https://goodsender.com/, including the dashboard, the documentation at https://goodsender.com/docs/ and the public blog;
• the GoodSender API at https://api.goodsender.com/;
• the hosted GoodSender MCP server at https://mcp.goodsender.com/, which lets AI assistants such as Claude work with your GoodSender workspace;
• the GoodSender MCP server and command-line tool when you run them on your own computer;
• blogs we host for you on a GoodSender address or on your own domain; and
• our support and other business communications.

Together we call these the "Services". Joy Labs Ventures also operates Laneful, the email delivery infrastructure GoodSender sends through. Laneful has its own privacy policy at https://joylabs.com/legal/privacy-policy. The Services are governed by the Joy Labs Ventures Terms of Service at https://joylabs.com/legal/terms-of-service.

2. Our roles: your account, and the people you write to

We act in two different roles, and your rights differ depending on which one applies.

When we are the controller. We decide how and why to process information about you as a GoodSender user, about visitors to goodsender.com, and about people who contact us. Sections 3 through 14 describe that processing.

When we process on your behalf. When you add recipients and subscribers, send email, or publish a blog, we process your recipients', subscribers' and readers' information on your instructions. You decide who to write to and what to send. We act as your service provider or processor, and you are responsible for having the right to contact those people. If you are a recipient, subscriber or reader of a GoodSender user and you have questions about how your information is used, please contact that user first. Section 11 explains how we handle requests we receive directly.

3. Information we collect

a. Information you provide to us

• Account information. When you sign in, we receive your email address, your name and a user identifier from the sign-in provider you choose. We store your email address and your workspace memberships.
• Workspace content. Your workspace name, blog name, posts, images, blog design, email templates, sender names and addresses, the domains you connect, and the settings you choose.
• Recipients and subscribers. The email addresses and optional names of the people you add, import or who subscribe to your blog, together with each person's consent status and the dates it changed.
• Email you send. The subject and body of custom emails, the data you pass into built-in templates, and the recipients of each send.
• Connected accounts. When you connect a publishing destination such as X, LinkedIn, Bluesky, Mastodon, Dev.to or Hashnode, we store the credential that platform issues, an account label, and for Dev.to the organization you choose. When you connect Cloudflare to set up a custom domain, we use the authorization once to write DNS records and do not store the access token.
• Support and other messages. What you send us when you contact support@goodsender.com, including your email address.
• Waitlist. If sign-up is restricted and you leave an email address to be contacted, we send that address a consent request and keep it as a pending recipient in our own GoodSender workspace until you respond.

b. Information collected automatically

• Service logs. When you use the website, the API or the hosted MCP server, our servers record your IP address, browser or client information, the pages or endpoints requested, timestamps and response status. These logs are kept on Google Cloud.
• Error reports. Our website sends error reports to Sentry so we can fix crashes. Reports carry an anonymous user identifier and technical details about the error. We do not send cookies or your email address with them.
• Website analytics. On goodsender.com we use Google Tag Manager and Google Analytics 4 to understand how visitors use the site. See Section 6.
• Email engagement. When you send a newsletter or broadcast through GoodSender, open and click tracking is turned on. Laneful tells us when each recipient's mail was delivered, opened, clicked, bounced, marked as spam or unsubscribed, and we keep those events against the recipient's address, together with the dates of the most recent open and click. For email you send through the API, you choose the tracking settings on each request.
• MCP tool telemetry. See Section 5.

c. Information from third parties

• Sign-in providers. Google and LinkedIn give us your email address, name and account identifier when you sign in with them.
• Laneful. Delivery, bounce and complaint events for the email you send, and the list of addresses that have bounced in your workspace.
• Connected platforms. The platforms you connect tell us whether a post succeeded and return the identifier or URL of what was published.

d. Information we do not collect

We do not knowingly collect:

• payment card or bank account details through GoodSender. Paid plans are invoiced by Joy Labs Ventures through Laneful's billing, and any payment information you give to pay an invoice is handled as described in the Laneful privacy policy;
• precise geolocation;
• biometric information;
• government-issued identifiers;
• demographic or other sensitive categories of information (such as race, religion, health or sexual orientation);
• the contents of your mailbox: GoodSender sends email and does not read your inbox; or
• the contents of your conversations with an AI assistant. The MCP connector receives only the inputs of the tools your assistant calls. See Section 5.

4. How we use information

We use personal information to:

