Access and your data

When to use it

Use this guide before granting access or removing a connection, so you know which permission belongs to Doorbell and which belongs to your agent.

Set it up

1. Sign in with the exact invited address using an emailed six-digit code, a password you set, or Google sign-in when offered. A +alias needs its own invitation.
2. To set or replace a password, open your email address or Account in the header. If you forget it, sign in with an emailed code first.
3. Authorize each mailbox or Slack identity under Sources. For Teams, verify your Microsoft identity and link the installation separately. Review MCP permissions and deny requests you did not start.
4. Approve capture and shared fields in the named agent's inputs. Capture changes affect every agent using that source. Slack message kinds and text permissions are controlled in Slack source settings. Keep receiver URLs and keys in secure fields.
5. Before disconnecting a source, review its impact. To erase one message, explicitly approve erase_retained_message. To delete all customer data, open Account and confirm Delete my customer data with your sign-in address.

Important limits

• Google sign-in does not grant Gmail monitoring. Doorbell's mailbox connection does not grant your agent mailbox access. Teams identity verification does not grant mailbox access.
• Doorbell does not fetch email bodies, previews, or attachments. It retains identity and approved metadata.
• Webhook capture retains declared scalars and explicitly approved bounded JSON paths, not raw requests. MCP sources retain accepted text, selected fields, receipts, and delivery copies; text is not a document-upload feature.
• Teams may retain addressed text and selected attachment descriptors, not attachment contents. Only the linked sender's agents select those messages.
• Slack requests broad history permissions but captures only selected new messages. Text is optional; group DMs require opt-in. Revocation blocks reads and queued disclosure. Reconnecting does not restore revoked content. Already transmitted content cannot be recalled.
• Read and receive access uses notifiers:read. configuration:write, configuration:destructive, credentials:write, connected-accounts:manage, and messages:publish grant separate actions. Grants are customer-wide; names and conditions do not create private agent access.
• Disconnect removes provider credentials and blocks further disclosure for that source. Other selected sources remain. In-flight requests cannot be recalled.
• Deleting an address removes its memberships and notification configuration, not canonical messages or shared webhook receivers. Erasing canonical content also scrubs derived copies; content-free retry receipts can remain for the idempotency window.
• Deleting customer data ends sessions and agent grants and removes live customer data. External workflows, already delivered content, and backups until their expiry remain outside that operation. An invitation record can remain, so data deletion alone does not revoke pilot access.

Troubleshooting

• If a sign-in code expires, request a new one and use the latest email. Codes expire after ten minutes and work once.
• If you cannot sign in, check the exact invitation address or request pilot access. For deletion after access has ended, contact privacy@agentdoorbell.com.
• If mailbox or agent access is refused, check that authorization separately rather than reconnecting an unrelated sign-in.