Privacy Policy

Effective 2026-11-03

This privacy policy applies to the Mailtrove app (the “Application”) for mobile devices, created by HO CHIU FUNG (the “Service Provider”). The Application is provided “AS IS”.

The short version: your letters live on your iPhone. To read a letter, its photos are sent to Google’s Gemini AI (on Google Cloud Vertex AI) through our server, which passes them on and does not keep them. Cloud backup and sync (Standard and Plus) are optional and off until you turn them on; only then is a copy of your letters kept on our servers, and you can delete it at any time. With Plus you can also let an AI assistant such as Claude, ChatGPT or Grok read your backed-up letters. There are no ads, analytics or tracking; free and paid usage is counted under a random anonymous ID, and an account (Sign in with Apple) is needed only for cloud backup.

What the Application stores, and where

Everything you add is stored locally on your device — and, only if you turn on cloud backup, also on the Service Provider’s servers (see “Cloud backup and sync”):

Photos of your letters
The text read from them and their details (date, sender, receiver, category, summary)
Your corrections, deleted letters (kept in Recently Deleted for 30 days) and settings such as language and app lock

The Application’s data is protected by iOS file encryption, and you can additionally lock the Application with Face ID, Touch ID or your passcode. If iCloud Backup is turned on for your iPhone, this data is included in your iPhone’s backup under Apple’s terms. An account is optional and only needed for cloud backup.

What leaves your device, and why

Reading a letter. To transcribe a letter, each page photo is reduced in size and sent over an encrypted HTTPS connection to the Service Provider’s server (hosted on Google Cloud), which forwards it to Google’s Gemini model on Vertex AI and returns the result to your device.

Asking a question (when this feature is available). Your question, and the details or text of the letters the assistant looks up to answer it, are sent the same way. Earlier questions and answers in the same conversation are included so follow-up questions make sense.

Apart from cloud backup (below), the Service Provider’s server does not store your photos, letter text or questions, and does not log their contents. Under Google Cloud’s terms, Google does not use this data to train its models. Vertex AI data caching has been turned off for the Service Provider’s project. Google may retain request data for a limited time for abuse monitoring as described in Google Cloud’s service terms; requests are processed through Google’s global endpoint.

Cloud backup and sync (optional)

Cloud backup and sync come with the Standard and Plus plans and are off unless you turn them on (Settings → Cloud backup & sync). They need an account, created with Sign in with Apple. The Application asks Apple for no name and no email address; the Service Provider keeps only a one-way hash of the identifier Apple gives it for this app, plus a sign-in session for each of your devices.

While backup is on, the text and details of your letters (including your corrections and letters in Recently Deleted) and a reduced-size copy of each photo are stored in Google Cloud Firestore and Google Cloud Storage in Hong Kong, encrypted at rest by Google and accessible only to the Service Provider’s server. They are used only to keep your devices in sync, to restore your letters, and — if you connect one — to let your AI assistant read them. They are not used to train AI models and are not shared with anyone else.

Turning backup off deletes the cloud copy. Deleting your account (Settings → Cloud backup & sync → Delete account) deletes the account, the cloud copy and any AI assistant connections, and revokes the Sign in with Apple link. Letters on your device are not affected by either. Deleted data may remain in Google’s systems for a short time while it is purged.

AI assistants (optional, Plus)

With Plus and cloud backup on, you can connect an AI assistant such as Claude (Anthropic), ChatGPT (OpenAI) or Grok (xAI) by entering a code from the assistant’s sign-in page in the Application. The assistant can then search and read the text and details of your backed-up letters when you ask it to (not the photos). It can only read: it cannot change or delete anything. What the assistant’s provider does with what it reads is governed by that provider’s own terms and privacy policy.

For each connection the Service Provider keeps the name the assistant registered with, when it was connected and last used, access tokens (stored as one-way hashes) and counts of its requests, to apply limits. You can disconnect an assistant at any time in Settings → AI assistants; turning off cloud backup disconnects all of them.

Usage counts and purchases

To apply the free allowance and paid plans, the Application creates a random identifier the first time it is used and keeps it in your iPhone’s Keychain (so it survives reinstalling the Application). It is not linked to your name, email address, Apple ID or any device identifier.

Under this identifier, the Service Provider’s server stores how many letter and question credits you have used and bought, and short-lived records that a letter or question was paid for (page counts and times only — never photos, letter text or questions). These records are kept in Google Cloud Firestore in Hong Kong.

Purchases are made through Apple. The Service Provider uses RevenueCat to see which purchases belong to the identifier; RevenueCat receives the identifier and Apple’s purchase records, not your letters. See RevenueCat’s privacy policy.

Feedback and problem reports

If you choose to send feedback (Settings → Send feedback, or “Report a problem” on a letter that couldn’t be read), the Service Provider receives your message, the email address you enter (optional, only to reply to you), the Application and iOS version, the Application’s language and your anonymous identifier. A problem report from a letter also includes the error message shown for it — never the letter’s photos or text. Feedback is stored in Google Cloud Firestore in Hong Kong, used only to answer you and improve the Application, and deleted automatically after two years, or sooner on request.

Security and abuse prevention

To keep the service secure and prevent misuse, the server’s logs record technical details of each request: the time, which feature was used, the result, the IP address and your anonymous identifier. When a request looks like misuse (for example a forged request, or text that tries to give the AI instructions), the server records a short event code with your anonymous identifier and a one-way hash of the IP address, and the Service Provider may be alerted. Logs never contain photos, letter text, questions or answers, and are deleted after 30 days.

The Application does not use any analytics, crash reporting, advertising, tracking or fingerprinting services, and does not sell or share your data.

Does the Application collect location information?

No. The Application does not request or collect location information.

Do third parties see your information?

Google, as the AI processor and cloud host described above; Apple (Sign in with Apple and purchases) and RevenueCat (purchases) as described above; and, only if you connect one, the AI assistant you choose, which reads your backed-up letters when you ask it to.

Your choices and rights

Export: Settings → Export all letters creates a ZIP file with every photo and all text, which you can keep anywhere.
Delete: deleting a letter moves it to Recently Deleted; it is removed for good after 30 days, or immediately if you choose “Delete now”.
Cloud copy: turning off cloud backup deletes the copy on the Service Provider’s servers; deleting your account also deletes the account and AI assistant connections.
Remove everything: uninstalling the Application deletes all data stored in it (other than any iPhone backups you have made). If cloud backup is on, turn it off or delete your account first to remove the cloud copy too.

Unless you turn on cloud backup, your letters are not stored on the Service Provider’s servers, so there is no server-side copy of them to access or delete. The usage counts for your anonymous identifier can be deleted on request: send the Account ID shown in Settings → Plan. Questions about your data can be sent through Settings → Send feedback, or to support@mailtrove.app.

Children

The Application is not directed to children under the age of 13 and does not knowingly collect personally identifiable information from children. If you believe a child has provided personal information through the Application, please contact support@mailtrove.app. Users in the EEA and UK must be at least 16 years of age (or the equivalent local digital-consent age) to use the Application without parental consent.

Security

Data sent from the Application is encrypted in transit (HTTPS). Requests to the Service Provider’s server require an application key, are rate-limited and are limited by your plan. Data on your device is protected by iOS file encryption and, optionally, the in-app lock. The cloud copy is encrypted at rest, kept in a private storage location with no public access, and reachable only through your signed-in devices and the AI assistants you connect, which get read-only access with short-lived tokens.

Changes

This Privacy Policy may be updated from time to time. Changes will be posted on this page with a new effective date. Continued use of the Application after any change constitutes acceptance of the change.

Contact

Questions about this policy: support@mailtrove.app.