Privacy Policy

Last updated 7 September 2026

Maily is an email app for iPhone, operated by Abel Amare ("Maily", "we"). This policy explains what the app does with your mail, your Google account data and everything else it touches. It is written to be read, not to be survived.

The short version. Your email stays on your phone. Our servers hold your settings and your subscription, never your messages. When you use an AI feature, the text of the messages that feature needs is sent to our AI provider to answer, and is never used to train anyone's model. You can delete everything from inside the app.

1. Who this covers

This policy covers the Maily iOS app and the website at mailyco.com. It applies to everyone who uses Maily, wherever they are.

2. What we collect, and where it lives

Your mail

When you connect a mailbox, Maily downloads recent messages — by default the last three months — and stores them on your device, so the app works without a connection. Message content, attachments, read state, drafts, snoozes and the categories Maily assigns are held on your phone and in your device's own backup if you have one enabled.

We do not store the contents of your mailbox on our servers. There is no copy of your messages, subjects, attachments or addresses in our database.

Your Maily account

You sign in to Maily itself with Apple, Google or an email address. We store your account identifier, your email address, and the display name and photo you choose. Authentication is handled by Supabase Auth.

What our servers do hold

What	Why
Settings and preferences	So your setup follows you to another device
Your answers to the setup questions	To match the assistant to how you work
Assistant conversations	Only if chat syncing is on — you can turn it off, which deletes the stored copy
Facts you asked Maily to remember	Only what you explicitly told it to keep. Visible and deletable in the app
AI usage records	Token counts and cost, to enforce your plan's allowance. No message content
Push notification token	To tell your phone new mail has arrived
Subscription status	Your plan, renewal date and Apple transaction identifiers

IMAP mailboxes

If you connect a mailbox that is not Gmail, the server addresses are stored on your device and the password is stored in the iOS Keychain. Neither is ever sent to our servers.

3. Google user data

When you connect a Gmail account, Maily asks for these permissions and uses them for these purposes only:

Permission	What Maily does with it
`gmail.readonly`	Reads your messages so the app can show your inbox, search it, and produce the summaries and categories you see. Displayed only to you, cached only on your device.
`gmail.compose`	Creates and updates drafts, and sends the messages you write. Auto-Reply is off unless you turn it on; when on, it sends only within the limits you set and notifies you each time.
`contacts.readonly` `contacts.other.readonly`	Looks up the photo and name for an address that has written to you, so senders have faces the way they do in Gmail. Cached on your device, deleted when you sign out.

Maily's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: Google user data is used only to provide and improve the features you can see in the app; it is not transferred to anyone except as described below; it is not used for advertising; no human reads it except where you explicitly ask us to for support, where required by law, or for security investigations; and it is never used to train generalised AI or machine-learning models.

4. The AI features

Sorting, summaries, search answers, drafts and Auto-Reply are produced by large language models run by OpenAI. To answer, the text of the specific messages that feature needs is sent to OpenAI through our server.

OpenAI processes it as our data processor, under their API terms.
It is not used to train OpenAI's models. Data submitted through the OpenAI API is excluded from training by default.
OpenAI may retain it briefly for abuse monitoring and then deletes it.
We do not keep the text after the answer is returned. What we record is the number of tokens used and what it cost.

If you would rather no message content left your phone, you can turn AI sorting and summaries off in the app's settings. The mailbox, search, reading and sending all keep working.

5. Who else sees anything

Who	What they get
Google	Your Gmail and Contacts requests, because that is where your mail lives
OpenAI	Message text needed for an AI feature, as above
Supabase	Hosts our database and servers, and stores what section 2 lists
Apple	Handles subscriptions and delivers push notifications

That is the whole list. We do not sell your data, we do not share it with advertisers, and there is no advertising network in this app.

6. Deleting your data

One mailbox: Settings → Sign out of this mailbox. Its mail, cached photos and preferences are removed from the phone and Maily's access to it ends.
Everything on the phone: You → Edit profile → Sign out of Maily. Every connected mailbox is disconnected and the offline copy, memories and conversations are erased.
Your account entirely: You → Edit profile → Delete account. This deletes your login and every row we hold about you — settings, conversations, memories, usage records — and cannot be undone. We keep only the transaction records we are required to keep for tax and accounting.
You can also write to support@mailyco.com and we will do it for you.

Removing Maily's access from your Google account permissions page revokes it immediately, from Google's side, whatever the app does.

7. Keeping it safe

Everything in transit uses TLS.
Mailbox passwords and tokens are held in the iOS Keychain, not in app storage.
Our database enforces row-level security: rows are readable only by the account that owns them.
Message HTML is rendered with scripting disabled, and pictures and links from a message cannot reach the rest of the app.

No system is perfect, and we will not pretend otherwise. If something happens that affects you, we will tell you.

8. How long we keep things

Settings, memories and conversations are kept until you delete them or delete your account. Usage records are kept for as long as your account exists, so your allowance can be counted. Anything on your phone lasts until you sign out or remove the app.

9. Children

Maily is not for children under 13, and where local law sets a higher age for consent to data processing, that age applies instead. We do not knowingly collect data from anyone below it.

10. Your rights

Depending on where you live, you may have the right to see what we hold, to correct it, to have it deleted, to object to processing, or to take it with you. The app gives you most of these directly. For anything else, write to support@mailyco.com and we will answer within 30 days.

11. Changes

If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always tells you which version you are reading.

12. Contact

Abel Amare, Maily
support@mailyco.com