Your mailbox, handled with care.

1. Scope and key points

This notice applies to Mate Mail for Android, its app settings and local background features, the Mate AI requests initiated from Mate Mail, the family-app connections described below, and this policy website. It does not replace the privacy notice of Google, Microsoft, Firebase, Cloudflare, an AI model provider, Android, an email recipient, or an app you choose to open an attachment with.

Mate Mail is a separate app from Note Mate and Calendar Mate; each has its own privacy notice. If you choose to send material between trusted Mate family apps, the receiving app handles that material under its own notice. This page describes the app behavior identified in the current code and may be revised when features or providers change.

Mate Mail does not ask you to provide your mailbox password. It does not obtain your calendar through Android calendar permissions. Any email content sent to a calendar or notes app is done through an explicit family-app feature or action.

2. Who operates Mate Mail

Mate Mail is operated by Shreyas Links (“we,” “us,” or “our”). For privacy questions, rights requests, deletion requests, or complaints, contact shreyaslinks00008@gmail.com. Please write “Mate Mail privacy” in the subject and tell us which account or app feature your request concerns. Do not email passwords, access tokens, or unnecessary message content.

For privacy laws that use the term, Shreyas Links acts as the controller/business for information it determines how to process for the app and its services. For email content stored in your Gmail or Microsoft account, the email provider independently operates its service and determines its own processing. We do not control that provider’s account data, retention, or legal duties.

We do not publish a separate postal address or name a Data Protection Officer in this notice. If applicable law requires a local representative, DPO, or additional contact details for a particular processing activity, those details will be provided through the relevant channel.

3. Information processed

Some data may include sensitive personal information because messages can contain anything another person sends you or you choose to write. Email may also contain special-category or highly confidential information. We do not ask you to use Mate Mail to process information you are not authorized to access or share.

Mate Mail does not request Android contacts, microphone, camera, precise location, or Android calendar permissions in the current app manifest. This does not prevent an email from containing names, addresses, location details, or other information written in its content.

4. Permissions and mailbox access

Provider permissions

Gmail. The app requests Google OAuth scopes including gmail.readonly, gmail.modify, and gmail.send for mailbox reading/search, actions such as archive/read/star/trash/snooze, and sending mail. These are broad Gmail permissions and are not limited to the one message currently on screen. Google Play services manages Google authorization tokens; Mate Mail stores the connected email address but does not persist the Gmail password or a refresh token.

Outlook/Microsoft 365. The app uses Microsoft sign-in and Microsoft Graph permissions for the profile, mail read/write, and mail send features (including User.Read, Mail.ReadWrite, and Mail.Send). The Microsoft access token is stored encrypted with AES-GCM and a key held by Android Keystore. A token can expire and require reconnection.

Provider permission screens show the requested access at connection time. You can disconnect the account in Mate Mail. Disconnecting clears the app’s saved connection state and mailbox cache; to revoke the authorization grant itself, use the connected account’s Google or Microsoft security/connected-app settings as well. Provider actions such as send, delete, archive, or mark read are performed on the provider account and may sync to other devices.

Android permissions

• Internet and network state: connect to your mail provider, Firebase authentication, family services, and requested AI features.
• Notifications: show new-mail, digest, scheduled-send or snooze reminders. Android may show sender/subject on the lock screen depending on your device settings.
• Boot and background scheduling: restore work you explicitly scheduled, such as scheduled send or snooze, after restart and run the relevant task.
• Widgets: display selected mailbox content on your home screen. A person who can see your screen or widgets may see that content.
• File sharing: when you choose to open/share an attachment, a temporary read grant can be given to the selected Android app.

Notifications, background work and widgets can be limited in Android settings. You can revoke permissions there; doing so may disable the related feature. The app does not use a denied permission to access the same data through a hidden route.

5. Purposes and legal grounds

Where a privacy law requires a legal basis, the basis depends on your location, the feature and the data involved. In jurisdictions such as the EEA/UK, we generally rely on the following grounds where applicable:

• Provide the service you request / contract: connect to a chosen mailbox; display, search, compose and manage email; save a draft; send a message; run a scheduled send; and provide app settings and widgets.
• Your consent or choice: access the provider account after its authorization, use optional notifications or Android features where permission is required, and send prompt/context to AI after you review and accept the separate AI disclosure. You can withdraw optional consent by turning the feature off or revoking permission.
• Legitimate interests, balanced against your rights: protect accounts and services, prevent abuse, troubleshoot failures, maintain service reliability, and measure limited operational usage. You may object where the law gives you that right.
• Legal obligations and claims: preserve or disclose information when required by law, respond to lawful requests, enforce terms, or establish or defend legal claims.

We use mailbox content to deliver the email functions you request, not for advertising. We do not sell personal information or share it for cross-context behavioral advertising. The use of information received from Google Workspace scopes adheres to the Google Workspace User Data and Developer Policy, including its Limited Use requirements: use is limited to user-facing functions, transfers are limited to permitted purposes and consent, and the data is not used to train generalized AI models. Where a provider or law defines a permitted use more narrowly, the stricter rule applies.

