Summary
- Zip Mail is a mail client. Your mail is stored by your mail provider and on your devices, not by us.
- Most features run entirely on your device, including the on-device Apple Intelligence features.
- If you turn on instant delivery, our relay service signs in to your mail accounts to watch for new mail. It stores the credentials it needs (encrypted), but not your messages. The one exception is a message you schedule with Send Later, which may be stored encrypted until it is sent.
- We don’t sell your personal information, share it for targeted advertising, or use your mail to train AI models. There are no advertising or tracking SDKs in the app or on this website.
- Our relay servers and database are hosted on DigitalOcean in Canada (Toronto), with encryption keys in Google Cloud KMS in Toronto.
During the beta: the relay and instant delivery are not live yet. Zip Mail connects directly from your device to your mail provider, and we hold no server-side data about your mail accounts. The beta is distributed through Apple’s TestFlight, which Apple operates under its own privacy policy. Apple may share crash reports and feedback with us if you choose to send them.
Who we are
Zip Mail is provided by Vikom Media (“we”, “us”). For personal data processed by our servers, and for your Zip Mail account, Vikom Media is the controller.
- Legal entity and registered address: Vikom Media
- Privacy contact: privacy@zipmail.app
- Availability: Zip Mail is not currently offered in the European Economic Area or the UK, so we have not appointed an EU or UK representative (GDPR Art. 27). We will appoint one before offering it there.
- Person in charge of the protection of personal information (Quebec Law 25): the Zip Mail privacy lead, reachable at privacy@zipmail.app
For mail that your devices download from your mail provider, the processing happens on your device under your control. Your mail provider is responsible for its own handling of your mailbox under its own terms.
What stays on your device
The following happens only on your iPhone, iPad, Mac or Apple Watch. We don’t receive this data:
- Your messages, attachments and the local search index.
- Importance sorting, bundles, tabs, summaries and quick replies.
- Your writing style profile, learned from your Sent mail.
- Package, flight, receipt and invitation cards, and Business and Tax extraction and export.
- Verification codes found in your mail for AutoFill. These never leave your device and are never logged.
- Contact suggestions based on the messages you read.
- Mail account passwords and tokens used by your device, stored in your device’s keychain.
Some of this data can be synced between your own devices through your Zip Mail account (see below). Sensitive items are end-to-end encrypted, so we can’t read them.
What we collect
| Category | Examples | When |
|---|---|---|
| Zip Mail account | Email address, passkey public keys, Sign in with Apple identifier, account creation date | When you create a Zip Mail account |
| Devices | Device name and model, push token, device public keys, App Attest attestation, app version | When you sign in on a device |
| Mail account connection | Email address, server settings, OAuth refresh token or app password (encrypted), sync position for each mailbox | When you turn on instant delivery for a mail account |
| Message metadata and previews | Sender, subject and a short preview of new messages | Processed in memory to decide whether to notify you and to build the encrypted notification. Not stored. |
| Notification rules | Muted and watched threads, sender importance scores keyed by a one-way hash of the address, rules based on message headers | Synced from your devices when instant delivery is on |
| Send Later messages | The full message you scheduled, encrypted individually | Only when the relay has to send it for you; deleted once sent |
| Synced settings | Preferences, swipe actions, rules, snooze records. Snippets, signatures, writing style and sender tables are end-to-end encrypted | When you use settings sync |
| Images loaded through the image proxy (Pro) | The address of a remote image in a message you open | Processed to fetch and return the image |
| Subscription | Product, transaction ID, subscription status and renewal dates from the App Store. Apple handles payment; we never see your card details | When you start a trial or subscribe |
| Security logs | IP address, time, request type, device ID, error codes | When your devices talk to our servers |
| Crash reports (optional) | Stack traces, device model, OS and app version | Only if you leave “Crash reports” on in Settings |
| Support | Your email and what you tell us | When you contact us |
Your email messages may contain personal data about other people. We don’t build profiles of the people who write to you, and contact suggestions happen only on your device.
