Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how Xenett Mail (“Xenett”, “we”, “us”) collects, uses, stores and shares information when you use Xenett Mail: the Xenett Mail web app, the Xenett Mail apps for iOS and Android, and the optional Xenett Mail extension for Google Chrome (together, the “Service”). It should be read together with our Terms of Service.

1. Who we are

The Service is provided by Xenett Mail. We are responsible for the personal information described in this policy. You can reach us about privacy at logins@xenett.com. [DATA PROTECTION OFFICER OR EU/UK REPRESENTATIVE, IF REQUIRED.]

2. Information we collect

2.1 Your Xenett account

Sign-in is handled by our authentication provider, Supabase, using “Sign in with Google” or “Sign in with Microsoft”. When you sign in, Google or Microsoft shares your basic profile with us: your name, email address, profile picture and an account identifier. Supabase stores this together with sign-in records. Our own server keeps a small copy (your user ID, name, profile picture and when you were last active). Signing in does not, by itself, give us access to your mailbox.

2.2 Mailboxes you connect

After signing in, you choose which email accounts to connect. You grant access on Google’s or Microsoft’s own consent screen, and you can connect more than one account. For each connected account we store the email address, display name, the permissions you granted, sync status, and the access and refresh tokens the provider issues to us. Tokens are encrypted before they are stored (see Security).

For a Google account we request these permissions:

For a Microsoft (Outlook) account we request these Microsoft Graph permissions:

2.3 Your mail, calendar and contacts

To run the Service, our servers fetch data from Google or Microsoft on your behalf: message lists, headers, message bodies, attachments, labels and folders, calendar events, and contacts. Most of it is passed straight through to your device. What our servers keep, and for how long, is listed in section 7. In summary:

• A cache of email bodies and images, so emails open quickly and remote images load without exposing your device to the sender.
• Mail you send, held briefly in a queue so that “undo send” and scheduled sending work, together with any attachments you upload.
• Recipient suggestions: names and addresses of people you have exchanged email with, and how often and how recently.
• A copy of your contacts from your connected accounts (names, email addresses, phone numbers, company and job title, photo link, and the rest of the contact record), refreshed automatically at most once a day while you use the app. We also add the people from your recipient suggestions.
• Calendar data for the date ranges you view: calendars, event titles, times, descriptions, locations, attendees and meeting links.
• Calendar invitations found in your emails (event details such as title, time, organizer and attendees), so the app can show them and let you respond.
• Things you set up in the app: pinned and muted conversations, snoozes and reminders (including the subject, a short snippet and the recipient), your email signatures, and your settings.

Sender pictures. When “Show avatars” is on (it is on by default), our server looks up a picture for each sender: from your connected account’s contacts or directory, from Gravatar (using a one-way SHA-256 hash of the sender’s email address), or a company logo from Google’s favicon service (using the domain of the sender’s address). These lookups are made by our server, not your device, and the results are cached. You can turn avatars off in Settings.

2.4 AI features

The Service includes optional AI features:

• Writing assistant: improve, shorten, lengthen, simplify or change the tone of text you are writing, follow your own instruction, or draft a reply.
• Meeting drafts: when you create a calendar event from an email, suggest its title, agenda, attendees, duration, location and video-call option.

AI requests are made only when you use one of these features. The AI assistant is on by default; you can turn it off in Settings, and while it is off nothing is sent to an AI provider. When you use a feature, we send the provider only what that request needs:

• the text you selected or are writing, and any instruction you type;
• the names and email addresses of the recipients, and your own name, address and AI signature;
• for replies and meeting drafts, the most recent messages of that conversation (up to 5 messages, converted to plain text, with quoted history and signatures removed, capped at about 10,000 characters), the participants’ names and addresses, and your time zone.

Our AI providers are Google (the Gemini API) and, as a fallback, OpenAI. We use their paid API services, whose terms do not permit them to use that content to train their models. [CONFIRM THE CONTRACTUAL TERMS WITH EACH PROVIDER, INCLUDING ANY ZERO-DATA-RETENTION ARRANGEMENT, BEFORE PUBLISHING.] We do not use your content to train any AI model.

We do not log the content of AI requests or the text the AI returns. We record only operational details (which feature, which provider and model, token counts, timing, whether it succeeded, and a one-way hash of your user ID), plus a count of your requests over the last 24 hours so we can apply daily usage limits. AI output can be wrong; review it before you send anything.

2.5 Calendar integrations: Zoom and Google Places

• Zoom (optional). If you connect a Zoom account, we store Zoom’s access and refresh tokens (encrypted) and your Zoom user ID and email address. When you add a Zoom meeting to a calendar event, we send Zoom the event title, start time, duration, time zone and repeat pattern so it can create the meeting. Disconnecting Zoom revokes our access at Zoom and deletes the stored tokens.
• Google Places. When you type a location into the calendar event editor, our server sends the text you typed to the Google Places API to suggest matching places. The request is made with our own key; it does not include your identity.