• Operate the Services. Create and secure your account, run your workspace, host your blog, render previews, and show you your subscribers, sends and engagement.
• Send on your instruction. Deliver the email you ask us to send, post to the platforms you connect, and write DNS records you authorize.
• Enforce consent. Custom email to a new recipient is held until that recipient agrees to a consent request we send on your behalf. Built-in transactional templates (one-time codes, multi-factor enrollment, new-device sign-in, password or email changes, order receipts) send immediately. We record each recipient's decision so we never send custom email to someone who has not agreed or who has declined.
• Prevent abuse and protect deliverability. We apply daily and monthly sending quotas and a minimum consent rate per sender. We keep a small random sample of the email sent from each workspace so we can review it for spam and abuse. We rate-limit subscribe forms and AI features. We record bounces, complaints and unsubscribes so we can honor them.
• Provide AI features. Two features inside GoodSender use Anthropic's Claude models: metadata suggestions for a post (title, summary, tags) and the blog design chat. For these we send the post or design prompt you are working on to Anthropic's API. The design chat can also fetch a web page you name, through ScrapingBee, so the model can see it. These features are separate from the MCP connector described in Section 5.
• Measure and improve the Services. Website analytics, error reports and MCP telemetry help us find what breaks and what is used.
• Communicate with you. Answer support requests and send service messages about your account. We send you our own product updates only once you have agreed to them through the same consent request we use for everyone else.
• Comply with law and protect rights. Meet legal obligations, respond to lawful requests, enforce our terms, and protect the Services, our users and others.
• Business transactions. Evaluate or complete a merger, acquisition, financing or sale of assets.

No sale, no cross-context advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined under U.S. state privacy laws.

No AI training on your content. We do not use your posts, email, recipient lists or other workspace content to train artificial intelligence or machine-learning models. Anthropic, the AI vendor we use, processes our requests under its commercial API terms, which do not permit it to train its models on that data.

De-identified information. We may create aggregated or de-identified statistics, such as counts of tool calls or sends, and use them for any purpose, provided they cannot reasonably be used to identify you.

5. AI assistants and the MCP connector

GoodSender publishes an MCP (Model Context Protocol) server so that AI assistants such as Claude, and any other MCP-compatible client, can create posts, manage recipients and send email in your workspace on your instruction. This section explains what that server receives, stores and sends.

What the connector receives. Your assistant decides which GoodSender tool to call and with what inputs. The server receives only those tool inputs (for example, a post title and body, or a recipient's email address) together with the credential that identifies your workspace. It does not receive your conversation, your assistant's memory, your chat history, conversation summaries, or files you have shared with your assistant, and it has no way to request them.

Anthropic is not a processor of your GoodSender data. The connector calls GoodSender's own API, which Joy Labs Ventures operates. What Claude does with your conversation, including what it chooses to pass to a tool and what it does with a tool's result, is governed by Anthropic's own privacy policy and terms, not by this policy. The same applies to any other assistant or MCP client you connect.

Signing in from an assistant (OAuth). When you connect GoodSender to an assistant, the assistant registers itself as an OAuth client and we store its client identifier, name and redirect addresses. You sign in to GoodSender and choose one workspace; the connection is bound to that workspace and cannot reach your others. We then issue tokens with these lifetimes:

• authorization request: 15 minutes;
• authorization code: 10 minutes;
• access token: 1 hour;
• refresh token: 30 days, replaced with a new one each time it is used.

You can end a connection by disconnecting GoodSender in your assistant, or by asking support@goodsender.com to revoke it. The dashboard shows whether an assistant is connected to a workspace but does not list individual connections.

What the hosted server stores. The hosted server at mcp.goodsender.com keeps a separate, isolated store for each workspace that connects to it. That store holds:

• the API key or OAuth credential for the workspace, encrypted with a key held only by the server;
• custom emails waiting for a recipient's consent, including their subject, body and recipients, until they are sent or declined;
• a working copy of the workspace's recipients, groups, sender addresses and custom templates, synchronized from the GoodSender API as tools need them; and
• short-lived working data: template previews, temporary drafts and confirmation tokens. Confirmation tokens expire after 10 minutes, and the rest is evicted on a size and time limit.

The store lives on a persistent disk attached to a server in the United States that Joy Labs Ventures operates, behind a Google Cloud load balancer that terminates TLS. We keep a workspace's store between sessions, so an assistant that reconnects later finds its pending emails and working copies in place. We do not purge it on a schedule; it is removed when you ask us to remove it.

Telemetry. For each tool call the hosted server records the workspace identifier, the tool name, whether the call succeeded, how long it took and, when it failed, the error message truncated to 512 characters. It does not record tool inputs or tool results. Error messages can contain fragments of what was passed to the tool, for example an email address that failed validation. This telemetry goes to GoodSender's own metrics and tracing systems, not to a third-party analytics vendor.

Running the server on your own computer. The same server runs locally in Claude Desktop, the GoodSender CLI and similar setups. There, the workspace store is a file on your own device, under your control. The local server sends the same telemetry described above, using your API key to identify the workspace, unless you turn it off by setting GOODSENDER_TELEMETRY=false. Everything else in this policy applies to the GoodSender API your local server talks to.

6. Cookies and analytics

Signed-in sessions. The GoodSender dashboard keeps you signed in using browser storage written by Firebase Authentication. This is strictly necessary to operate the Services.

Website analytics. In production, goodsender.com loads Google Tag Manager, which loads Google Analytics 4. Google Analytics sets cookies (such as _ga) and collects your IP address, device and browser information, the pages you visit and events such as sign-up steps. We send page paths that could identify a workspace or post only in a generalized form. Google's privacy policy is at https://policies.google.com/privacy, and you can opt out with the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. We do not currently show a cookie banner.

