Effective September 20, 2026

Privacy policy

Unboxed Mail is designed to minimize the mail data handled by our service. Message content and private intelligence stay on your device.

Data on your device

The app downloads Gmail messages, contacts found in message headers, attachments you open, drafts, labels, and mailbox state so it can work quickly and offline. This local store is encrypted and protected by iOS file protection. On compatible devices, summaries, commitments, decisions, and classifications are processed locally with Apple-provided on-device models. We do not receive that model input or output.

Data used for push notifications

To deliver new-mail notifications after the app is closed, our push service processes your Gmail address, an OAuth refresh token, an Apple Push Notification device token, Gmail history identifiers, and message or thread identifiers. These values are encrypted before storage. Notification text is generic; the service does not request or store message subjects or bodies.

Google user data

Unboxed Mail uses Google user data only to provide the email features you request. We do not use Google user data for advertising, credit decisions, or training general-purpose AI models. We do not sell it or transfer it to data brokers. Human access is prohibited except with your affirmative consent, for security or abuse investigation, to comply with law, or when data is aggregated and anonymized for internal operations. Our use and transfer of Google API data complies with the Google API Services User Data Policy, including its Limited Use requirements.

Remote images and links

Remote images are blocked by default so senders cannot learn that you opened a message. If you choose to load them, your device connects to the sender’s image host. Opening a link takes you to the linked service, whose privacy practices apply.

Service providers and retention

Google Cloud stores encrypted push registration and delivery state. Apple delivers notifications and distributes the beta through TestFlight. We retain push registration data while an account is connected and remove active records when you disconnect it. Encrypted residual copies may remain temporarily in provider backups and security logs before aging out under their normal retention schedules.

Your choices

You can disable notifications, remote images, and private intelligence in Settings. You can disconnect any Gmail account to remove its local data, revoke its Google authorization, and unregister it from push. See Delete account data for detailed steps.

Security and children

We use encryption in transit and at rest, least-privilege service accounts, signed webhook authentication, and access controls. No system can guarantee absolute security. Unboxed Mail is not directed to children under 13.

Contact and updates

Questions or privacy requests can be sent to eric@unboxed.ventures. We will post material policy changes here and update the effective date.