The shortest privacy policy we could honestly write.

Unlike Mail is operated by Adamanture Private Limited (“we”, “us”), the data controller for the personal data described here. Privacy questions, requests, and grievances: support@adamanture.com.

• Account identity — the email address you sign in with, the account identifier your provider (Google, Microsoft, or Zoho) gives us during OAuth, and the display name and avatar it shows us, so we can label your accounts. Used to run your account; nothing else.
• Billing records — once you pay: your plan, the amounts and currency, dates, your billing country, the payment method you used (for example card or UPI), and Razorpay’s identifiers for the payment, subscription and refund. Card, UPI and bank details go to Razorpay and never reach our servers (§ 07). If you subscribe in the Android app, Google Play shares with us the order id, the purchase token, the amount and currency, the period it covers and your country; we keep them to credit the time you paid for, and a random account identifier we create and pass to Google Play so the purchase can be matched to your account.
• Operational logs — timestamps, status codes, and error traces, content-free, kept briefly to keep the service healthy and debuggable.
• Security activity history — sign-ins, account changes, and sync events from your devices (which platform, when), shown to you in the app so you can see what touched your account. Content-free; it goes when your account does.
• Push notification token (Android only) — turn notifications on in the Android app and the device registers a token with Google’s Firebase Cloud Messaging, which we store against your mailbox so we can wake the app. The notifications we send are contentless: an empty poke, after which your device fetches and decrypts the message locally. For a Gmail mailbox, Google’s push service tells our server that something changed and names the mailbox address, never the message. Remove the account or turn notifications off and the token goes with it.
• Crash reports (Android only) — if the app crashes, the device sends a report to Google’s Firebase Crashlytics so we can fix it: the stack trace, device model, OS and app version, free memory and disk, and when it happened. Before a report leaves the device we strip email addresses and credentials from its text, and it never includes your messages, contacts or keys. Google holds reports for 90 days; they are not linked to your account.

Our database also holds material that is opaque to us by construction: your wrapped keys, sealed provider tokens, and sealed message data. The keys that open them exist only on your devices. The full inventory — stored, never-stored, and transient — is published on the Compliance & Trust page, and the mechanism on the blueprint. A breach of our database is a breach of noise.

• Message plaintext of sealed mail, ever. We keep no mail content of any kind; what the web version briefly holds in memory is described in § 06
• Your passphrase, keys, or anything derived from them
• Advertising profiles, tracking pixels, anything resold to anyone — and no usage analytics inside the app: the one diagnostic signal we take is the content-free crash report in § 03. (Visit counting on this marketing site is covered in § 08.)
• Your contacts for any purpose beyond showing them to you

We make nothing from reading your mail. It’s promise #4 on the mission page, and the architecture enforces it better than any policy could.

Your mail lives at your provider — Google, Microsoft, or Zoho — exactly as before; Unlike Mail is a client, not a new mailbox. The Windows and Android apps read and send it by talking to your provider directly. Sealed messages are encrypted on your device before any server — ours or your provider’s — sees them. Mail exchanged with people not on Unlike Mail is ordinary email, governed by your provider’s privacy policy, not ours.

What our server does today. Our server still takes part:

• Each time an app starts or you add a mailbox, the app sends our server a short-lived access token from your provider so we can confirm the mailbox is yours. The server checks it and does not keep it; the app keeps the long-lived sign-in in your device’s secure storage.
• For a Zoho mailbox, the sign-in and every token refresh pass through our server, which adds the secret Zoho requires and keeps nothing.
• While you are signed in, it holds your unlock keys in memory, and drops them when you sign out, go idle, or it restarts.
• Its push service sees the mailbox address in a Gmail notification (see § 03).

The web version is being retired. Until it goes, our server keeps the refresh token of each mailbox signed in there, encrypted under a key only your passphrase unlocks, and relays your mail through its memory while you are signed in, keeping none of it.

