Privacy policy

Your email belongs with you and your email provider. Letterslot is built to read, organise, search and send it on your devices.

Who is responsible

Pragmatic Builders Limited operates Letterslot and this website and is the data controller for personal information it processes to operate these services. In this policy, “we” means Pragmatic Builders Limited. Contact us at oops@letterslot.app for privacy, data-deletion and legal requests. Please do not post private mail or credentials publicly.

What the app accesses, and why

• Account identity: your email address, display name, configured aliases and provider details, to identify accounts and choose the correct sending address.
• Email: messages, bodies, headers, recipients, attachments, folders, labels and message state, to display conversations, search, screen senders, file mail, handle attachments, compose, send and perform the mailbox actions you choose.
• Correspondence history: addresses and names in received and sent mail, and frequency and recency of correspondence, to suggest recipients. We do not bulk-import your system Contacts for this feature.
• Your choices: sender decisions, promotion preferences, labels, signatures, drafts, flags and settings, to provide the features you use.
• Derived information: a local search index, numerical search embeddings, classifications and explanations, to find and organise mail. These remain personal information even when represented as vectors.
• Authentication: provider-issued OAuth tokens or an app password where supported, to connect to the account you authorise.

The app connects directly to your provider over encrypted connections. Message bodies, headers, subjects, sender lists, snippets and attachments are not uploaded to Letterslot servers. Sending delivers your message to your provider and intended recipients. Ordinary email is not end-to-end encrypted merely because transport encryption is used.

Google account access and Limited Use

If you connect Gmail, Letterslot accesses the Google account identity and Gmail data needed for its visible email features. IMAP/SMTP OAuth uses the https://mail.google.com/ permission, which grants broad mailbox access, including the ability to read, compose, send and permanently delete mail. We use that access for the mail features and actions you enable, not unrelated purposes. Provider sign-in shows the permissions actually requested; unavailable or unapproved integrations remain disabled.

Letterslot’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This applies to raw Google data and information derived from it.

We do not sell Google user data, use it for advertising, provide it to data brokers, use it for credit or lending decisions, or use it to train general-purpose AI models. Any transfer is limited to providing the prominent features you authorise, necessary security purposes, legal requirements, or a business transfer with your prior explicit consent, as permitted by that policy. Our design does not give staff a mailbox-content viewer. If you voluntarily provide specific data for support, people may review it with your affirmative agreement; any other access must meet the policy’s narrow security or legal exceptions.

Local storage, Keychain and iCloud

Synced mail, drafts, downloaded attachments, address history, search indexes and settings are stored on your device. Passwords and OAuth tokens are stored in Apple Keychain. Device protection and backup settings affect that data; a local database is not a separately end-to-end encrypted vault. Exported files are protected according to the location you choose.

The current build supports explicit settings and signature exports, including to your own iCloud Drive. Automatic cross-device metadata sync is still in development. Choosing iCloud or an Apple device backup brings Apple’s service terms and your Apple account security settings into use. We do not run a hosted mailbox archive or a Letterslot cloud backup of your mail.

Apple Intelligence and search

Supported classification, Screening explanations and natural-language interpretation use Apple’s on-device model APIs. Search embeddings are generated locally using Apple’s language models. Mail and prompts are not sent to a Letterslot AI server or an external AI provider. These features depend on device, language, operating system and model availability. AI suggestions can be wrong; they do not grant a sender permission to reach your Inbox.

Notification signals

Our notification infrastructure is designed to process random routing identifiers, provider change cursors, push tokens and delivery state, rather than email content. Provider webhook formats can contain limited account metadata: for example, Gmail supplies a mailbox address. The handler derives a keyed routing identifier and discards the address without storing or logging it. Apple Push Notification service carries an opaque wake signal; the device fetches its mail directly. Cloudflare hosts the website and notification handlers; Hetzner is the planned host for optional IMAP IDLE connections. Production push and device registration are not yet enabled.

Optional IMAP IDLE credential leases — planned

Where you explicitly enable an IDLE watcher, it needs a credential to authenticate to your provider while your device is unavailable. The proposed service stores an encrypted credential under a high-entropy identifier retained by your device, without an account-address lookup or user-searchable directory. The device must refresh that lease regularly. An unrefreshed lease expires after 14 days. A provider token can expire or be revoked sooner.

