Privacy Policy
In short: Enveloo is a mail app that works directly between your device and your mail provider. Your messages, passwords and settings are stored on your device in an encrypted database. We don't have them, we can't read them, and we don't track you.
Who we are
Enveloo is made by Tyron s.r.o., Slovakia. For privacy questions write to [email protected].
Your mail and accounts
- The app connects from your device straight to your mail provider (for example Gmail, Outlook or your company's mail server) over encrypted connections (TLS) to download, send and organize your mail.
- Messages, attachments, account passwords and sign-in tokens are stored on your device, in a database encrypted with a key kept in your device's Keychain. We can't read them — the one exception is the mailbox sign-in our server keeps for Instant notifications (below).
- When you sign in with Google or Microsoft, the sign-in happens in your browser with that provider. The app receives a token that lets it access your mailbox and stores it only on your device. You can revoke it anytime in your Google or Microsoft account settings.
- Enveloo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Gmail data is used only to show, search, organize and send your mail in the app, is not transferred to us or third parties, and is never used for advertising or to train AI models.
Instant notifications
With device sync on, Enveloo's server watches your inbox so a notification reaches your devices even when your other devices are off. This is on by default for IMAP accounts (including Gmail and Outlook) and you can turn it off for each account in Settings.
- Your device gives the server the account's sign-in (password or sign-in token) over an encrypted connection. The server stores it encrypted and uses it only to open your inbox read-only.
- From new messages it reads only the sender, subject and first lines to build the notification. It stores no mail, and the notification is encrypted for your devices, so Apple can't read it.
- Turning it off for an account, or removing the account, deletes the stored sign-in from the server.
Sender icons
To show a company's logo next to its messages, the app downloads the icon directly from the sender's own website (for example allegro.pl). That website can see your IP address, as with any web request. Personal domains like gmail.com are never contacted this way; those senders get initials instead.
Images in messages
Remote images in messages are blocked by default, because they're often used to track when you open an email. They load only for the message where you choose "Load images".
What we don't do
- No analytics, advertising or tracking SDKs, and no cookies on this website.
- We don't sell or share personal data.
- We don't collect your contacts, messages or usage data.
Crash reports
If you share crash reports with developers in your device's settings, Apple may pass us anonymous technical reports. They don't contain your messages.
Your rights
Because your data stays on your device, you control it: removing an account in Enveloo deletes its messages and credentials from the device, and deleting the app deletes everything. Under the GDPR you can contact us at [email protected] with any request; you can also contact the Slovak Data Protection Office (dataprotection.gov.sk).
Changes
Future versions will sync settings and read status between your devices through our server in end-to-end encrypted form, so we still won't be able to read them. We'll update this policy before that ships.