2.6 Notifications

• Web notifications on phones and tablets. If you turn on notifications in the web app, your browser gives us a push subscription (an address at your browser maker’s push service, plus encryption keys), which we store with your browser’s user agent. When new mail arrives, or a scheduled email could not be sent, we send a notification showing the sender’s name or address, the account and the subject. It is encrypted under the Web Push standard and delivered through your browser maker’s push service (for example Google, Apple, Mozilla or Microsoft). You can turn notifications off in your browser settings at any time.
• Desktop notifications are shown by the optional Chrome extension on your computer.
• The mobile apps ask for your phone’s permission to show notifications during setup. Your choice is stored only on your phone; the apps do not currently register your device for push notifications or send us a push token.

2.7 Diagnostics, problem reports and logs

• Automatic error reports. When the web app crashes or an action fails (for example archiving or sending), it sends us a diagnostic report: the error message and technical trace, the app version, the kind of screen you were on (not the full address, which can contain an email subject), a short list of recent app actions, your browser’s user agent, whether you were online, and your user ID if you were signed in. These reports are designed not to contain the content of your emails. An error message returned by Google or Microsoft can occasionally include an email address.
• Problem reports you choose to send. You can report a problem from the app. A report can include a description you write and, if you are reporting how a particular email displays, the full content of that one email. The app tells you exactly what will be sent and lets you preview it before you send. Reports are stored and emailed to our developers so the problem can be fixed.
• Server logs. Our servers log each request: IP address, request method and path (with credentials removed), response status and timing, and error details.

Automatic error reports are deleted 30 days after the error last occurred, and stored problem reports 30 days after you send them. Server logs are kept for about 30 days. The email copies of problem reports sent to our developers are kept for [RETENTION PERIOD FOR EMAILED REPORTS — TO BE CONFIRMED].

2.8 Your devices, cookies and local storage

• Web app. To make the app fast and usable offline, it keeps a copy of your mail in your browser’s private storage: message lists, email bodies, drafts, images, attachment details and a local search index. Your sign-in session and some preferences are kept in the browser’s local storage. When you sign out, the web app disconnects your mailboxes (see section 9) and deletes these local copies from that browser.
• Mobile apps. Your sign-in session is stored on your phone, encrypted with a key kept in the iOS Keychain or Android Keystore. The apps also store a few preferences, such as the theme, the account you last viewed and your notification choice. Signing out of the mobile app erases the session and the remembered account from the phone. It does not disconnect your mailboxes from our servers; you can do that from the web app.
• Chrome extension (optional, desktop). The extension keeps a copy of your sign-in session in the extension’s storage so it can keep you signed in, keep one app tab in charge of syncing, and show desktop notifications. It is removed when you sign out.
• Codes from email (optional). If you turn on “Fill codes from email”, we look for one-time verification codes in new mail as it arrives. A code is held only in our servers’ memory for 10 minutes, with the sender’s name and domain. It is never written to our database, our logs or push notifications. The extension fetches codes with a key made for that device, which can read recent codes and nothing else, and keeps them only until you close the browser. On other websites the extension looks only for the code field; it does not read or send anything else from the page. If you turn on “Archive the email after the code is used”, the extension tells our server when a code was used so it can archive that email.
• Cookies. We do not use advertising or analytics cookies, and the Service contains no third-party analytics or advertising code. We set one short-lived, strictly necessary cookie while you connect an account, which ties that connection to your browser and expires within 10 minutes.
• Fonts. The web app loads its typeface from Google Fonts, so your browser connects to Google when the app loads.

3. How we use information

We use the information described above to:

• provide the Service: show, search, send and organize your email; show and manage your calendar; suggest recipients and show contact pictures; send notifications you asked for; and run AI features when you use them;
• keep the Service secure and working: authenticate you, prevent abuse, apply usage limits, and find and fix errors;
• respond to you when you contact us or send a problem report; and
• comply with the law and enforce our Terms of Service.

We do not sell your information, we do not use it for advertising, and we do not build advertising profiles.

Legal bases (EEA and UK users). We process your information to provide the Service you asked for (performance of a contract); for our legitimate interests in keeping the Service secure and reliable, balanced against your rights; with your consent where we ask for it, such as for notifications or a problem report that includes an email; and to meet legal obligations. You can withdraw consent at any time.

4. Google user data and Limited Use

Xenett Mail’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, for data we receive from Gmail, Google Calendar and Google Contacts:

• We use it only to provide and improve the user-facing features described in this policy, which are visible in the app: reading, searching, sending and organizing your email, your calendar, recipient suggestions and contact pictures, notifications, and the AI features you choose to use.
• We transfer it to others only as necessary to provide or improve those features (for example to our hosting and database providers, and to our AI provider when you use an AI feature), to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.
• We do not use or transfer it to serve advertisements, including retargeting, personalized or interest-based advertising.
• We do not sell it.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalized artificial-intelligence or machine-learning models.
• We do not allow people to read it unless you have given your explicit agreement for specific messages (for example a problem report that includes an email), it is necessary for security purposes such as investigating abuse, it is needed to comply with applicable law, or it has been aggregated and anonymized for our internal operations.

