V Mail
Privacy notice
V Mail is a mail client that keeps a searchable copy of the mailboxes you connect. This page says what it keeps, what it does with it, who else touches it and how to get it removed. It is written to be read.
Who is responsible
The person or company that runs this V Mail server decides what happens to your data and is responsible for it: the person who runs this V Mail server. Write to them for anything on this page.
What is kept
- Your account: your name, your e-mail address and your password. The password is never stored as such, only as a salted scrypt hash.
- Your mailbox access: the server address and the password or token you give for a mailbox you connect. These are stored encrypted, and are used only to read and send mail for you.
- Your mail: a copy of the messages, their attachments and the text read out of attachments, so they can be searched and sorted here. Messages are kept on this server until you ask for them to be deleted.
- What is worked out from your mail: topics, summaries, tags, to-dos, dates, who is in a conversation and in what position. They are made from your own mail and shown only to you.
- Settings: appearance, signatures, rules and similar choices.
- When you registered and accepted the terms, and which version.
- Your mobile number, when this server asks for one to stop fake accounts. It is used once, to send a code by text message. Afterwards only a one-way fingerprint of it is kept, so the same number cannot open a second account; the number itself is not stored.
Who else sees it
- Text processing. To read and summarise a message, its text (and the text of its attachments) is sent to an external text-processing service that works for this server and not for its own purposes. Ask the person who runs this V Mail server which one is in use.
- A text-message provider receives your mobile number and the code when you register on a server that asks for one.
- Your mail provider (Gmail, iCloud, your company's server) sees what it always sees: V Mail connects to it as you.
- The hosting provider of this server stores the data on its machines.
- Nobody else. Your mail is not sold, not used for advertising and not shown to other people who use this server.
What is not done
- No analytics, no advertising, no tracking pixels, no session recording.
- No fonts or scripts are loaded from other sites: everything the pages need comes from this server.
- Remote images in a message load only when you choose to show them (the sender then sees that you opened it). A map for a meeting place from Google loads only when you tap to show it, and Google then sees your address like any website would.
- When you choose a password, five characters of a one-way hash of it are sent to a password-breach service to learn whether it has leaked before. The service cannot tell which password it is, and the password itself never leaves the server.
Cookies and storage in your browser
One cookie keeps you signed in. It is necessary for the service, cannot be read by scripts on the page and is sent only to this server. The browser also remembers interface choices, such as the theme and which panels are open. Nothing is stored to follow you around.
Who may use it
You must be 16 or older. If you are younger, do not register.
Your rights
You can ask to see what is kept about you, to have it corrected, exported or deleted, to limit or object to how it is used, and to complain to your data protection authority (in Croatia, AZOP). Disconnecting a mailbox in V Mail stops it being read, but does not by itself delete the copy already kept here; the mail itself always stays at your provider. To have the copy, or the whole account and everything kept for it, deleted, write to the person who runs this V Mail server.
Security
Connections are encrypted, sessions are tied to your password, mail opens in a sandbox where scripts cannot run, sign-in attempts are rate limited and you can add a second step with an authenticator app in Settings.
Changes
When this notice changes in a way that matters, the version above changes and you are asked to accept it again.