HIPPOMANGO
Privacy policy
Last updated: October 19, 2026
HippoMango is operated by Jonathan Lindahl. This policy describes our agency website, public Email Check tool and private Gmail scanner. Questions or deletion requests can be sent to [email protected].
1. Agency website
Our website, hippomango.com, describes our services and lets you contact us about a project.
Inquiries
The inquiry form collects your name, work email, brand website, requested service and message. Email platform and budget range are optional. Submission timestamps and a form subject are also recorded. Please do not submit passwords or customer data.
Submissions are sent to Formspree, stored in its submissions dashboard and used to deliver and respond to your inquiry. Related correspondence may also be retained in our Google Workspace mailbox. These records do not have a fixed automatic deletion schedule established by this website. Contact us to request deletion; records needed for ongoing services or applicable recordkeeping obligations may need to be retained. Submitting an inquiry does not subscribe you to a newsletter. We do not sell inquiry information or use it to serve targeted advertisements.
Hosting, fonts and browser storage
Cloudflare Pages hosts the website. Cloudflare processes network information, including IP addresses and request information, to deliver and protect the site. Its platform may process logs and security information under its own policies.
The website loads Inter and Space Grotesk from Google Fonts. Your browser connects to Google to retrieve stylesheets and fonts, disclosing network information such as your IP address and user agent. Form contents are not sent to Google Fonts.
The website application code does not set cookies, use local storage, include analytics trackers or provide a newsletter signup. Hosting and security services may use their own technical mechanisms. Links to LinkedIn, GitHub and the separate Email Check application take you to those services; they are not embedded social feeds.
Provider policies: Cloudflare, Formspree and Google.
2. Public HippoMango Email Check
The public tool at hippomango-email-check.onrender.com checks pasted email HTML or an uploaded .eml message and returns a report. It requires no account or Gmail connection.
Email content and reports
Email content is processed for the submitted request and is not retained in an application database. The report is returned to your browser rather than saved as a public report page. Copies you download or save remain wherever you choose to store them.
Uploads larger than approximately 500 KB may be spooled to a temporary file by the server framework during processing. These temporary files are closed and removed as part of normal request cleanup. Pasted HTML is processed in memory by the application. These statements describe application handling, separately from hosting-provider operations.
Usage records and feedback
Scan records retain a timestamp, input type, sample/template indicators, finding counts and check counts, without the submitted email body. Failed-submission records retain a timestamp and a reason category such as empty, unsupported or oversized. These records have no automatic expiration.
Feedback retains your usefulness response, optional comment and scan context for 90 days, after which the application purges it. Feedback records do not include an IP address. Free-text comments may contain personal information you enter, so do not paste email content or sensitive information into feedback.
Rate limiting and service providers
For rate limiting, the application holds an IP-derived hash in memory using a secret regenerated when the server restarts. The application does not persist that hash or the raw IP address in its scan records. This does not describe logs maintained separately by the hosting provider.
Render hosts the checker and processes requests and potentially platform/access logs under its privacy policy. The checker is configured without application access logging of individual requests. Google Fonts supplies Archivo, IBM Plex Sans and IBM Plex Mono on the checker pages; Google receives browser network information when fonts are requested.
The checker application sets no cookies and includes no analytics trackers. It uses programmed rules rather than AI or machine learning. Its checking process does not send submitted email content to an AI service or use it to train models.
3. Private Gmail scanner
HippoMango Email Scanner is a private tool operated by Jonathan Lindahl for his own authorized mailbox. It is separate from the public checker and is not offered as a public Gmail-connection service. Messages in that mailbox may contain senders’ names, email addresses, tracking identifiers and other personal information.
Access and purpose
The scanner requests the Gmail read-only scope, https://www.googleapis.com/auth/gmail.readonly, to retrieve marketing emails and produce email-quality findings. This scope permits mailbox reading; the application narrows retrieval using a configured search query for brand-subscription addresses. That query is an application filter, not a Google-enforced limit on the OAuth permission. The scanner does not send, label, modify or delete Gmail messages.
Storage and deletion
Matching messages are stored in a PostgreSQL database on the operator’s computer. Stored information includes subjects, sender addresses, received dates, HTML and plain-text bodies, recipient information, List-Unsubscribe headers, extracted links and findings. The scanner has no automatic expiration for these records; deletion is manual. Revoking Gmail access stops future authorized retrieval but does not delete previously imported database records or messages in Gmail.
OAuth access and refresh tokens are stored locally in a file excluded from version control. Tokens are transmitted to Google as needed for authentication and API requests; they are not intended for publication or sharing. Authorization can be revoked through Google Account connections.
External requests
Optional link checks are disabled by default and run only for brands with recorded permission. When enabled, requests disclose the requested URL and network information to the destination and any redirect services. URLs extracted from emails can contain recipient-specific tracking identifiers, and visiting them may register a click. The scanner does not send the full email body as part of a link check.
Optional Klaviyo connections read flow and template content from accounts the operator controls; Gmail messages are not uploaded to Klaviyo. The scanner’s automated processing contains no AI/ML component and does not send email bodies to AI services.
Google API data
HippoMango’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Google API data is used for the scanner’s email-quality review and reporting functionality. It is not sold, provided to data brokers, used to serve advertisements or used to train generalized AI/ML models. Access is limited to the operator and any access specifically permitted by the applicable Google policies, such as necessary security or legal handling. Any permitted transfer must meet those policies’ purpose and consent requirements.
4. Your choices and requests
Contact [email protected] to ask about information held about you or request access, correction or deletion. Applicable rights depend on your location and the circumstances. Provide enough information to identify the relevant inquiry or record without sending unnecessary sensitive information.
Public-checker email bodies are not retained as application records after processing. Feedback comments and agency inquiries may be identifiable from the information you supplied. Scanner records require manual deletion. Provider-controlled records are also subject to the relevant provider’s policies.
5. Children and policy updates
These services are intended for professional and business use, not for children. If you believe a child has provided personal information, contact us so we can investigate and address it.
We will update this page and its date when these practices change. Material changes to Google API data use will be disclosed and any required consent obtained before that new use.
Contact: Jonathan Lindahl · HippoMango
[email protected]