Error reporting. Sentry runs on goodsender.com in production for error reporting only. It does not use session replay and we strip cookies and user details from what it sends.

Blogs we host for you. We put no analytics tag of our own on the blogs we host. If you add your own Google Analytics or Tag Manager identifier in your blog settings, your tag runs on your blog under your own Google account and your own responsibility.

No advertising cookies. We do not use advertising cookies, retargeting pixels or similar tracking for cross-context behavioral advertising.

Your choices. You can block or delete cookies in your browser. Because we do not sell or share personal information for cross-context behavioral advertising, there is no additional opt-out to honor, but we will treat a Global Privacy Control signal as an opt-out request where applicable law requires it.

7. How we share information

We share personal information only as described below.

Service providers. Companies that process information on our behalf, under contracts that restrict their use of it:

Platforms you connect. When you connect a destination and ask us to post there, that platform receives your post content and acts under its own privacy policy. Today those are X, LinkedIn, Bluesky, Mastodon, Dev.to and Hashnode. When you connect Cloudflare, we write DNS records into your Cloudflare zone and nothing else. We share nothing with a platform you have not connected.

Affiliates. Joy Labs Ventures, LLC operates GoodSender and Laneful as one company. Information moves between the two products as needed to provide the Services.

Legal and safety. We may disclose information to comply with law, legal process or lawful requests from public authorities; to enforce our agreements; to protect the rights, property or safety of GoodSender, our users or others; or to investigate and defend legal claims.

Business transfers. If Joy Labs Ventures is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred to the successor, subject to customary confidentiality protections and, where applicable, notice.

With your direction. We share information in other cases when you ask us to.

No sale. We do not sell personal information and have not done so in the 12 months before the date above.

8. Data retention

We keep personal information for as long as needed for the purposes in this policy, then delete or de-identify it. Specific periods:

We may keep information longer when the law requires it, to resolve disputes, to enforce our agreements, or to maintain records of abuse and security incidents.

9. Security

We use administrative, technical and physical safeguards designed to protect personal information, including:

• TLS encryption for the website, the API and the hosted MCP server;
• API keys stored as SHA-256 hashes, never in plain text;
• API keys held by the hosted MCP server encrypted with AES-256;
• connected-platform credentials stored encrypted;
• authentication by Firebase Authentication, with OAuth 2.1 and PKCE for AI-assistant connections and refresh tokens that rotate on use;
• isolation of each workspace's data by workspace identifier across the database and the hosted MCP server; and
• access to production systems limited to the people who operate them.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your API keys and connected-account credentials private, and tell us at support@goodsender.com if you suspect unauthorized use of your account.

10. International transfers

Joy Labs Ventures is based in the United States and the Services are hosted there: our Google Cloud resources run in the us-central1 region, and the hosted MCP server runs on a server in the United States. If you use the Services from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those of your country. Where applicable law requires it, we use appropriate safeguards for those transfers.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate information;
• delete your information, subject to the exceptions in Section 8;
• object to or restrict certain processing;
• opt out of sale, sharing or targeted advertising, which we do not do; and
• appeal a decision we make on your request.

To exercise these rights, email legal@joylabsventures.com. We will verify your identity, which may mean asking you to confirm information we already hold or to sign in. We will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask for proof of their authority.

If you are a recipient, subscriber or reader. The GoodSender user who contacted you controls your information, and you should direct requests to them. You also have direct controls: every consent request we send carries a link where you can agree or decline, and a decline stops custom email from that sender. If you contact us directly, we will handle your request in line with applicable law and the user's instructions, which may mean passing it to the user or helping them respond.

Marketing from us. We send our own product updates only to people who have agreed to them through a consent request. You can withdraw that at any time using the link in any such email or by writing to support@goodsender.com. We may still send service, security and account messages.

California residents. Appendix A lists the categories of personal information we collect, as the California Consumer Privacy Act requires. California Civil Code section 1798.83 lets California residents ask about disclosures to third parties for their direct marketing; we make none.

12. Children

The Services are not directed to, and are not intended for, anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us at legal@joylabsventures.com and we will delete it as the law requires.

13. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version at https://goodsender.com/privacy and change the "Last updated" date at the top. Where the law requires it, we will give additional notice. Your continued use of the Services after the updated policy takes effect means you accept it, to the extent the law allows.

14. Contact

• Product and account questions: support@goodsender.com
• Privacy rights requests and legal questions: legal@joylabsventures.com
• Postal address: Joy Labs Ventures, LLC, 15333 Culver Drive #340-2120, Irvine, CA 92604, United States

Appendix A. California categories of personal information

This table covers personal information we collect for our own purposes as a business in the 12 months before the "Last updated" date. It does not cover recipient, subscriber or reader information we process on a GoodSender user's behalf as a service provider.

Categories not collected. In the 12 months before the "Last updated" date we did not collect characteristics of protected classifications, biometric information, precise geolocation, audio or visual information, professional or employment information, non-public education information, or inferences used to build a profile about you.

No sale or sharing. We have not sold personal information or shared it for cross-context behavioral advertising in the 12 months before the "Last updated" date, and we do not sell or share the personal information of anyone we know to be under 16.