6. Device storage and security

Encrypted data

Mate Mail keeps a working mailbox cache in private app storage. The cache can include up to about 120 message-list entries per folder and up to about 80 recently opened full messages, including their bodies. Cache records are encrypted using AES-GCM with a key held by Android Keystore. A legacy cache entry may be encrypted when it is next read. Microsoft access tokens are likewise encrypted using an Android Keystore key. The app does not store a Gmail password.

Other local app data

Some supporting app data is stored in Android app-private preferences or files without additional file-level encryption by Mate Mail. This includes AI chat history (up to the latest 40 local conversation entries), preferences, and scheduled-send records. A scheduled-send record can include recipients (including CC/BCC), subject, message body, reply/thread identifiers and scheduled time so Android background work can send it at the time you selected. Snooze/background work can retain message identifiers and limited sender/subject information until the work completes or is cancelled. The app requests Android backup be disabled, but this is not a substitute for device encryption or screen privacy.

Safeguards and limits

Network traffic to providers and the AI service uses HTTPS. Android app sandboxing, Android Keystore protection for the encrypted items, access controls and limited local caching are intended to reduce exposure. No method is perfectly secure: an unlocked, rooted, compromised, shared, or malware-infected device; malicious content; notification previews; screenshots; or a service-provider incident can expose information. Do not rely on this app as an encrypted mailbox or secure archive.

7. Mate AI: what is sent and how to control it

Information included in a request

When you submit an AI prompt or tap an AI feature, the app sends the prompt, the feature’s instructions, up to the last 10 conversation turns (subject to per-message limits), and the relevant context assembled for that feature. For Mate Mail this can include recent email subjects, sender/recipient details, snippets or body text, unread and priority state, and a limited set of messages identified as awaiting a reply. The exact selection depends on the feature and current mailbox. A response can include suggested actions; sending, editing, or applying a suggestion requires a separate action in the app.

The request is sent over HTTPS to our Cloudflare Worker with an authenticated family-account token and app/feature identifiers. The Worker routes the request to the configured model service, currently including Groq for the Mate Mail chat route; provider routing may change as the service evolves. The model provider receives the request content needed to generate the response. Do not include content in an AI prompt unless you are comfortable sharing it with these processors.

AI storage, use and limitations

Local conversation text is kept in app-private preferences for continuity (up to the latest 40 entries); starting a new chat can clear the local conversation. Operational service records can include provider/model, feature, request size, response status, usage/rate-limit information and troubleshooting errors. They are not intended as a mailbox archive. The model provider may process or retain requests under its current terms and settings; we do not promise a provider-specific deletion period here. The app does not use the content of these requests to train our own general-purpose model. Outputs can be inaccurate, incomplete, biased, or unsafe; review them before relying on or sending them.

AI is not an email delivery service, legal/financial/medical adviser, or substitute for checking a message. A message is sent only by your explicit send action or by a scheduled-send action you previously configured.

8. Recipients and service providers

• Google and Microsoft: provide account authorization and mailbox APIs. They receive API requests and the information needed to perform the mailbox operation. Your provider’s own terms and privacy notice govern its processing.
• Cloudflare: hosts the AI proxy and this privacy page. The Worker receives AI request content, authenticates/rate-limits requests, routes to a model provider, and creates limited operational logs. Cloudflare’s platform may process technical data to operate and secure its services.
• AI model provider: currently configured providers such as Groq process prompt and context to produce a response. Their retention, security and use conditions can change; review their current terms before enabling AI.
• Firebase: Firebase Authentication supports the Mate family account and issues the account token used by family AI services. Firebase may process account, device and authentication metadata under its own terms.
• Android and selected apps: Android handles notifications, alarms, widgets and secure app-to-app grants. A recipient or external app receives content when you send an email, share material, or choose to open an attachment there.
• Trusted Mate family apps: a family integration can pass the content you choose into a signed Mate app or service, such as saving email-derived information in Calendar Mate or Note Mate. The receiving app’s separate privacy notice applies.

Service providers are engaged to supply or secure the requested service. We do not authorize them to sell your email content or use it for their own advertising. We may also disclose information if necessary to comply with law, protect users or services, investigate abuse, or handle a business transfer, subject to applicable legal requirements.

9. Email features, messages and external content

Mailbox actions and delivery

Mate Mail can display/search folders, open messages, list and download attachments, create or edit drafts, compose, reply/reply-all, forward, send, archive, mark read/unread, star, move to trash, unsubscribe, snooze, and schedule sending. Actions modify your connected mailbox. Mail sent from the app is delivered to the recipients you specify and may be stored, forwarded, indexed or retained by them and their providers. The app may add a “Sent with Mail Mate” footer depending on your settings.

Attachments and shared content

When you choose to open or download an attachment, the file is fetched from your email provider and may be placed in temporary app storage. If you open it in another app, that app receives access to the shared file and handles it under its own practices. When you use Android’s share/send-to integration, the text or file you selected is passed to the destination you chose.

Remote images and tracking

Email HTML can reference remote images, including tracking pixels. If external images are enabled or loaded, the image host can receive a network request that may reveal your IP address, approximate network-derived location, device/browser information, and the time the image was fetched; a sender may infer that a message was opened. You can disable automatic image loading in the message display settings and avoid loading images in messages you do not trust.

