Private from the recipient.
Honest about the rest.

What the recipient sees

The email comes from Nastygram, not your address. Business conversations do not show your account name or email. Context, timing or writing style can still identify you. ChatGPT drafts and repairs the candidate; Nastygram independently validates it without rewriting. AI can miss identifying clues or unsupported claims. Avoid unnecessary sensitive information and ask for an optional preview if you want to inspect the exact candidate.

How information is handled

ChatGPT composition happens in your conversation and is subject to your host settings and limits. Nastygram receives the relevant original feedback, candidate and minimum recipient context to independently validate and deliver only approved text. The manual website path and replies use the same exact text as original and candidate; the server never rewrites it.

Website and plugin access use one Nastygram email-code account. The private identity service stores account email details, sessions and OAuth authorization/revocation records separately from application feedback data. Session cookies and OAuth grants authorize access; purported identity headers and possession of an email From address do not. Never enter sign-in or business verification codes in chat.

The application stores keyed account/recipient references, timestamps and bounded verdict/delivery/opt-out records for authorization, abuse prevention and duplicate protection. These references are pseudonymous and linkable. Approved recipient, final text and necessary delivery context are encrypted at rest in the outbox. Only approved payloads are eligible for dispatch; automatic delivery attempts stop within 24 hours and eight attempts. Unknown or crashed provider acceptance is not automatically retried. Expired or terminal delivery copies are cleared by private maintenance; physical cleanup can wait if maintenance stops.

At dispatch, an owner-only encrypted journal retains the destination and exact approved final text, including accepted sends, without automatic expiry. It is not a journal of original rough notes or rejected candidates. Optional sender history and shared conversations have their own retention below. Record a verified deletion request in Account & privacy controls for operator review. Messaging, identity, AI and hosting providers may separately retain content and metadata under their policies.

Content-free service activity

Nastygram also keeps content-free activity records for completed business inbox verification and first observed valid feedback attempts, including failed attempts. Administrator reads contain an event kind, time, processing source and a purpose-specific keyed reference. Stored records additionally use existing keyed account IDs and opaque business inbox IDs to link deletion; they contain no feedback text, sender or recipient email, business name or account name. These references remain pseudonymous and linkable, not guaranteed anonymous. All activity event kinds and sources, including unlinked inbound-email events, expire twelve UTC calendar months after occurrence. The anniversary preserves the original UTC time and milliseconds; an invalid day is clamped to the target month’s last valid day. Expired events disappear from administrator reads immediately. Physical deletion is a batch of up to 200 rows per invocation of the private scheduled maintenance path, with no independent schedule. Expired rows can remain physically stored indefinitely if that path stops running. A new first-attempt event may be recorded after a former event expires; returning during an active event window does not extend its deadline. Actual Nastygram account deletion removes its linked account-attempt and claimant-signup records; business inbox deletion removes its signup record. Conversation erasure, hiding, stopping history and access revocation are separate actions and do not remove activity records. Request broader account or business deletion through support; an authenticated request records your verified scope for operator review; it does not immediately erase data. Inbound-email identities are not automatically linked to Nastygram accounts, so deleting an account does not remove an unlinked email-origin event. Copies already read elsewhere cannot be recalled. Historical preview-only use cannot be reconstructed.

Failed review diagnostics

The new validator keeps bounded verdicts, issue codes, non-content usage/cost/latency totals and keyed deduplication references. It does not persist original or rejected candidate text, attempted rewrites, raw provider output or chain of thought in its accounting ledger. In-flight and unknown requests retain their spend reservation; deletion de-links account references while preserving active-window accounting totals so it cannot reset spend caps.

Historical failed-review diagnostic records follow their existing seven-day policy. They may contain encrypted original drafts and old attempted edits for owner-only inspection. A permitted replay now independently validates the exact retained original without rewriting, sending or issuing a preview token; replay results expire with the original record. Expired records are inaccessible and removed during bounded cleanup or diagnostic access. This legacy policy is separate from the new content-free validator ledger, approved journal and optional history.

Private dashboards and replies

Use the same Nastygram email-code account on the website and plugin. This rollout starts with fresh accounts: old sessions, history and business claims do not migrate. Recreate your account and reverify each business inbox. Suppression protection must be reconciled before new delivery is enabled; an old claim, signed link or session is not new account authority.

Activating optional sender history allows encrypted approved final messages and destination details to be retained for up to 365 days. Shared eligible account conversations also retain their final text and replies for up to 365 days. Original rough notes and rejected candidates are not saved as new dashboard history. Browser recovery of recent sent copies and the old mailbox hydration endpoint are retired; activation does not restore old sends or resend a message.

A verified business can receive eligible new feedback directly in its private dashboard. Optional link-only email alerts contain no feedback text or sender details. Business staff do not receive the sender’s account name, email or identifier. Businesses start eligible private conversations and customers can answer. Exact reply text is independently validated before authorized publication; it is never rewritten. Intentional authorized business identity can remain in a business reply, but anonymous sender identity must not be disclosed. No purchase or paid plan is required in this release.

Dashboard reads do not automatically mark messages read. Expired content stops appearing even if physical cleanup is delayed. Private scheduled maintenance performs bounded cleanup. Spend and usage records are removed after their active accounting windows close. Minimal keyed replay references and check results remain until verified account deletion to prevent duplicate processing; deletion fences can remain to prevent restoration. Hiding, stopping optional history, exporting and erasing conversation content are different actions. Shared erasure requires explicit confirmation and stops new replies, but does not recall recipient/provider copies or itself perform full account deletion.

