App Privacy Policy
This Privacy Policy explains how Ak Apps UG (haftungsbeschränkt) processes personal data when you use the Mailself app or contact us. How mailself.co processes personal data is described in the Website Privacy Policy.
1. Controller
Email:
2. What Mailself does
Mailself lets you send a web link from the iOS Share Sheet to your own verified email address.
To provide this service, Mailself processes your account information and the link you choose to send. Limited send and subscription information is also processed to operate the Free plan, Pro, Undo and account functionality.
We do not sell your personal data.
We do not use your personal data for targeted advertising.
We do not use your personal data to track you across apps or websites.
The current Mailself app does not contain third-party advertising or analytics SDKs.
3. Account and authentication
To use Mailself, you provide and verify an email address.
We process your email address, an internal account identifier and authentication and verification information.
Your verified email address is required because it is the destination for links you send through Mailself.
Authentication is provided through Supabase.
The legal basis is Article 6(1)(b) GDPR because this processing is necessary to create and operate your Mailself account and provide the service you request.
Processing that is necessary to protect accounts, prevent abuse and maintain service security is based on Article 6(1)(f) GDPR. Our legitimate interest is operating a secure and reliable service.
4. Links you send
When you choose Mailself from the iOS Share Sheet, Mailself processes:
- the web URL you selected
- the title associated with that URL
- your verified email address
- the authenticated account associated with the send
The URL and title are sent to the Mailself backend so that an email can be created and delivered to your verified email address.
The URL and title are not stored in Mailself’s own database as part of the send record.
Mailself provides a five-second Undo window. The backend delays release of the email so an Undo request can stop the send before it is released.
The legal basis is Article 6(1)(b) GDPR because this processing is necessary to perform the sending service you request.
5. Email delivery through Resend
Mailself uses Resend, operated by Plus Five Five, Inc., to deliver transactional email.
This includes verification emails and emails containing links you send to yourself.
For delivery, Resend processes information including:
- your recipient email address
- the email subject
- the URL and title contained in the email
- technical delivery and log information
Resend stores email and log data in the United States.
For the standard Resend plans used by Mailself, Resend states that email and log data is retained for 30 days.
Resend states that backups persist for seven days.
Resend processes this data on our behalf under its Data Processing Addendum.
Transfers to the United States are protected by the safeguards described in Resend’s Data Processing Addendum, including the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.
Resend uses subprocessors to operate and secure its service. According to Resend, a small sample of emails can be processed on dedicated RunPod infrastructure for trust and safety. Resend states that customer email content processed for normal sending is not used to train or fine-tune AI models.
6. Send metadata and Free quota
The Mailself backend stores limited metadata about sends.
This can include:
- your internal account identifier
- a send identifier
- send status
- timestamps
- whether the send counts toward the Free quota
- whether the send was an onboarding test
The URL and title are not included in these database send records.
Free includes 10 sends per calendar month.
Send metadata is used to calculate the remaining allowance, operate Undo and maintain the service.
The legal basis is Article 6(1)(b) GDPR.
Security and abuse-prevention processing can additionally be based on Article 6(1)(f) GDPR.
7. Data stored on your iPhone
Mailself stores certain information locally on your iPhone.
Depending on your use of the app, this can include:
- your email address
- account and onboarding state
- your remaining Free sends
- recently sent links
- links waiting to be sent
- app settings
- notification status
A link can be stored locally when it cannot currently be sent, for example because your iPhone is offline, a send fails or the Free allowance has been exhausted.
A locally saved link is transmitted to the Mailself backend when Mailself attempts to send it.
8. Pro subscriptions
Pro subscriptions are purchased and managed through Apple’s App Store.
Apple handles your payment information. Ak Apps UG (haftungsbeschränkt) does not receive your payment card details.
To determine whether Pro is active, Mailself processes limited subscription information, which can include:
- the original App Store transaction identifier
- subscription entitlement status
- subscription expiration information
Mailself communicates with Apple’s App Store services to verify subscription entitlement.
The legal basis is Article 6(1)(b) GDPR.
Apple processes App Store purchases and Apple Account information under Apple’s own privacy terms.