Purposes and lawful bases
Where the EU or UK GDPR applies, we rely on the following lawful bases (Art. 6):
| Purpose | Lawful basis |
|---|---|
| Providing your Zip Mail account, sign-in and device management | Contract |
| Instant delivery: watching your inbox, deciding whether to notify you and sending notifications | Contract |
| Send Later, snooze timers and actions taken from notifications or Apple Watch | Contract |
| Syncing your settings between your devices | Contract |
| Private image loading (Pro) | Contract |
| Managing subscriptions | Contract |
| Security, fraud and abuse prevention, including security logs | Legitimate interests (keeping the service and your accounts secure), supported by a documented balancing test |
| Crash reports | Consent (you can turn them off at any time) |
| Cloud AI extras | Consent (off unless you turn them on) |
| Answering support requests | Contract, or legitimate interests if you’re not a user |
| Complying with the law and responding to valid legal requests | Legal obligation |
We don’t use your data for advertising, and we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Importance sorting only affects how your own mail is arranged and when you’re notified, and you can correct it.
Apple Intelligence and cloud AI
On-device AI. Summaries, quick replies, your writing style, smart cards, importance sorting and contact suggestions use Apple’s on-device Foundation Models framework. This processing runs on your device, and we don’t receive the inputs or outputs. AI-generated summaries and drafts are labelled as such in the app.
Cloud AI extras (optional). Some future features, such as natural-language search and drafting replies to long threads, may use Anthropic’s Claude models through our servers. These are off by default, and you’ll be asked for consent, with Anthropic named, before anything is sent. When they’re on, only the content needed for the request is sent, plus a short summary of your writing style if you choose. Anthropic processes it under a data processing agreement with zero data retention and no training on your data. Cloud AI extras are not available in the beta.
Sharing and subprocessors
We don’t sell personal information and don’t share it for cross-context behavioural advertising. We share it only with service providers that process it on our behalf under data processing agreements, when the law requires it, or with your direction.
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean | Relay servers, database and backups | Canada (Toronto) |
| Cloudflare | DNS, network protection, secure tunnel to our servers, this website, the image proxy, encrypted backup and audit-log storage | Global network |
| Google Cloud | Key Management Service for encrypting mail credentials; Pub/Sub for Gmail new-mail notifications | KMS and Pub/Sub message storage: Canada (Toronto); US-based provider |
| Apple | Apple Push Notification service (encrypted notification contents), App Store subscriptions, App Attest, Sign in with Apple, TestFlight | United States and global |
| Anthropic | Cloud AI extras, only if you opt in. Not used in the beta | United States |
| Apple | Crash reports, only if you choose to share them with developers | United States |
We send essential account emails, including sign-in codes and security notices, via Cloudflare, a subprocessor listed above.
We will keep this list current and give notice of changes before a new subprocessor starts processing your data. Your mail providers (for example Google, Microsoft, Apple iCloud, Yahoo or Fastmail) are not our subprocessors; you have your own relationship with them, and we connect to them at your direction.
Legal requests. We only disclose data when legally required, and we will tell you unless the law forbids it. By design we hold little: we don’t have your mailbox, and end-to-end encrypted settings can’t be read by us.
Business transfers. If Vikom Media is involved in a merger, acquisition or sale of assets, your data may be transferred as part of it, and this policy will continue to protect it.
Where data is processed
Our relay servers and database are hosted on DigitalOcean in Canada (Toronto). Encryption keys are held in Google Cloud KMS in Toronto, and Gmail Pub/Sub message storage is restricted to Toronto. We also use US-based subprocessors and global services:
- Apple, a US-based subprocessor, delivers notifications through APNs. Notification contents are encrypted to your device, so Apple can’t read them; Apple does see delivery metadata such as your push token and the time.
- Gmail new-mail notifications pass through Google Cloud Pub/Sub, a service from a US-based subprocessor, with message storage restricted to Toronto. These contain an account identifier and a change marker, not message content.
- Cloudflare operates a global network, so requests may be handled by the data centre nearest to you.
- Anthropic, a US-based subprocessor, processes cloud AI requests in the United States only if you enable cloud AI extras.
Zip Mail is not currently offered in the EEA or UK. Before offering it there, we will review the applicable international-transfer safeguards and representative requirements. For residents of Quebec, we assess transfers outside Quebec as required by Law 25.
