Privacy Policy

Effective date: July 5, 2026

Hero Wiki ("the App", available at hero.wikiproperty.my) is an email campaign tool that lets a registered user connect their own Gmail account and send email campaigns to recipient lists they upload. This policy explains what data the App collects, why, and how it is used.

Who runs this

The App is operated by Isaac Chee. Contact: wikiproptrading@gmail.com.

Data we collect

• Account data: the email address and password (stored as a bcrypt hash, never in plain text) you register with.
• Campaign data: campaign names, email subject/body content, and recipient lists (email addresses and optional names) you upload to send a campaign.
• Send/engagement data: per-recipient send status (sent, opened, failed) and open-tracking events, so you can see campaign results.
• Gmail connection data: if you connect your Gmail account, we store your Gmail address and an OAuth refresh token. The refresh token is encrypted at rest (AES-256-GCM) and is never shown to us or anyone else in plain text.

How we use Google user data (OAuth scopes)

When you click "Connect Gmail," Google asks you to grant the App one scope:

• https://www.googleapis.com/auth/gmail.send — used exclusively to send the campaign emails you compose, from your own Gmail address, when you click "Send now" or when a scheduled send you configured runs. The App never reads your inbox, never searches your mail, and never sends anything you did not compose in the App.
• https://www.googleapis.com/auth/userinfo.email — used once, right after you grant access, to confirm which Gmail address you connected and display it back to you.

Google user data obtained through these scopes is used only to provide the sending feature described above. It is not used for advertising, not sold, and not shared with any third party. The App's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention and deletion

Your account, campaign, and recipient data are retained until you delete your account or ask us to delete it. Disconnecting Gmail from the App's dashboard immediately deletes your stored refresh token. To request full account deletion, email wikiproptrading@gmail.com.

Data sharing

We do not sell or share your data with third parties. Recipient email addresses you upload are used only to send the campaigns you create and are never used for any other purpose.

Security

Passwords are hashed with bcrypt. Gmail refresh tokens are encrypted at rest with AES-256-GCM. All traffic to the App is served over HTTPS.

Changes to this policy

If this policy changes, the updated version will be posted at this same URL with a new effective date.