Privacy Policy

Last updated: 29 October 2026

SamtheCat Mail is owned by SamtheCat Studio. It is a mail client that keeps selected messages private on your iPhone. This policy describes what the app processes on your device and what may leave your device when you connect an email provider.

Our approach

SamtheCat Mail does not operate a service that stores your email password or reads your mailbox on our servers to send you push notifications (unlike many third-party mail apps that keep credentials on vendor servers for instant alerts). In the privacy-first release, mail sync runs directly between your iPhone and your email providers (Google, Microsoft, Apple iCloud).

Data on your device

• Mail you download, drafts, protection state, settings, and security audit entries are stored locally on this iPhone unless you use iCloud backup for the device.
• OAuth tokens and cryptographic keys for protected messages are stored in the iOS Keychain (available after first unlock, so background sync can run).
• Smart Inbox lanes may be computed on your iPhone using Apple’s on-device intelligence when available. Summaries, reply drafts and rewrites are written on your iPhone; the email text is not sent to SamtheCat Studio.
• If you allow it, the app reads your iPhone calendars (for the agenda) and Contacts photos (for sender pictures) on this iPhone only; they are not uploaded. Connecting a Google or Microsoft calendar lets the app read your events and answer invitations directly with that provider. Allowing Auto-Reply and Mail Rules lets the app read and change your out-of-office reply and your Gmail filters or Outlook rules directly with that provider. Searching mail not on this iPhone sends your search words directly to your mail provider.
• The app does not sell your personal data and does not use your data for cross-app tracking.

Data that may leave your device

• When you connect Google, Microsoft, Apple (iCloud), or IMAP, the app communicates directly with those providers to sign in and sync mail using industry-standard TLS. Those providers process data under their own policies.
• If you turn on Sync actions to provider, actions you take in the app (such as read, star, archive, or delete) are sent to that provider.
• New mail alerts: The app may show notifications after it syncs mail. That sync is triggered when you open the app or when iOS runs background refresh; it is not the same as instant push from a SamtheCat Mail server. Apple Push Notification registration may be used for system notifications; in the privacy-first release we do not send your device token to a SamtheCat Mail relay.
• On-device features such as Face ID, notifications, translation, read-aloud, and compose dictation use Apple system services; Apple’s policies apply to those services. Dictation prefers on-device speech recognition when iOS provides it.

Google user data (Limited Use)

When you connect Gmail, SamtheCat Mail requests:

• https://www.googleapis.com/auth/gmail.modify — read, send, archive, star, and move mail (including to Trash). It does not permanently delete mail while skipping Trash.
• https://www.googleapis.com/auth/gmail.settings.basic — only after you allow Auto-Reply or Mail Rules, to read and change vacation auto-reply and Gmail filters.
• https://www.googleapis.com/auth/calendar.events — only after you connect Google Calendar, to show events and answer invitations.

SamtheCat Mail’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google mail and calendar data is used only to provide those user-facing features in the app. It stays on this iPhone (Keychain for tokens; local storage for downloaded mail). It is not sold, not used for advertising, not used to train AI models off this iPhone, and not transferred to SamtheCat Studio or other third parties except Google as your provider. On-device Apple Intelligence may summarise or draft from mail you choose to process on this iPhone; that text is not sent to SamtheCat Studio.

Microsoft user data

Connecting Outlook requests Mail.ReadWrite and Mail.Send (and, if you allow them, Calendars.ReadWrite and MailboxSettings.ReadWrite). The same practices apply: on-device mail client features only, no SamtheCat inbox server.

Your choices

• You can remove connected accounts and their tokens from Settings → Accounts. Removing a Gmail account also asks Google to revoke this app’s access. You can revoke Google access yourself at Google Account permissions.
• You can turn off Sync actions to provider if you want mail actions to stay on this iPhone only.

Children

The app is not directed at children under 13.

Website contact forms

When you use the launch-notify or Support form on samthecatmail.com, we collect the name, email, and message you submit, plus optional marketing consent. Submissions are sent to our CRM (intriQ) over HTTPS via a Netlify proxy—we do not expose webhook keys in the public site.

Contact

Product questions and support: Support contact form (preferred). Privacy-specific requests about your personal data may also be sent to cs_samthecat@protonmail.com.