Privacy notice

Last updated: [DATE]. Draft — have it reviewed for your country before launch (for example for GDPR/NDPR) and fill in the bracketed parts.

Who we are

AllWebMails is operated by [COMPANY NAME, ADDRESS]. Contact: hello@allwebmails.com.

What we process and why

• Your account: your Gmail address, a hash of your password (we never store the password itself), your time zone, approval and access-period history. Used to run your account. Your Gmail address only receives account notices (confirmation, password reset, access-period reminders) — never mail from your connected mailboxes.
• Connected mailboxes: server settings and the mailbox password, encrypted with a key that is not stored in our database. Used only to fetch and send your mail.
• Your mail: copies of messages, attachments you open, drafts and scheduled messages, so you can read and search them on all your devices. Files are encrypted with a key unique to you.
• Devices and security: signed-in devices, sign-in attempts and IP addresses, and an audit log of important account actions, to protect your account and detect abuse.
• Notifications: a push token per device. Notifications contain only the receiving mailbox address — never the sender, subject or content.

What we never do

• We do not sell your data or use your mail for advertising or profiling.
• Our administrator can see account and connection status, but not your mailbox passwords or the content of your mail.
• We do not change or delete mail on your provider except when you ask (move, delete, mark as read, send).

How long we keep it

• While your account exists. If your access period ends, your account is suspended and your data is kept so you can continue after renewal.
• Disconnecting a mailbox lets you choose to keep or delete what is stored for it.
• Deleting your account deletes everything we store for you. Encrypted backups are kept for up to [14] days; your personal encryption key is deleted immediately, so files in backups become unreadable, and deleted accounts are removed again if a backup is ever restored.

Where it is stored

[Hosting provider and country/region of the servers and database, e.g. "Hostinger VPS in the EU and a managed PostgreSQL database in the EU".] Connections are encrypted (HTTPS/TLS).

Your rights

You can access, correct, export or delete your data, and object to processing, by contacting us. You can also complain to your data protection authority.

Changes

We will tell you in the app before important changes take effect.