Mitsa Mail — Privacy Policy

Effective Date: 2 September 2026 | Last Updated: 6 September 2026

This Privacy Policy explains how Mitsa Mail ("Mitsa", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use mitsa.email, the Mitsa web application, and related email and productivity services (collectively, the "Service").

1. Google API Services User Data Policy Compliance

When you connect your Google (Gmail) account to Mitsa Mail via Google OAuth:

• Data Accessed: Mitsa Mail accesses your Gmail email address, profile information, email messages, message threads, subject lines, timestamps, sender/recipient addresses, and message bodies.
• Purpose of Access: We access this data strictly to provide user-facing email client functionality—specifically to display your messages in your unified Mitsa inbox, allow you to compose and send messages, organize threads, search your mailbox, and manage drafts.
• No Advertising: We do NOT use, transfer, or disclose your Google user data to serve advertisements, build advertising profiles, or monetize your personal communications.
• No Model Retraining: We do NOT use your Google user data to train, retrain, or fine-tune generalized machine learning or artificial intelligence models.
• Human Access Restrictions: Human workers do not read your Google user data unless: (1) you have provided explicit permission to resolve a specific technical issue, (2) it is necessary for security investigations (such as investigating abuse or malware), or (3) required by applicable law.
• Limited Sharing: We do NOT transfer or sell your Google user data to third parties, except as strictly necessary to operate the Service infrastructure or comply with valid legal processes.

2. Information We Collect and Process

A. Account and Authentication Data

When you create an account, we collect your Mitsa email handle (e.g., you@mitsa.email), display name, and password. Passwords and passcodes are cryptographically hashed using salted Argon2id algorithms and are never stored in plaintext. We also collect optional recovery email addresses and confirmed timezones to properly format calendar events and email dates.

B. Mailbox and Productivity Content

We process the content of your communications, including emails sent, received, or drafted, attachments, recipient lists, contacts, calendar events, and To-Do lists. This data is processed to deliver, display, and organize your communications.

C. Connected External Accounts (Gmail, Apple iCloud, IMAP)

If you connect external email accounts, we securely store the authentication credentials or OAuth tokens required to establish encrypted connections to those providers. OAuth refresh tokens are stored encrypted and are used exclusively to synchronize your mailbox on your behalf.

D. Log and Technical Data

We automatically collect diagnostic information including IP addresses, browser types, request timestamps, mail delivery server logs, and error telemetry. This data is used solely to maintain server security, monitor network uptime, and prevent fraudulent abuse.

3. How We Use Information

We use information collected through the Service to:

• Create, maintain, and authenticate your user account;
• Receive, deliver, store, search, and manage your email messages;
• Provide unified inbox access across Mitsa and connected external accounts;
• Facilitate contact management, calendar scheduling, and task tracking;
• Detect and prevent spam, phishing, unauthorized access, and malicious activities;
• Respond to your support requests and technical inquiries.

4. Data Storage, Retention, and Security

Mitsa Mail takes security seriously. All network communication between your browser and our servers is encrypted using industry-standard TLS (HTTPS). Authentication tokens and sensitive credentials are encrypted at rest.

We retain your account and mailbox data for as long as your account remains active. If you delete an email or disconnect a connected external account (such as Google), the cached data and associated OAuth access tokens are removed from our active database.

5. How to Revoke Access and Delete Data

You have full control over your connected accounts and personal data:

• Disconnect from Mitsa: You can disconnect your Google or other external accounts at any time from the "Connected Inboxes" dialog within the Mitsa application by clicking the "Disconnect" button.
• Revoke from Google Account: You can revoke Mitsa's access to your Google account at any time by visiting Google Security — Third-party apps with account access.
• Account Deletion: You can request complete deletion of your Mitsa account and all associated data by sending an email to privacy@mitsa.email.

6. Children's Privacy

The Service is not intended for individuals under the age of 13 (or the minimum legal age in your jurisdiction). We do not knowingly collect personal information from children.

7. Changes to This Privacy Policy

We may periodically update this Privacy Policy. Any modifications will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our team at:

Mitsa Mail
Privacy Team: privacy@mitsa.email
Support: support@mitsa.email
Developer Contact: gaurav.agarwl@gmail.com
Website: https://mitsa.email