Privacy Policy — Unleashed Mail

Unleashed Mail ("we," "our," or "the App") is a native macOS email client developed by Unleashed Services. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights regarding your information.

Key principle: Unleashed Mail is a local-first application. Your email data is stored exclusively on your device in an encrypted database. We do not operate servers that store your data.

1. Information We Collect

1.1 Information You Provide Directly

Email account credentials (OAuth tokens) — stored in macOS Keychain
AI API keys (if you provide custom keys) — stored in macOS Keychain
Email signatures — stored in local encrypted database
App preferences and settings — stored in macOS UserDefaults

1.2 Information from Connected Services

When you connect your email account, the App accesses data from your email provider using OAuth 2.0 authorization that you grant:

Email messages (subject, body, headers, metadata) — for displaying and managing your email
Contacts (name, email, photo) — for autocomplete and display
Calendar events — for calendar integration
Tasks — for task management
Labels and folders — for organizing your email

All data from connected services is stored only on your device in a SQLCipher-encrypted database (AES-256). We never copy, proxy, or store this data on our servers.

1.3 Information Generated by the App

Local drafts and scheduled emails — for offline composition and delayed sending
AI-generated summaries and extracted tasks — for AI assistant features
Writing style profiles — for AI personalization
Search index — for fast email search
Semantic embeddings — for AI-powered search

1.4 Information We Do NOT Collect

Location data
Device identifiers or advertising IDs
Browsing history
Usage analytics (no analytics service is integrated)
Biometric data (Touch ID verification stays in macOS Secure Enclave)

2. How We Use Your Information

We use the information described above solely to:

Provide email functionality — syncing, displaying, composing, and sending email through your provider's API.
Enable AI features — summarization, drafting assistance, task extraction, and smart search.
Personalize your experience — learning your writing style, remembering preferences, and organizing your inbox.
Maintain security — encrypting local data, managing authentication tokens, and isolating multi-account data.

We do not use your data for advertising, profiling, or selling to third parties.

3. Information Shared with Third Parties

Unleashed Mail connects directly to third-party services on your behalf. We do not operate intermediary servers.

3.1 Email Providers

Google (Gmail, Calendar, Tasks, Contacts) — OAuth tokens and email content per your authorization. See Google's Privacy Policy.
Microsoft (Outlook, Exchange) — OAuth tokens and email content per your authorization. See Microsoft's Privacy Statement.

3.2 AI Providers

AI features are optional and user-initiated. When you use an AI feature, the App sends a prompt to your configured AI provider.

Google Gemini (default) — PII-redacted prompt text
OpenAI — PII-redacted prompt text (if you configure it)
Anthropic — PII-redacted prompt text (if you configure it)
Apple Intelligence — local processing only, no data transmitted

PII Redaction: Before sending any content to AI providers, the App automatically strips personally identifiable information including email addresses, phone numbers, social security numbers, credit card numbers, API keys, and passwords.

No training: Per the terms of the AI providers we support, data sent via API is not used to train their models.

3.3 Apple Services

Apple Push Notification Service — device notification token only (no email content)
Apple StoreKit — purchase metadata managed by Apple

3.4 Crash Reporting (Planned)

We plan to integrate Sentry for opt-in crash reporting. If enabled, it will collect stack traces, device model, OS version, and app version — no email content or PII. This section will be updated when implemented.

3.5 No Other Sharing

We do not share, sell, rent, or trade your personal information with any other third parties. We do not use third-party analytics, advertising networks, or tracking SDKs.

4. Legal Bases for Processing (GDPR)

If you are in the EEA, UK, or Switzerland:

Contract (Art 6(1)(b)) — Email content, OAuth tokens, calendar, tasks, drafts, signatures: necessary to provide the email client service.
Legitimate Interest (Art 6(1)(f)) — Contacts, AI personalization: improving user experience. You can opt out via settings.
Consent (Art 6(1)(a)) — Crash reporting (when implemented), biometric authentication: you explicitly opt in.

5. Data Retention

Email messages — until you delete them or remove your account
OAuth tokens — until you sign out
AI-generated data — until you delete them (Settings > AI > Privacy)
AI activity logs — auto-purged after 30 days
App preferences — until app is uninstalled

6. Data Security

Database encryption: AES-256 via SQLCipher. The encryption key is stored in macOS Keychain and never exposed in plaintext.
Keychain security: OAuth tokens and API keys use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly — not synced to iCloud.
Network security: All API communication uses TLS 1.2+. Certificate pinning on email provider connections.
Multi-account isolation: All database queries filter by account to prevent cross-account data leaks.
OAuth 2.0 PKCE: Proof Key for Code Exchange prevents authorization code interception.
AI safety: Automated PII redaction, input/output validation, and prompt injection protection.

For more details, see our Security page.

7. International Data Transfers

Unleashed Mail stores all data locally. When you use connected services, data is transmitted to provider servers in various locations:

Google servers (various global locations) — for Gmail, Calendar, and Gemini AI
Microsoft servers (various global locations) — for Outlook/Exchange sync
OpenAI servers (United States) — if configured as AI provider
Anthropic servers (United States) — if configured as AI provider

These transfers are governed by each provider's data protection agreements and, where applicable, Standard Contractual Clauses for EEA transfers.

8. Your Rights

All Users

Access: All data is stored locally on your device.
Deletion: Delete AI data via Settings > AI > Privacy. Remove accounts to delete all data for that account.
Control: Disable AI features, crash reporting, or biometric authentication at any time.
Portability: Export email via your provider's tools (Google Takeout, Microsoft export).

European Users (GDPR)

You have the right to access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), data portability (Art 20), objection (Art 21), and to lodge a complaint with your data protection authority.

California Users (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share your personal information.

To exercise any of these rights, contact us at [email protected].

9. Children's Privacy

Unleashed Mail is not directed at individuals under 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will include a version number increment and in-app notice. Continued use after changes constitutes acceptance.

11. App Store Privacy Nutrition Label

Category	Collected	Linked to Identity	Used for Tracking
Email Address	Yes (account setup)	Yes	No
Contacts	Yes (with permission)	No	No
Emails	Yes (local only)	No	No
Crash Data	Planned (opt-in)	No	No
Location	No	N/A	No
Usage Data	No	N/A	No
Identifiers	No	N/A	No

12. Contact Us

For privacy-related questions, data access requests, or concerns:

Email: [email protected]
In-app: Settings > Support

Data Controller: Unleashed Services