Effective date: October 29, 2026. This policy describes data processing by MailSteward, the iOS email client and optional personal assistant. The operator is the developer identified on the App Store listing. Privacy and support contact: treeui.old@gmail.com.
When you connect a mailbox, your phone communicates directly with the selected email provider. Gmail and Microsoft use OAuth; compatible IMAP/SMTP accounts use a password or app-specific authorization code. Credentials and OAuth access and refresh tokens are stored in the iPhone Keychain. Our backend does not receive these credentials. The app reads recent inbox messages, sender/recipient addresses, subjects, dates, message bodies and inline images to display mail, prepare replies and provide the assistant features you choose. Mail caches, drafts, rules, memories and action history stay in files protected by iOS data protection. Remote HTTPS email images load only at your request and are cached temporarily on the phone; the remote image host may receive network information for that download. Optional contact access matches sender photos locally and does not upload your address book to our AI service.
On supported iPhone 17 models and newer iPhones, you can choose to download an approximately 429 MB Qwen model. Local-mode mail analysis, draft rewriting and text suggestions run on the phone. Model downloads, mail synchronization and Apple services you request can still use the network. The small local model does not plan system tool actions.
Cloud processing requires your separate in-app consent. When you request analysis, rewriting or tool assistance, or enable foreground automatic analysis, necessary selected sender information, subjects, email excerpts, your instructions, and bounded results from authorized tools are sent through Cloudflare Workers to Cloudflare Workers AI for personalized suggestions. You can disable cloud consent in Settings. We do not store email bodies or model replies in our business database or application logs. Cloudflare processes network, security, performance and billing metadata and may retain data under its safety or legal exceptions. Processing uses Cloudflare's global network; we do not promise processing in a single country. See Cloudflare Workers AI data usage.
MailSteward's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the visible mail features and personalized assistance explicitly chosen by the user. We do not sell Google data, use it for advertising, or use it to train general-purpose AI/ML models. Gmail read access displays mail and supplies only the assistance the user authorizes. Gmail send access delivers user-confirmed ordinary messages or bounded messages to a paired Channel member under explicit foreground preauthorization. Our backend does not send user email.
If you use Sign in with Apple, our server stores the app-specific Apple user identifier, a random account identifier and registration time. We do not request your Apple name or email. Sessions are stored as hashes and expire after 30 days. Account-linked daily AI usage is retained for 90 days; random request identifiers and processing status are retained for 30 days to enforce quotas and avoid duplicates. Authentication rate limiting uses hourly changing IP hash buckets that expire after about one hour. Daily cleanup may occur up to 24 hours after these periods. Infrastructure providers also process network and security metadata.
Location, weather, calendar availability and reminder reads require their separate in-app confirmation and system permissions where applicable. Precise coordinates are transiently held on the phone and may be processed by Apple geocoding and, after a separate confirmation, Apple Weather. Online AI receives only city-level location and weather summaries, not GPS coordinates. Calendar reads send at most 40 busy intervals, without event titles, participants, locations or notes. Reminder reads send at most 20 unfinished reminder titles and due dates within the confirmed range. Creation of calendar events and reminders requires separate confirmation. You can revoke system permissions in iOS Settings.
Cloud memory backup is not available. If enabled in a later verified release, memories and source excerpts will be encrypted on the phone using your recovery code before up to 20 MB of ciphertext is stored on Cloudflare R2, with server-verified App purchase eligibility and an Apple-linked account. We do not store the recovery code and cannot read or recover that encrypted content. This policy does not mean backup is currently enabled or purchasable.
In Settings you can disable cloud AI consent, change mailbox read scope and sending rules, remove local mailbox data, revoke Google authorization or open the provider's consent-management page. Removing a mailbox deletes its local connection, cached mail, drafts and related transactions; it does not delete the provider's original emails. Clear Local Data removes local mail, rules and history.
Delete Cloud Account in Settings requires fresh verification of the same Apple identity. The server exchanges the one-time authorization code, revokes Apple authorization, then deletes the server account, sessions, usage records and any associated encrypted backup. If revocation fails, deletion stops and can be retried. Apple refresh tokens are not persistently stored. Deleting the cloud account does not delete your provider mailbox or local mail data. You may also contact treeui.old@gmail.com for deletion assistance.
If you email support, we process your email address and the redacted information you provide to answer and troubleshoot. Request deletion of support correspondence through the same address. Do not send credentials or complete private emails. We do not use advertising tracking or sell personal data. Changes to this policy will be published on this page with an updated effective date.