5. How we share information

We share information only with the service providers that help us run the Service, when you direct us to (for example by connecting an account), or when the law requires it. Our service providers may use the information only to provide their services to us.

We may also disclose information if we believe in good faith that the law requires it, or that it is necessary to protect the rights, property or safety of our users, the public or us. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction; we will tell you before that happens, and data received from Google will be transferred only with your explicit prior consent.

6. Where information is processed

Our servers run on AWS in the Asia Pacific (Mumbai) region, India. Supabase stores its data in [SUPABASE REGION]. Google, Microsoft, OpenAI, Zoom and the other providers above may process information in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers. [TRANSFER MECHANISMS, E.G. STANDARD CONTRACTUAL CLAUSES — TO BE CONFIRMED.]

7. How long we keep information

Disconnecting a mailbox does not immediately remove cached email bodies and images; they expire on the schedule above, or sooner if you ask us to delete them.

8. Security

We protect your information with measures including:

• encryption in transit (HTTPS) for all connections to the Service;
• encryption at rest of the tokens that grant access to your Google, Microsoft and Zoom accounts (AES-256-GCM, with each token bound to the record it belongs to);
• sign-in through Google or Microsoft, so we never receive your password;
• a verified sign-in token on every request that reads or changes your data;
• cleaning and isolating email content before it is displayed, and a strict content security policy in the web app;
• loading remote email images through our server, which keeps your IP address from senders, and removing known tracking pixels;
• removing credentials from logs, and keeping email content out of AI logs and automatic error reports;
• revoking our access at Google and Zoom when you disconnect those accounts; and
• rate limits and access controls on our systems.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us at logins@xenett.com.

9. Your choices and rights

• Disconnect a mailbox. Use the account menu in the web app. We stop syncing it, revoke our access at Google, delete its connection details and tokens, and delete the data listed in section 7 as kept “until you disconnect that mailbox”. Microsoft does not let an app revoke its own access, so for an Outlook account we delete our copy of the token and you can remove the consent yourself as described below.
• Sign out. Signing out of the web app disconnects every mailbox as above and deletes the local copies of your mail from that browser.
• Revoke access from your provider. You can also remove Xenett Mail’s access at any time from your Google Account, or for a Microsoft account at account.live.com/consent/Manage (personal) or myapps.microsoft.com (work or school).
• Turn features off. Switch off the AI assistant and sender avatars in Settings, disconnect Zoom, and turn notifications off in your browser or phone settings.
• Delete your account. You can delete your account yourself: in the web app, open Settings and choose Delete account; in the iOS or Android app, open Settings from the account menu and choose Delete account. We explain what will be deleted and ask you to confirm by typing DELETE. Then we:
  • disconnect every mailbox as described above, which stops syncing and, for Google accounts, revokes our access, and disconnect Zoom;
  • cancel any scheduled or queued emails and reminders;
  • delete your account and the information we hold for it on our servers: connection details and tokens, cached email bodies and images, attachments you uploaded, settings, email signatures, calendar data, contacts copies, recipient suggestions, push subscriptions, and the error and problem reports linked to your account;
  • sign you out, and delete the copies of your mail kept in that browser or on that phone.

  Your sign-in stops working immediately. If a step cannot finish straight away, for example because a service we rely on is briefly unavailable, we keep retrying automatically until it does. We keep only a record of your account’s random identifier and when it was deleted, which stops an old sign-in from being used again; it contains no name or email address. Some information may remain for a limited time: in server logs (about 30 days), in copies of problem reports already emailed to our developers (see section 2.7), in backups for up to [BACKUP RETENTION PERIOD — TO BE CONFIRMED], and where the law requires us to keep it.

  If you prefer, email logins@xenett.com from the address you sign in with and we will delete your account for you.

  Your email, calendar and contacts stay in your Google or Microsoft account; we do not delete them there. For an Outlook account, you can also remove Xenett Mail’s consent as described above.

• Access and export. You can ask us at logins@xenett.com for a copy of the information we hold about you. Your mail itself remains available from Google or Microsoft.

Depending on where you live, you may have further rights, including to correct your information, to restrict or object to our processing, to data portability, and to complain to a data protection authority. To exercise any of them, contact us at logins@xenett.com. We may need to verify your identity before acting on a request.

10. Children

The Service is not directed to children. We do not knowingly collect personal information from children under 13, or under 16 in the European Economic Area and the United Kingdom. If you believe a child has given us personal information, contact us at logins@xenett.com and we will delete it.

11. Changes to this policy

We may update this policy as the Service changes. We will post the new version on this page and update the “Last updated” date. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent.

12. Contact us

Questions or requests about this policy or your information:
Xenett Mail
logins@xenett.com