Last updated 20 October 2026
This policy explains what data SuperMailOS collects, how we use it, and the choices you have. SuperMailOS is operated by Adee Labs LLP (Jaipur, Rajasthan, India). We keep it plain-spoken on purpose.
In plain English
A summary for convenience — the full text below is what applies.
Account information: your name, email address, company name, and login credentials (passwords are stored only as salted hashes, never in plain text).
Email content: the messages, threads, contacts, and attachments in your mailboxes. We store these so we can deliver and display your mail; that is the core of the service.
Deliverability and operational data: sending logs, delivery/bounce events, DMARC aggregate reports, and sending-IP reputation signals we use to keep your mail landing in the inbox.
Basic usage and device data needed to operate and secure the app.
To provide the service: send, receive, store, thread, and display your email, and manage your domains and mailboxes.
To protect deliverability and prevent abuse: monitor for spam, compromise, and sending anomalies across our shared infrastructure.
To support you and communicate essential account, security, and billing notices.
We do not sell your data, and we do not read your email except as required to operate the service, prevent abuse, or comply with law. We never use the content of your email to train advertising or unrelated models.
A workspace admin can create API keys so their own code can read, search, organize and send mail. Everything about this is opt-in: no key exists until an admin makes one.
We store only a one-way hash of each key and its first few characters, so the admin can recognise it. The key itself is shown once and cannot be recovered. We also record who created it and when it was last used.
A key acts for the person who created it and can reach only the mailboxes that person can open. It stops working when an admin revokes it or when its creator leaves the workspace.
To make sends safe to retry, we keep for 24 hours a fingerprint of each send request and the ids in our response. We do not keep the message text for that purpose. Sends made with a key are recorded in the audit log like any other send.
If an admin sets up a webhook, we send event notifications to the URL they choose when mail arrives, is sent, is delivered, bounces or draws a complaint.
These notifications carry metadata only: the sender and recipient addresses (never Bcc), the subject, identifiers, timestamps and, for incoming mail, a short preview of up to 140 characters. They never include the message body or attachments. Each is signed so your server can check it came from us.
We keep a log of each delivery for 30 days: the event, whether it succeeded, the response code, and the first few kilobytes of your server's reply. We also keep the notification itself for that time so it can be retried or resent.
The endpoint is yours. What happens to a notification after it reaches your server is up to you and your own providers.
You can connect an AI assistant to your mailboxes through our MCP server. Assistants such as Claude and ChatGPT connect by signing you in to SuperMailOS: we show you which app is asking and what it wants to do (read mail; organize mail and save drafts; send mail), and you can approve fewer permissions or decline. Developer tools such as Claude Code, Cursor, VS Code or Windsurf can also use an API key that a workspace admin creates. Nothing is connected until you approve an app or an admin creates a key. A connection acts as the person who approved it (or created the key), reaches only the mailboxes that person can open, and can do only what was approved.
For each app you approve we store the name and return address the app gave us, the permissions you approved, when it was last used, and one-way hashes of its access and refresh tokens, never the tokens themselves. An approval lasts at most 90 days. You can see and disconnect your connected apps under Settings → Connected apps; changing your password or leaving the workspace disconnects all of them.
When the assistant asks for mail, we return that mail to the assistant you connected. From there it is processed by that tool and its AI provider under your own agreement with them, not by us and not under this policy. Check that provider's terms before connecting a mailbox that holds sensitive mail.
Apart from the built-in AI features described below, which run only when someone uses them, we do not send your mail to any AI provider ourselves. We do not use your mail to train AI models.
Anyone can email you text written to manipulate an assistant. Our documentation explains how to limit that risk, including keeping send permissions off and approving sends yourself.
The inbox has two built-in AI features: Summarize, which summarizes a long conversation, and Write with AI, which drafts an email or rewrites what you wrote. A workspace admin can turn them off for everyone in the workspace.
They run only when someone clicks one of them, never in the background. When you do, we send what that request needs to Anthropic's Claude API, which writes the result. For a summary, that is the conversation: its subject and, for each message, who it was from and to (names and email addresses), when it was sent, its text, and the names and sizes of any attachments. Bcc lines and the contents of attachments are never sent. For Write with AI, it is your name and the address you are writing from, what you typed into it and the draft you asked it to rewrite, together with the conversation you are answering (as for a summary), the email you are forwarding and who it is going to, or the recipients and subject of a new email.
The result comes back only to the person who asked. Anthropic processes this data as our service provider, and under its commercial terms it does not use it to train its models. We keep a count of AI requests per person per day, which we use to limit use, but not their text. A summary is kept in our server's memory for a few hours, so that opening the conversation again doesn't ask again.
AI can be wrong. A summary or a draft is a starting point: read it before you rely on it or send it.
The iPhone and Android apps keep a copy of your mail on your device so it opens instantly and works offline; it's removed when you sign out. Notifications go through Apple (iPhone) or Google (Android) and contain the sender's name, the subject and a short preview, never Bcc recipients or attachments, and only for the addresses you turn on.
We use PostHog to understand how SuperMailOS is used and to find and fix problems. In your browser it records which pages you visit and what you click, your browser and device, your IP address and approximate location, how fast pages load, errors, and recordings of visits (how the page was laid out and where you clicked and scrolled). Our servers also report errors, and a few account events such as signing up or verifying a domain.
Your mail is never sent to PostHog. On every page you use after signing in, your mail and what identifies you or the people you write to (names, addresses, subjects and message text), your workspace's details (such as its people, domains, devices and billing), everything you type, images and attachments are masked in your browser before anything is sent, and message bodies are left out of recordings entirely. What a recording shows is the page's layout and our own words on it, such as buttons, menus, headings and labels. Error reports have addresses and other personal details removed.
We link this to your account (your name, email address and workspace) so we can help when something goes wrong. Recordings are kept for 30 days. You can switch this off for your browser in Settings, under This app, and we switch it off when your browser sends a Global Privacy Control or Do Not Track signal. Switching it off stops what your browser sends; our servers still record the account events and errors above.
The free checkers on our site look up the domain or address you enter in public DNS and, depending on the tool, public blocklists and domain registries. We do not keep a record of what you enter or of the result; a recent lookup may sit in server memory for up to ten minutes so a repeat check is quick. We keep only a count of how many checks ran each day, per tool, and use your IP address in memory to rate-limit requests.
Payments are handled by Paddle.com, our merchant of record. Paddle processes your card and billing details directly; we never see or store full payment card numbers. Paddle's handling of your data is governed by its own privacy policy.
We use one essential, signed session cookie to keep you logged in. For the analytics described above, PostHog keeps a first-party cookie and browser storage (named ph_…) to recognise your visits. We do not use advertising or cross-site tracking cookies.
We rely on a small set of providers to run the service:
These providers process data only to provide their service to us, under contract.
We keep your data for as long as your account is active. When you close your account we will, on request and where feasible, provide a window to export your mail, then delete your content within a reasonable period, except where we must retain records to comply with law.
We protect data in transit with TLS and apply access controls, credential hashing, and monitoring. No system is perfectly secure, but we work to safeguard your data and to isolate each customer's mail.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. You can exercise these from within the app or by contacting us.
Your data may be processed in the countries where our infrastructure and providers operate. Where required, we use appropriate safeguards for international transfers.
SuperMailOS is operated by Adee Labs LLP, Jaipur, Rajasthan, India. For privacy questions or to exercise your rights, email us at privacy@supermailos.com.