Actually Mail

LEGAL

Privacy Policy

Last updated September 25, 2026

Nirvantric ("we," "us," "our") operates Actually Mail (the "App"). This Privacy Policy explains what happens to your information when you use the App.

The short version: Actually Mail is a local-first email client. Your messages, mail account credentials, and app data live on your device. We do not operate a server that receives, stores, or processes your email. We have no analytics, no crash reporting, and no advertising SDKs in the App.

1. Information the App Handles

1.1 Your Email Accounts and Messages

Actually Mail connects directly, from your device, to the mail providers you choose to add:

  • Gmail, via Google Sign-In and the Gmail API
  • Microsoft 365 / Outlook.com / Exchange Online, via Microsoft sign-in and the Microsoft Graph API and/or IMAP/SMTP
  • Yahoo Mail, iCloud Mail, AOL, or any other IMAP/SMTP-compatible account, using an app-specific password you provide

When you connect an account, the App communicates directly with that provider's servers to list your messages, download message content on demand, and (if you use Compose) send messages on your behalf. We do not operate any server in between. Nirvantric never receives, stores, or has access to your email content, your mail account password, or your OAuth tokens.

Message bodies are fetched on demand for display and are not stored in the App's local database. Message metadata (sender, subject, date, read/starred status, and similar) is stored locally on your device using Apple's SwiftData framework so the App can work offline and show your inbox quickly. This metadata is never transmitted to us.

1.2 Credentials and Tokens

  • OAuth access/refresh tokens (Google, Microsoft) and IMAP app passwords are stored only in the iOS Keychain, protected by the operating system.
  • These credentials are never written to the App's own database, never included in the backup/export feature described below, and never sent to Nirvantric.

1.3 On-Device AI Features

Insights, summaries, and "Today's Brief" are generated using Apple's on-device Apple Intelligence (the FoundationModels framework), when available on your device and enabled in your device settings. This processing happens entirely on your device — email content used to generate a summary is not sent to Nirvantric or to any third-party AI service.

Google Workspace user data is not used to develop, improve, or train generalized AI or machine-learning models, and is not transferred to third-party AI/ML services for model training.

1.4 Health Data (Optional Mood Feature)

If you enable the optional mood check-in feature, the App reads and/or writes a "state of mind" entry via Apple HealthKit, with your explicit permission, to help prioritize which emails to show you first. This data is managed by HealthKit under Apple's own privacy protections and is never transmitted to Nirvantric or any third party.

1.5 Face ID / App Lock

If you enable App Lock, Actually Mail uses Face ID (or your device passcode) via Apple's LocalAuthentication framework to require unlocking the App. Your biometric data is processed entirely by iOS's Secure Enclave; the App never receives or stores your biometric data.

1.6 Contacts (VIP Senders)

To mark a contact as a VIP sender, the App presents Apple's system contact picker. The App only receives the single contact you select — it does not request or receive access to your full address book.

1.7 Notifications

Actually Mail uses local notifications only (for example, to alert you to new mail found during a background refresh, or a snoozed message coming due). We do not use push notifications, and no notification content is routed through any Nirvantric server, because none exists.

1.8 Subscriptions

Pro subscription purchases are handled entirely by Apple through StoreKit. Nirvantric never receives your payment card details. We may receive subscription status/entitlement information from Apple's App Store systems to unlock Pro features on your device.

1.9 Backup & Restore

The App includes an optional, user-initiated backup feature that exports your sender classifications, retention rules, account aliases, and connected-account identities (such as email addresses and display names) to a file. This file never contains credentials, OAuth tokens, or message content. The file is saved wherever you choose (for example, the Files app, AirDrop, or a cloud drive you select) and is never automatically sent to Nirvantric.

2. Information We Do Not Collect

We do not use analytics SDKs, crash-reporting SDKs, advertising SDKs, or any third-party tracking technology in Actually Mail. We do not operate a backend server for the App's core functionality, so there is no Nirvantric-controlled database of your email, contacts, or usage activity.

3. Third-Party Services

When you connect a mail account, your use of that provider (Google, Microsoft, Yahoo, Apple/iCloud, or any other IMAP/SMTP provider) is also governed by that provider's own privacy policy and terms. We encourage you to review:

Actually Mail's use of Google user data, where applicable, complies with the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data: Actually Mail accesses Google user data only as necessary to provide its user-facing email features. This may include Gmail message metadata and, when requested by the user for display or composition-related functionality, email content. Google user data is processed locally on the user's device and is not transmitted to or stored by Nirvantric. Nirvantric does not collect, create, retain, share, sell, or transfer raw, aggregated, or anonymized Google user data for advertising, analytics, data brokerage, profiling, or any other unrelated purpose.

4. Data Retention and Deletion

Because your data lives on your device:

  • Disconnecting a mail account in the App removes its locally stored messages and credentials from your device.
  • Deleting the App removes all locally stored data, including cached message metadata, sender rules, and Keychain-stored credentials associated with the App.
  • Any backup file you've exported is entirely under your own control — deleting the App does not delete a backup file you've saved elsewhere.

5. Children's Privacy

Actually Mail is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the App, contact us using the information below.

6. Your Rights

Because Actually Mail does not maintain a server-side copy of your personal data, most data-subject rights (access, correction, deletion, portability) are already in your direct control on your device — via the App's own account-disconnect, delete, and export features. If you have questions about your data or this policy, contact us at the email below.

7. Security

We rely on Apple's platform security (Keychain, Secure Enclave, sandboxing) to protect data stored by the App. No method of storage or transmission is 100% secure; you are responsible for keeping your device and its passcode/biometrics secure.

8. International Users

Actually Mail does not transfer your data to Nirvantric across borders, because we do not receive it. If you connect accounts hosted by Google, Microsoft, or another provider, that provider may process and store your data according to its own global infrastructure and policies — please review the relevant provider's privacy policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do. Continued use of the App after a change constitutes acceptance of the updated policy.

10. Contact Us

Questions about this Privacy Policy or your data can be sent to:

Nirvantric
support@nirvantric.com