How long we keep data
| Data | Retention |
|---|---|
| Notification previews | In memory only, while the notification is built |
| Send Later messages | Until sent, then deleted; deleted immediately if you cancel |
| Mail credentials and sync positions | While instant delivery is on for that account; deleted when you turn it off or delete your account |
| Zip Mail account, devices and synced settings | While your account exists |
| Security logs | 90 days; IP addresses truncated after 30 days |
| Audit logs of administrative access | 1 year |
| Deleted accounts | Purged from live systems within 30 days, and from backups as they expire (within 35 days) |
| Subscription records | 7 years, as required by tax and accounting law |
| Support emails | 2 years after the last message |
| Data on your device | Until you remove the mail account or delete the app |
Security
We protect your data with measures including per-credential encryption with keys held in a separate hardware-backed key service, passkey sign-in, encrypted notifications, Canadian hosting with no open inbound ports, no standing access to production and immutable audit logs. The security overview explains these, including their limits. If a breach puts your data at risk, we will notify the relevant regulators (within 72 hours where the GDPR requires it) and tell affected users without undue delay.
Your rights
Depending on where you live, you have some or all of the following rights. We honour the core ones for all users, wherever they are.
EU and UK (GDPR and UK GDPR)
- Access your personal data and get a copy of it.
- Correct inaccurate data.
- Delete your data.
- Restrict or object to processing, including processing based on legitimate interests.
- Data portability, in a structured, machine-readable format.
- Withdraw consent at any time, feature by feature, without affecting earlier processing.
- Complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.
California (CCPA as amended by the CPRA)
- Know what personal information we collect, use and disclose, and get a copy.
- Delete and correct personal information.
- Opt out of the sale or sharing of personal information. We don’t sell or share it, so there is nothing to opt out of.
- Limit the use of sensitive personal information. We use mail account credentials only to provide the service you asked for.
- Not be discriminated against for exercising these rights.
- Use an authorized agent. We may ask the agent for proof of authorization and verify your identity.
In the last 12 months, the categories we collected are those in What we collect: identifiers, customer records, commercial information (subscriptions), internet activity (security logs) and account credentials. We collect them from you, your devices and the mail accounts you connect, for the purposes listed above, and disclose them only to the service providers listed above.
Canada (PIPEDA and Quebec Law 25)
- Access your personal information and ask for corrections.
- Withdraw consent, subject to legal or contractual restrictions.
- In Quebec, receive computerized personal information in a structured, commonly used format, and be informed about automated decisions.
- Complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
How to make a request
Many requests can be handled in the app under Settings › Privacy › Your data. You can also email privacy@zipmail.app. We may need to verify your identity, usually by confirming you control the email address on your Zip Mail account. We respond within 30 days, and tell you if we need more time where the law allows it.
Deleting and exporting your data
- Delete your Zip Mail account in the app under Settings › Privacy › Your data. This stops instant delivery, revokes our access to your Google and Microsoft accounts, and deletes your credentials, devices, rules, timers and synced settings from our servers. Data is purged within 30 days and removed from backups within 35 days.
- Turn off instant delivery for a single mail account to delete the relay’s credentials and sync data for that account.
- Revoke access at your provider. You can also remove Zip Mail’s access or app password in your Google, Microsoft, Apple, Yahoo or Fastmail account settings at any time.
- Remove data on your device by removing a mail account in Zip Mail or deleting the app. Your mail stays with your mail provider.
- Export your data in the app under Settings › Privacy › Your data. The export contains the data we hold about you in JSON, plus any pending Send Later messages in mbox format.
While these in-app flows are being completed during the beta, email privacy@zipmail.app and we’ll handle your request manually.
Children
Zip Mail is not directed at children. You must be at least 16 years old to use it in the European Economic Area and the UK, and at least 13 elsewhere, or older if your country requires it. If we learn that we hold personal data about a child below these ages, we will delete it. If you believe this has happened, contact privacy@zipmail.app.
This website
zipmail.app uses no cookies, analytics, trackers, third-party fonts or third-party scripts. It’s served by Cloudflare, which processes your IP address and request details to deliver the site and protect it from attacks, as described in Cloudflare’s own policies. We don’t use that data to identify or profile visitors.
Changes to this policy
We’ll post any changes here and update the date at the top. If a change materially affects how we handle your data, we’ll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.
Contact
Questions or requests about privacy: privacy@zipmail.app.
Email: privacy@zipmail.app
Zip Mail is not currently offered in the EEA or UK; no EU or UK representative is appointed.