9. Notifications
If you allow notifications, Mailself can notify you when a locally saved link is waiting, including when your Free allowance has been exhausted.
The current implementation creates these notifications locally through iOS.
Mailself does not use notifications for third-party advertising.
You can change notification permissions at any time in iOS Settings.
10. Support
If you contact us using the contact details in the Imprint, we process your email address and the information contained in your message to respond to you.
The legal basis is Article 6(1)(b) GDPR where the communication relates to your use of Mailself or Article 6(1)(f) GDPR for general support, security and service administration.
Our legitimate interest is providing support, resolving technical issues and maintaining the service.
Email infrastructure used to route and receive support messages can process your email address, message content and technical delivery information.
Support correspondence is retained only for as long as reasonably necessary to handle and document the request or for longer where necessary to establish, exercise or defend legal claims.
11. Service providers
Supabase
Mailself uses Supabase for authentication, backend functions and database services.
The primary Mailself project data is hosted in Frankfurt, Germany.
Supabase processes personal data on our behalf under its Data Processing Addendum.
Where processing by Supabase or its subprocessors involves an international transfer, the applicable contractual or statutory transfer safeguards apply.
Resend
Mailself uses Resend for transactional email delivery.
Resend processes recipient addresses, email content and delivery information in the United States as described above.
Apple
Apple provides the App Store, StoreKit, subscription billing and related platform services.
Apple processes information under its own terms and privacy policy.
12. How long we keep data
We keep personal data only for as long as necessary for the purposes described in this Privacy Policy or where a longer period is required by law.
In particular:
- your Mailself account and verified email address are kept while your account exists
- account-linked send metadata is kept while your account exists
- URLs and titles are not stored in the Mailself server database as part of send records
- Resend currently retains email and log data for 30 days on its standard plans
- Resend states that backups persist for seven days
- subscription information is kept while necessary to operate and verify your subscription and account
- local app data remains on your device until it is removed by Mailself, account deletion or removal of the app, depending on the type of data
- support correspondence is kept only as long as necessary for support, documentation and applicable legal claims
Where individual records cannot immediately be removed from protected provider backups, deleted information can remain in those backups until the applicable backup retention period expires.
13. Account deletion
You can initiate account deletion directly in Mailself:
Settings → Delete Account
Account deletion is permanent once completed.
When deletion has successfully completed, Mailself deletes the account and account-linked data held in its active backend systems, except where information must be retained by law.
Local Mailself account data is reset as part of the deletion process.
Information already processed by a service provider can remain until that provider’s stated retention period expires.
In particular, email and delivery-log data already processed by Resend can remain for the applicable Resend retention period.
Deleting your Mailself account does not cancel an App Store subscription.
If you have an active Pro subscription and do not want future charges, cancel it separately in your Apple Account.
14. Your rights
Where the GDPR applies, you have the right, subject to the applicable legal requirements, to:
- request access to your personal data
- request correction of inaccurate personal data
- request deletion of your personal data
- request restriction of processing
- object to processing based on legitimate interests
- receive certain personal data you provided in a portable format
- withdraw consent at any time where processing is based on consent
Withdrawal does not affect processing that was lawful before withdrawal.
To exercise your rights, use the contact details in the Imprint.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
The supervisory authority responsible for Ak Apps UG (haftungsbeschränkt) in North Rhine-Westphalia is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenKavalleriestraße 2-4
40213 Düsseldorf
Germany
15. International transfers
Some service providers process personal data in countries outside the European Economic Area, including the United States.
Where required, transfers are protected by an adequacy decision, the EU Standard Contractual Clauses or another transfer mechanism permitted under applicable data protection law.
Details relating to Resend are described above.
16. Automated decision-making
Mailself does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.
17. United States users
Mailself does not sell personal information.
Mailself does not share personal information for cross-context behavioral advertising.
Mailself does not use personal information for targeted advertising.
Where applicable state law gives you additional rights regarding your personal information, you can submit a request using the contact details in the Imprint.
We may need to verify your identity before completing a request.
18. Changes to this Privacy Policy
We may update this Privacy Policy when Mailself, our service providers or applicable legal requirements change.
The current version will be published on this page together with its last-updated date.