Notifications, digests and widgets

New-mail notifications and optional digests are generated from your connected mailbox and on-device settings. Notification previews and widgets can display message metadata on the device. Android lock-screen and launcher settings determine who can see them. You can disable notifications and remove widgets at any time.

10. Retention and deletion

We retain information only for as long as needed for the purposes above, unless a longer period is required or permitted by law. Because much email content is stored in your own provider account or locally on your device, the app cannot delete every copy held by a recipient, provider, backup or synced device.

To disconnect Google or Microsoft, use the app’s account settings. This removes the app’s local connection state but may not revoke the OAuth grant at the provider; revoke it in Google/Microsoft account security settings. To delete an email, draft or scheduled item from the provider, use Mate Mail or the provider’s own controls. Uninstalling Mate Mail does not delete mailbox content stored by the provider or copies already delivered to recipients.

11. Your choices and privacy rights

You can manage account connections, AI consent, notifications, image loading, widgets and local preferences in the app or Android settings. You may ask us to access, correct, erase, restrict or explain personal information processed by us, or to exercise another right provided by your local law. Where applicable, you may also object to processing, request portability, withdraw consent, or complain to your data protection authority.

Send a request to shreyaslinks00008@gmail.com. Include “Mate Mail privacy request,” the country/region where you use the service, the account email (if relevant), the right you want to exercise, and a way to contact you. We may ask for proportionate information to verify the request and protect the account. We will respond within the time required by applicable law. You may use an authorized agent where local law allows it.

We may be unable to retrieve or erase a provider-held email through a privacy request to us. For those copies, use the Google or Microsoft account controls. A privacy request to us does not automatically delete an email from the provider or from a recipient’s inbox. Some information may be retained where permitted for legal obligations, security, dispute resolution, or completion of a transaction you requested.

California and other US state rights

Depending on applicable law and eligibility, residents may have rights to know/access, correct, delete, obtain a portable copy, opt out of sale or targeted advertising, and limit certain sensitive-data uses, and to appeal a denied request. Mate Mail does not sell personal information or share it for cross-context behavioral advertising. We do not use mailbox content for targeted advertising. We will not discriminate against you for exercising a privacy right. Submit a request through the contact above; a verification step may be required.

India

Where applicable under India’s data-protection framework and its effective provisions, you may have rights to access information about processing, correction and erasure, grievance redressal, and nomination. You can contact us using the details above. We will handle requests according to the provisions in force at the time and the applicable rules.

12. International transfers

Google, Microsoft, Firebase, Cloudflare and model providers may process information in countries other than where you live. Data-protection protections and government access laws can differ across countries. Where transfer restrictions apply, we will use a valid transfer mechanism and safeguards required by applicable law, such as an adequacy decision or contractual safeguards, and provide information about it on request where required. Each provider’s current documentation describes its own processing locations and safeguards.

13. Children

Mate Mail is a general productivity application and is not designed for children under 13, or below the minimum age for independent consent required in the child’s jurisdiction. We do not knowingly direct the service to children or knowingly collect children’s personal information for independent use. If you believe a child has provided personal information to us, contact us and we will assess and take appropriate steps. A parent/guardian should supervise any permitted use and any email account connected to the app.

14. Changes, complaints and contact

We may update this notice to reflect app features, vendors, security practices or legal requirements. We will change the effective date above and, when a change materially affects how information is used, provide an appropriate notice in the app, on this page, or through another required channel. Continued use after an update is subject to applicable consent rules; it does not replace consent where the law requires a separate choice.

For questions or a complaint, email shreyaslinks00008@gmail.com. You may also contact your local privacy or data-protection regulator. If your concern relates to Gmail, Microsoft, Firebase, Cloudflare, or a model provider’s independent processing, contact that provider as well.

15. Regional and platform information

We aim to explain the app’s data practices clearly and to follow privacy requirements that apply to the service. The laws and platform programs below may apply depending on your location, eligibility and app distribution. Listing them is not a representation that every law applies to every user, nor a legal certification.

• European Union / EEA and UK: rights, transparency, legal bases, retention and international-transfer rules may apply under data-protection law. The EU GDPR official text describes these requirements.
• India: the Digital Personal Data Protection Act and rules apply as their provisions take effect. See the MeitY DPDP Rules, 2025.
• California: if the California Consumer Privacy Act applies, additional notices and rights may be available. See the California Privacy Protection Agency’s CCPA statute and regulations.
• Google Gmail API: Google classifies some Gmail scopes requested by Mate Mail as restricted or sensitive; Google may require verification and a security assessment depending on the app’s release and handling. See Gmail API scopes, OAuth policies, and the Google Workspace user data policy.
• Microsoft Graph: Microsoft account permissions and user-data processing are described in its Microsoft Graph permissions reference and Microsoft Privacy Statement.

The privacy policy is a description of current product practices, not a substitute for legal advice or required operational controls. Provider approval, assessments, contracts, security configurations and jurisdiction-specific notices must be maintained separately where required.