Google user data. Unlike Mail’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We ask Gmail for the access the client needs — to read, modify, and send on your behalf — and use it for nothing but running the mailbox you signed in to. Not for advertising, not for resale, and not read by a human except with your explicit consent, to resolve a support issue you raised, or where the law requires it.

Other processors. Amazon Web Services hosts our servers and database, and Cloudflare serves this site and sees the ordinary request data any web host sees. Google’s Firebase carries push tokens and, in the Android app, crash reports (§ 03). Unsplash supplies the wallpaper pictures: it sees your device’s IP address when a picture loads, never your mail or who you are. Payment and billing-email processors follow.

Razorpay is our payment processor. When you pay, Razorpay’s checkout collects your card, UPI or netbanking details and your contact details, and processes them under its own privacy policy. We don’t collect or store them; we receive the outcome of the payment and the billing records listed in § 03.

Google Play is the payment processor in the Android app. A subscription bought there is charged and managed by Google Play under Google’s privacy policy, and Google never gives us your card or payment details. Google tells us about each order and each change to the subscription (renewal, cancellation, refund) so we can add or take back the time; what we receive is listed in § 03, and we keep it for billing, as below.

Billing emails. Receipts, payment alerts, notices before an automatic charge and reminders that your access is ending are sent through Zoho CPaaS to the address of your connected mailbox. They come from billing@adamanture.com (Adamanture Private Limited), and replies go to support@adamanture.com. Reminders that your access is ending can be turned off; receipts, payment alerts and notices before a charge are always sent. For a subscription bought through Google Play, Google sends the receipts and renewal notices, and we send only the reminders that your access is ending.

Payment records outlive the account. If you delete your account, we keep payment records — amounts, currency, dates, billing country and payment identifiers — for 8 years, because the Companies Act, 2013 (section 128) requires us to keep our books of account. After deletion those records are no longer linked to you. Razorpay and Google keep their own records under their own policies.

The apps use no advertising cookies, no cross-site trackers, no fingerprinting and no analytics. The web version, while it lasts, sets a single HttpOnly session cookie so you stay signed in.

This marketing site (unlikemail.com) uses Google Analytics 4 to count visits and see which pages are read. It runs only on unlikemail.com, after the page has loaded, and sets first-party cookies (_ga and _ga_*) holding a random identifier. Google receives the pages you view, where you came from, your browser and device type, and an approximate location derived from your IP address, and processes them under Google’s privacy policy. We don’t use it for advertising, and it is never linked to an Unlike Mail account. To opt out, block those cookies or use Google’s opt-out add-on. Cloudflare serves the site and sees the ordinary request data any web host sees.

Delete your account and we delete your rows — identity, wraps, ciphertext — within 30 days, backups included on their rotation. Revoking our OAuth access at your provider cuts our mailbox access instantly, independent of us. Operational logs expire on a short fixed schedule. And because everything sensitive was ciphertext, deletion is belt-and-suspenders: the data was useless the whole time.

One exception: payment records. They are kept for 8 years for accounting, no longer linked to you (§ 07). Deleting your account also cancels auto-renew; time you have already paid for isn’t refunded (see Cancellation and Refund).

Wherever you are, we honor: access (a copy of what we hold about you — it’s short), correction, erasure (except the payment records we must keep, § 07), portability (your mail is already portable — it’s your mailbox), and objection. EU users: our lawful basis is contract performance (running the service you asked for). India: requests under the DPDP Act 2023 go to our grievance contact. All of it: support@adamanture.com, answered by a human, usually within days not months.

• Age: Unlike Mail is for adults. Creating an account requires confirming you are 18 or older, and we record that confirmation. We don’t knowingly hold data from anyone under 18 — tell us at support@adamanture.com and we’ll delete the account.
• Changes: if this policy changes materially, we’ll email you before it takes effect and keep the old version available. No silent edits.
• Contact: support@adamanture.com — a human reads it.