Privacy Policy

Last updated: August 2026. This Privacy Policy explains how Mymail processes personal information when you use the website, browser mail client, Windows app, Android app, and email Service.

Our goal: We aim to collect and retain only what we need to operate the Service. We protect data in transit with HTTPS (TLS), hash account passwords, and encrypt stored mailbox credentials on our servers.

Information we process: We process account information (such as your email address and optional recovery email), authentication and session data, device and app settings needed for the Service, and email metadata needed for delivery and mailbox features (for example sender, recipient, timestamps, folder identifiers, and — for non-E2E mail — subject).

Message content and attachments: To deliver and display your mail, our Service retrieves, processes, and transmits message metadata, and for standard (non-E2E) mail also message bodies and attachments. Content is protected in transit with HTTPS. For @mymail.krd-to-@mymail.krd mail sent from Mymail browser webmail, the Windows app, or the Android app, clients encrypt the body, subject, and attachments before upload when keys are available, so the stored content is ciphertext. Pro/Business Cloud files uploaded from the Mymail suite are encrypted on the device (names and contents) with the same keys; the Contacts book and Calendar events are encrypted the same way. We store ciphertext and cannot read those files, contacts, or events. We may also store a password-wrapped private-key backup so you can restore encryption keys on another device; without your password that backup is not readable by Mymail. Mail to or from outside domains (for example Gmail) stays standard internet email. If you enable local mail caching in the app, message data may also be stored on your device.

Device storage: Some information may be stored on your device (for example cached message data, settings, drafts, and local encryption keys). On Android, private keys use the system Keystore via Secure Store. In the browser and Windows app, keys stay in local site storage; with App lock enabled they are PIN-wrapped at rest while locked. Signing out or removing an account removes that address’s local encryption keys from the device. Optional App lock protects the client on that device with a PIN (and biometrics on Android); it does not encrypt mail on the server.

Support communications: If you contact support or report a bug, we process the information you choose to provide. Please avoid including sensitive content you do not want shared.

Billing data: If you subscribe to a paid plan, Stripe processes payment details on our behalf. We store subscription and entitlement records needed to apply plan limits; we do not store full card numbers on Mymail servers.

Your choices: You can sign out in the browser or app and contact us to request account deletion or access where applicable. In Settings you may opt into a separate Encryption password for your key backup, view your key fingerprint, and enable App lock. Paid plan and payment methods are managed in Account → Billing.

Platform availability: The current beta offers Mymail in the browser, via Windows download, and via direct Android APK download. We may expand to iOS and other clients in later versions; this Policy will continue to apply to those clients when available.

Contact: For privacy questions, contact support@mymail.krd.

Mymail · support@mymail.krd · llms.txt