Privacy Policy
Last updated November 14, 2026
Aura Mail ("the app," "we") is an email client for iOS developed by Inplace Studio. This policy describes what data the app handles and how.
The short version: your email stays yours. We access your mailbox only to show it to you and to perform actions you take or approve.
We never sell your data, never use it for advertising, and never use your email content to train AI models.
You can disconnect your account and delete your data at any time.
Data we access
Email data (Gmail, Outlook, or IMAP accounts you connect). With your permission via Google/Microsoft sign-in or IMAP credentials, the app reads your messages to display them, modifies them (archive, label, read state, trash) and sends messages only when you — or the app's assistant acting on your explicit approval — take those actions.
Account identity. Your email address and display name, to label your mailbox and route notifications.
Calendar data (only if you connect a calendar). Events are read to show your schedule in the app, and events are created only when you add one. When the assistant drafts a reply to a scheduling request, it is given your free/busy times, never event titles or attendees.
Writing style. To draft replies in your voice, the app builds a short description of your writing style from your own sent replies. It is used only to generate your drafts.
Scheduled and snoozed messages. A message you schedule is stored on our backend until it is sent, then deleted. Snooze records hold only the message identifier and the wake time.
On-device storage. Messages are cached on your iPhone, protected by iOS data protection, so they can be shown quickly and arrive with notifications. Credentials on the device are kept in the iOS Keychain.
Your own AI key (optional). If you add your own AI provider key in Settings, AI requests go directly from your device to that provider under its terms.
How Google user data is used (Limited Use disclosure)
Aura Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Gmail data is used only to provide user-facing features of the app: displaying and organizing your mail, sending messages you compose, and generating AI suggestions (replies, summaries, triage) for you.
- Gmail data is not used to develop or train generalized AI/ML models.
- Gmail data is not sold, not used for advertising, and not transferred to third parties except sub-processors listed below that are necessary to operate the app, or as required by law.
Sub-processors
| Service | Purpose | Data touched |
|---|---|---|
| Railway (US) | App backend: authentication, push notification delivery | Message metadata needed for notifications (sender, subject, snippet); OAuth tokens (encrypted at rest) |
| Vercel (US) | AI agent backend | Message content transiently for AI processing; extracted metadata (e.g. suggested contacts/tasks) |
| Supabase (US) | Database | Account records, OAuth tokens, agent suggestions, notification bookkeeping |
| Anthropic (US) | AI processing (Claude API) | Individual message content, processed transiently to generate suggestions; not used by Anthropic to train models per API terms |
| Apple (APNs) | Push notification delivery | Notification content (sender, subject, preview) |
Retention & deletion
- OAuth tokens are stored until you disconnect the account.
- The AI agent stores extracted suggestion data (e.g. a proposed contact or task) until you act on or dismiss it.
- Removing an account in the app revokes its tokens and deletes stored credentials. "Delete Account & All Data" in Settings permanently removes everything we stored.
- You can also request deletion by email; it is completed within 30 days.
Read-status pixels (optional feature)
If you enable "Track Opens" for an email you send, that email includes a tiny image hosted by our backend that records when the message is first opened. This is off by default and per-message.
Security
Data in transit is encrypted (TLS). Tokens and data at rest are stored in access-controlled databases with row-level security. Backend requests are authenticated with signed tokens.
Your choices
- Disconnect any account in Settings at any time.
- Revoke the app's Google access at myaccount.google.com/permissions.
- Contact us for data export or deletion.
Contact
Inplace Studio — sarjit@inplacestudio.com
7739 Fay Ave, La Jolla, CA 92037
Changes to this policy will be posted at this URL with an updated date.