邮件助手·MailSteward · 生效日期：2026 年 10 月 29 日。运营主体以 App Store 开发者信息为准。隐私联系：treeui.old@gmail.com。
邮箱密码、授权码和 OAuth 令牌保存在本机 Keychain。邮件缓存、草稿、规则、事务和处理记录保存在受 iOS 数据保护的本地文件。连接邮箱时，手机直接与所选邮件服务商通信，适用该服务商的隐私政策。我们的业务服务器不接收邮箱凭证，也不归档整邮箱。
在受支持的 iPhone 17 系列及更新 iPhone 上，你可以主动确认下载约 429 MB 的 Qwen 模型。下载服务会处理连接所需的网络信息；下载文件经大小与 SHA-256 校验后保存在手机，可在 App 中删除。选择本机模式后，来信分析、草稿改写和文字建议在手机上推理，不把这些推理输入和输出交给我们的服务器。邮箱同步、模型下载和你主动使用的 Apple 系统服务仍可能联网。本机小模型效果可能弱于云端；目前不负责工具规划或系统写入。
你主动分析、改写，或开启前台自动分析时，当前邮件的发件人、主题、必要正文和你的指令；使用工具助理时，依据你在设置中保存的邮箱范围与读取授权，还包括工具读取的必要邮件、往来联系人和已确认操作的结果。这些内容会经 Cloudflare Workers 传给 Cloudflare Workers AI，以生成建议。这些内容可能包含你或他人的个人信息，请仅提交你有权处理的内容。你可在“设置 → 在线 AI 数据路径”随时关闭云端授权，也可在“设置 → 助理与规则 → 邮件范围与授权”关闭本机读取授权或更改邮箱范围。关闭后不再发起新的分析；已提交的请求可能仍由服务商完成。
业务数据库与应用日志不保存邮件正文或模型回复。根据 Cloudflare Workers AI 数据政策，常规无状态推理内容仅在提供服务所需期间处理、不用于训练，但可能存在安全、法律例外及运营元数据留存。请求经 Cloudflare 全球网络处理，不承诺数据仅保存在某一个国家或地区。
MailSteward 对 Google API 所提供信息的使用和向其他应用的传输将遵守 Google API Services User Data Policy，包括 Limited Use 要求。Google 邮件数据只用于用户可见的邮箱功能及用户明确选择的个性化助理功能，不用于训练通用 AI 或机器学习模型，也不用于广告。
MailSteward’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only for visible mail features and the personalized assistance explicitly chosen by the user. It is not used for advertising or to train general-purpose AI/ML models.
使用 Apple 登录后，服务器保存 Apple 提供的应用专属用户标识、随机账号标识和注册时间；不请求姓名或邮箱。会话以哈希保存，30 天失效。我们保存按账号关联的每日 AI 次数（90 天）、请求随机标识及状态（30 天），用于额度与防重复处理。认证限流使用每小时变化的 IP 哈希桶，约 1 小时后失效。每天定时清理已过期记录，因此清理可能比期限晚最多约 24 小时。基础设施提供商也可能处理网络地址及安全、性能和计费元数据。
云记忆目前尚未开放。开放后需要 Apple 登录和经服务器核验的一次性购买 App 资格，最多保存 20 MB 密文。手机使用恢复码加密助理记忆及其中的邮件来源摘要，再上传至 Cloudflare R2；服务器不保存恢复码，无法读取内容或替你找回恢复码。你可以删除云端副本，删除云端账号也会删除该副本。本机记忆不受云端删除影响。
你在工具确认页同意后，App 才会申请使用期间位置权限并读取一次当前位置；精确坐标仅在本机短暂保留，可交给 Apple 的地理编码服务反查城市，并在你另行确认后交给 Apple Weather 查询天气。在线 AI 只收到城市级位置及天气摘要，不收到坐标。你确认指定时段后，App 可申请日历完整读取权限，但仅将最多 40 个忙碌区间传给在线 AI，不传标题、地点、与会者和备注；待办查询仅传最多 20 条指定到期范围内未完成事项的标题和时间。系统权限可以在 iOS 设置中撤回。创建日程和提醒、普通邮件发送仍需你另行确认；已配对 Channel 可按设置中的预授权在前台自动回复。Agent 仅在 App 活跃时运行。仅在你允许后，本机可读取通讯录以匹配发件人头像，不向在线 AI 上传通讯录。我们不做广告追踪、不出售个人数据。
如果你通过支持邮箱主动联系我们，我们会处理你的邮箱地址和你提供的反馈，以回复问题并排查故障。请仅提供去除隐私的信息；可通过同一邮箱请求删除支持往来。
在“设置 → 登录与用量 → 删除云端账号与用量记录”可删除服务器账号、加密云记忆副本及关联会话和记录。删除时需要重新验证同一 Apple 账号，服务端将交换一次性授权码并撤销 Apple 授权；不持久保存 Apple 刷新令牌。撤销失败时保留账号并允许重试。此操作不会删除邮件服务商原邮件，也不会清除本机邮箱。移除邮箱会删除该邮箱的本机连接、缓存、草稿和相关事务；“清除本机数据”可删除全部本机邮件、规则和记录。也可通过 treeui.old@gmail.com 请求协助，请勿发送密码、授权码或完整私密邮件。