Verified account deletion is an operator-reviewed workflow that fences affected validation/dispatch and handles linked identity sessions, OAuth grants, mappings, approved payloads, journals, conversations and activity. Business-inbox deletion scopes shared business records rather than every other sender’s private journal. Recording a request does not immediately erase data. Active workers and unknown provider acceptance must be reconciled without resending; provider/mailbox/log/backup copies require separate review. Content-free deletion fences and duplicate records prevent restoration or replay. Use support for broader verified requests.

Reply drafts and pending exact reply attempts may remain in this browser tab’s session storage, scoped to the account, inbox and thread, so an uncertain request can reuse its reference. They clear after success, sign-out/account change or the end of the tab session. Restoring a draft never sends automatically. Content returned to ChatGPT is subject to your conversation settings there. Private sender, business and administration dashboards do not load Clarity.

Business claims store name, location/inbox description, encrypted contact address, verification status and audit evidence. Website-only single-use business codes expire after 15 minutes, permit five attempts and are stored as keyed hashes. This proves control of the exact mailbox, not legal business ownership or other addresses. Account sign-in codes have a separate ten-minute expiry and separate throttles. Configured administrators can inspect bounded platform metrics, claim evidence and report reasons under the same service authorization on website and plugin; this does not grant unrestricted sender identity access.

Business research and partner requests

If you share feedback on our business concept, we store your business name, contact name, email address, answers about value and price, optional feedback on the name and branding, and submission time to evaluate the proposed offer and follow up about your answers. This does not enroll you in a subscription or marketing list. Earlier partnership requests may also include an optional website. These records are separate from anonymous customer messages. Business form fields are marked for masking in Clarity recordings. These records are retained while evaluating the pilot offer and following up on the submission. An operator reviews erasure when that purpose ends or a verified request is received, subject to documented legal or abuse-prevention needs. This is a manual lifecycle; no automatic research-record expiry is configured.

Website analytics

Clarity loads only on query-free public home and business pages on our production domains. Local development and preview hostnames do not load it. Private dashboards, support and policy pages do not load it. Public links to private destinations use a new document so a public recording does not share the private page lifecycle. We use Microsoft Clarity to understand website usage through interaction data and session recordings. The message composer, including feedback and recipient details, is marked for masking in Clarity recordings. Consent behavior, masks and route restrictions are source controls; actual payload/recording and project-retention verification remains a rollout gate. Cookie-consent denial does not necessarily imply zero telemetry. Microsoft processes analytics data under its privacy statement.

Restaurant subscriptions

This release offers no purchases, payment collection or paid-plan enforcement. Business verification and eligible replies do not require payment. Historical payment/provider records, where any are retained, have a separate verified deletion and reconciliation scope; this rollout does not claim automatic erasure of provider billing records. Any future paid offer requires its own disclosed terms and release decision.

Business inbox profile

Business owners can optionally select a broad business type when claiming an inbox and change it later. Existing inboxes without a selected type stay unspecified. This owner-selected profile describes the verified inbox, including any locations sharing its email address; it is separate from historical message labels and does not change routing or activity totals.

Feedback analytics

Nastygram reports deterministic delivery, reply, claim and activity counts with documented scopes and time windows. Keyed account references and opaque thread/inbox IDs support authorization, duplicate protection and linked deletion; they are not guaranteed anonymous. No new automatic AI categorization, generative theme analysis or background drafting is enabled for this release. An owner-selected broad business profile is separate from any historical classification labels. Raw feedback, account email, codes and tokens must not enter public analytics events.

Private administrative views and service analytics are separate from Clarity and do not load its recordings. Historical mailbox copies or classifications follow their existing provider/record policies and do not prove a current automatic processing feature. Provider acceptance in a count is not evidence of inbox placement or reading.

Anonymous conversations

Eligible account-delivered feedback can support a private exchange: the verified business replies first and the customer may answer. Both sides need current service authorization. Replies are encrypted at rest and transported over HTTPS, not end-to-end encrypted. They use independent validation of exact authorized text without rewriting. Account names and sender email are not shared, but text can identify people. Authors can stop replies or explicitly erase retained shared content. No purchase or paid entitlement is required in this release.

Sending and delivery

ChatGPT drafts and repairs in the conversation. Direct authorized submit validates the supplied original/candidate and may durably accept the exact approved payload; optional preview validates only and queues nothing. Original and candidate are each limited to 1,200 characters. One operation allows at most three provider attempts; only rejection permits a repair revision. A preview approval token expires after ten minutes and is bound to its account, operation, recipient, policy and exact final bytes.

Accepted means durable outbox acceptance, not delivered, inbox placement or reading. A paused result means nothing was accepted or sent. Safe retries use only approved bytes, never AI, and stop within 24 hours/eight attempts. Ambiguous acceptance or a crashed dispatch becomes unknown; automatic resend stops. Checking a receipt does not create a new send. Delivered copies cannot be recalled. SMS is unsupported.

Incoming structured email retains provider-signature and routing checks, but a From address or provider signature does not prove linked account authorization. That route currently requires action in the authenticated manual website flow or ChatGPT; it does not automatically compose, validate or deliver. This is a rollout limitation, not an alternative way around account or validation controls.

Ground rules and opt-out

Feedback should be about a real experience. Threats, hate, targeted harassment, impersonation and spam are not allowed. Each sender can submit up to three messages per rolling hour and ten per rolling 24 hours to the same recipient.

Every Nastygram email includes an opt-out link. Recipients can use it to stop future Nastygram messages to that address.