The design decrypts a credential only to establish the provider connection, removes the stored lease after consuming it, and releases the plaintext credential after authentication. The authenticated connection can remain open until it ends, is revoked or reaches the lease expiry deadline; reconnecting requires a fresh credential. Connection state still exists in memory. Disabling the feature must terminate that connection and delete any outstanding lease.

These identifiers are pseudonymous, not anonymous. Authentication necessarily exposes the login identity transiently to the watcher and the provider. Encryption at rest does not mean the service is unable to decrypt a credential. This design must be implemented and verified before the feature is offered; the current local fixture watcher does not provide this production lease system.

No advertising or behavioural tracking

We do not include advertising SDKs, session replay, fingerprinting or behavioural analytics. This website has no analytics scripts, tracking cookies, external fonts or mailing-list signup. Hosting and network providers process connection information, including IP addresses, to serve and protect requests. That is distinct from advertising tracking.

We intend to use Apple’s crash and diagnostic reporting, subject to your Apple sharing settings, rather than a third-party monitoring SDK. Reports may contain device, operating-system, app-version and crash information. Diagnostic and infrastructure logs must not contain email content, passwords or tokens. Support information is processed only if you choose to provide it.

Remote images and domain icons

When enabled, domain icons can be fetched from Google’s favicon service, revealing the requested domain and connection information to Google. BIMI lookups can contact domain and certificate hosts. Loading remote content in a message can disclose your IP address and reveal that the content was opened to its host; follow the app’s remote-content controls. These requests do not upload the message itself.

Who receives information

Your email provider receives direct mail requests; recipients receive messages you send. Apple provides platform, Keychain, optional iCloud, diagnostics and push services. Cloudflare provides web and notification infrastructure, and Hetzner is planned for the optional IDLE watcher. These providers may process technical data in countries outside your own. Where UK or EEA transfer rules apply, we must use an applicable adequacy decision or appropriate contractual safeguards. We do not claim a fixed hosting region before production hosting is configured.

We may disclose information we actually hold when legally required, or where necessary and lawful to protect the service against abuse. This does not give us a copy of mail that remains on your device or at your provider.

Retention, deletion and revocation

Local caches and derived indexes are retained while needed for connected accounts. In the current development build, Disconnect removes saved sign-in credentials and stops monitoring but retains cached mail. A complete local account-data erasure control is still required before public release. Exported files and backups you created remain under your control. Removing a cache or uninstalling the app does not delete provider mail. Mailbox delete and Trash actions are separate and can affect provider mail when the relevant integration is connected.

You can revoke Google access through your Google Account connections, or revoke access/app passwords with your other provider. Revocation stops future authorised access but does not erase previously downloaded local files. For the planned IDLE service, unrefreshed encrypted leases have the 14-day maximum described above; deletion and connection termination must also be available when disabling it.

Support correspondence is kept only as needed to resolve the request and meet applicable legal obligations. Production retention periods for routing records and operational logs have not yet been configured; this policy will state them before those services launch. We do not invent a retention period for third-party Apple diagnostics or backups you control.

Your rights and our legal bases

Where UK or EEA data-protection law applies, we rely on performing our agreement with you for requested email features; legitimate interests for proportionate service security and support; consent for optional processing where required; and legal obligations where applicable. You can withdraw consent without affecting processing that was lawful before withdrawal. Provider OAuth permission is an access authorisation and does not by itself determine every data-protection legal basis.

Depending on your location and circumstances, you may request access, correction, deletion, restriction, portability or object to processing. Email oops@letterslot.app; we may need proportionate identity checks and your device-held routing identifier to locate pseudonymous service records. We cannot recover a record from your email address if no such lookup exists. You may complain to the UK Information Commissioner’s Office or your local authority. We do not make legal or similarly significant automated decisions about you.

Children and changes

Letterslot is not directed at children under 13. Your email provider’s age and authorisation rules also apply. We will update this page when practices change and give notice, and obtain additional consent where needed, before using data for materially different purposes.

Operator: Pragmatic Builders Limited · Last updated 19 October 2026