butMail Privacy Policy
In short
- butMail has no ads, analytics or tracking, and no butMail account. Your mail stays on your iPhone and at your mail provider.
- Push notifications are optional. If you turn them on, our notification server in the EU stores your device's notification token and, for each mail account, its address and app-specific password, encrypted.
- The server only reads your Inbox to detect new mail. It never stores, sends, deletes, moves or marks your messages.
- Sender and subject are encrypted for your device before they leave the server. The visible notification text that passes through Apple is only “New message”.
- Turning push off or removing an account in the app deletes its data from the server.
Who is responsible
butMail is made and operated by Izsáki Róbert (“we”). We are the controller for the data processed by the butMail push notification service. Contact: privacy@ostricks.com.
1. The app on your device
butMail connects directly from your iPhone to your mail provider (for example iCloud Mail or Gmail) over encrypted IMAP and SMTP. Messages, drafts and the local cache are stored on your device. Passwords and keys are stored in the iOS Keychain. We do not receive your mail through the app, and the app contains no advertising, analytics or tracking code.
Optional features that contact other services
- External avatars (Settings → External avatars). To show sender pictures and company logos, the app asks Gravatar for a SHA-256 hash of the sender's address, and Logo.dev and CompanyEnrich for the sender's domain name. These services see your IP address. If you add your own Logo.dev key, it is stored in the Keychain and sent only to Logo.dev. You can turn this off at any time.
- Remote images in messages are blocked by default. If you load them, the sender's servers can see your IP address and that the message was opened.
- Contacts: if you allow it, contact photos and address suggestions are read on the device only. The app never changes or uploads your contacts.
2. The push notification service
iPhone apps cannot keep a mail connection open in the background, so new-mail notifications need a server. The butMail notification service runs at push.ostricks.com. It is used only if you turn on push notifications in the app.
What the server stores
| Data | Why |
|---|---|
| Your device's APNs token and build environment | To deliver notifications through Apple |
| Device public keys (request signing, App Attest, notification encryption) and the App Attest counter | To make sure requests come from your device and the genuine app, and to encrypt notification contents for your device only |
| Mail server, port and user name (your mail address) for each account you enable | To check your Inbox |
| Your app-specific password, encrypted with AES-256-GCM | To sign in to your Inbox. It is decrypted only in memory for a sign-in. |
| Mailbox state: UIDVALIDITY, the highest message number seen and the unread count | To notify you only about mail that is really new, and to set the badge |
| Which device follows which account, timestamps (registered, last seen) and sign-in error counters | To run the service and stop repeated failed sign-ins |
What the server does with your mail
The server opens your Inbox read-only (IMAP EXAMINE, BODY.PEEK). When new mail arrives, it reads the new message's sender, subject, date, threading headers and the first part of its plain text. From these it builds the notification and an Inbox preview, encrypts them with your device's public key and hands them to Apple. These contents are processed in memory only and are never stored or logged. The server never stores message bodies or attachments, never reads other folders, and never sends, deletes, moves or flags mail.
Apple Push Notification service receives the encrypted contents, the generic text “New message”, the badge number, a hashed account identifier and message numbers. It cannot read sender, subject or text.
Logs and abuse protection
Server logs contain only the operation name, its result and a short prefix of a hashed account identifier. They contain no IP addresses, mail addresses, passwords, tokens or message contents. To limit abuse, the server keeps request counts per IP address in memory for up to 24 hours. They are never written to disk.
How long data is kept
- Turning off notifications for an account, or removing it from the app, removes it from the server. When no device follows an account any more, its password and state are deleted immediately.
- Devices that have not contacted the server for 90 days, or whose notification token Apple reports as invalid for 30 days, are deleted automatically with any accounts only they used.
- Deleted data is overwritten in the database. We keep no backups of the notification database.
3. Service providers
- UpCloud Oy (Helsinki, Finland) hosts the server in its Amsterdam, Netherlands data centre under a data processing agreement. Data stays in the EU. UpCloud is ISO/IEC 27001 certified.
- Apple delivers notifications (Apple Push Notification service) and confirms that requests come from the genuine app (App Attest). Apple may process data in the United States under the EU–US Data Privacy Framework.
- Your mail provider (Apple iCloud or Google Gmail): the server signs in to it on your behalf, as described above. Your provider's own privacy policy applies.
We do not sell, rent or share your data for advertising, and we do no profiling or automated decision-making.
4. Legal basis
We process push service data to provide the service you turn on (GDPR Art. 6(1)(b)). We use IP-based rate limits, request signatures and App Attest for our legitimate interest in keeping the service and your accounts secure (Art. 6(1)(f)).
5. Security
All connections use TLS. Passwords are encrypted with a key that is itself encrypted by the operating system and never stored next to the database. The services run with minimal privileges in a hardened environment, and administrator access requires SSH keys. Requests are signed by a key held in your iPhone's Secure Enclave.
6. Your rights
Under the GDPR you may request access to, correction, deletion, restriction or portability of your data, and you may object to processing. The quickest way to delete server data is to turn off push notifications or remove the account in the app. Because the server does not know your name, please include the mail address concerned when you contact us. You may also lodge a complaint with a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (naih.hu); you may also contact the authority where you live.
7. Children
butMail is not directed at children under 16.
8. Changes
We will update this page when the app or service changes and show the new effective date. We will tell you about important changes in the app.