Overview
KiteMail is an email client. It connects to the mailbox provider you choose; it does not create a new mailbox for you or operate an email relay for your messages.
Information the app handles
To show and manage your mail, KiteMail handles the mailbox address, connection settings, message headers, message content, attachments and the settings you choose in the app. This information is used to provide the email features you ask for, such as reading, writing, searching, sorting, notifications and rules.
Mail that KiteMail downloads, including message details and attachments you open, may be cached on your device so the app can show your inbox and previously opened messages. The mail cache is stored in the app’s application-support area, separately from sign-in credentials.
How your email is used
KiteMail communicates with your selected email provider to retrieve, send and organise mail. Your mail remains with that provider. Features such as categories, labels, rules and saved searches are processed by the app using the messages available to it. KiteMail does not use your Google mail to serve ads or train general-purpose AI models.
When you connect Gmail, Google grants KiteMail access to the mail functions you authorise. The app uses that access to display messages and attachments, search, send mail, save drafts and make changes you request, such as marking messages read or moving them to Trash. The ordinary Delete action moves received mail to Trash. In versions that offer it, a separate Empty Gmail Trash action appears only when you are viewing one Gmail account’s Trash. After an explicit warning and confirmation, that action permanently deletes the messages in that account’s Trash through the Gmail API directly from your device; it cannot be undone.
KiteMail uses a Cloudflare-hosted sign-in and notification relay to complete Google authentication and return short-lived access to your device. The relay stores your mailbox address, an encrypted Gmail refresh token and connection information needed to maintain the link. For Gmail notifications it also processes history and message identifiers, installation identifiers and notification tokens. It does not receive or store message bodies, attachments, sender names or subject lines. Gmail passwords are not given to KiteMail; email passwords and app passwords for other providers stay in your device’s secure storage and are never sent to the relay.
Notifications use content-free event markers rather than your sender, subject line or message content. Your device retrieves the relevant message from your email provider when you open the notification.
How we protect mailbox data
Connections to mail providers use encrypted transport: HTTPS for authentication and relay requests, and TLS for IMAP and SMTP connections. The app keeps email passwords and app passwords in the secure-storage facilities provided by the device operating system. The relay encrypts stored Gmail refresh tokens with AES-GCM; its encryption key is held separately from its database.
Downloaded mail is kept in KiteMail’s application-support storage on your device, not in the relay. The mail cache is not separately encrypted by KiteMail; it relies on your device’s app storage protections and any device or disk encryption you have enabled. Anyone with access to your unlocked device or operating-system account may be able to access locally stored mail. Use a device passcode and enable device or disk encryption, especially on a shared computer.
The relay uses installation credentials and time-limited sign-in links to restrict connection requests. We do not sell Google user data. We share the limited connection and notification information described above with our infrastructure and notification providers only to provide these features.
Purchases
KiteMail Pro is a one-time in-app purchase. Purchases are processed by Apple, Google or Microsoft, depending on your device. Mobile purchase status is managed through RevenueCat; Windows purchases are handled by Microsoft Store. KiteMail does not receive your card or payment-account details.
Website information
This website is hosted by Vercel. Like most hosting providers, Vercel may process limited technical information needed to deliver the site, such as IP address, browser type and request logs. KiteMail does not use the website to read your email.
Your choices
You can remove a mailbox from KiteMail at any time. This removes its saved credentials and local mail cache from the app; it does not delete messages from your email provider. You can also clear KiteMail’s local app data through your device settings. You control the messages held by your provider through its own account and privacy settings.
To request deletion of the encrypted Gmail sign-in token stored by our relay, or notification-registration data associated with your installation, email support@kitemailapp.com with the subject “KiteMail data deletion request”. We may ask for limited information needed to identify the relevant installation or mailbox connection. Purchase records remain governed by Apple, Google, Microsoft and RevenueCat retention requirements.
Changes and contact
We may update this policy when KiteMail changes. The effective date at the top will show when it was last updated. For privacy questions, email support@kitemailapp.com.