67 lines
3.5 KiB
Markdown
67 lines
3.5 KiB
Markdown
# Korax Privacy Policy
|
|
|
|
_Last updated: 30 September 2026_
|
|
|
|
## Who we are
|
|
|
|
Korax is a PGP-first email client developed and distributed by **K-Ops Oy**. Questions about this policy can be sent to: **korax@k-ops.eu**
|
|
|
|
## What data Korax processes
|
|
|
|
Korax connects directly to your email provider using the IMAP and SMTP protocols. The following data is processed on your device:
|
|
|
|
| Data | Purpose | Where it is stored |
|
|
|------|---------|-------------------|
|
|
| IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database |
|
|
| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) |
|
|
| Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache |
|
|
| Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database |
|
|
| PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database |
|
|
|
|
## What we do not collect
|
|
|
|
- Korax does **not** operate any servers that receive your data.
|
|
- Your email content, credentials, and keys never leave your device through Korax. Apart from the optional lookups described below, all network communication goes directly between your device and your configured mail server.
|
|
- Korax does **not** collect analytics, crash reports, usage statistics, or any telemetry.
|
|
- Korax does **not** display advertising.
|
|
- Korax does **not** sell or share your data, and has no analytics or advertising partners.
|
|
|
|
## Optional lookups
|
|
|
|
Two features contact a third-party service. Both can be switched off in the app's settings.
|
|
|
|
- **Key server lookup** (Settings → Auto-lookup Keyservers): to find a contact's public PGP key, Korax sends that contact's email address, or a key ID or fingerprint, to the public OpenPGP key server `keys.openpgp.org`.
|
|
- **Remote avatars** (off unless you turn them on): Korax requests a profile picture from Gravatar, which receives a hash of the sender's email address, and a website icon from DuckDuckGo, which receives the sender's domain. These services also see your IP address.
|
|
|
|
Nothing else leaves your device through Korax.
|
|
|
|
## Permissions
|
|
|
|
Korax requests only the **INTERNET** permission, used to connect to your configured IMAP/SMTP servers and, if enabled, the optional lookups above.
|
|
|
|
## Data retention and deletion
|
|
|
|
All data is stored locally on your device. To delete your data, remove your accounts within the app (Settings → Accounts) or uninstall Korax. Uninstalling the app removes all locally cached messages and settings.
|
|
|
|
## Security
|
|
|
|
- Credentials are stored in the OS secure credential store and are not accessible to other apps.
|
|
- All connections to mail servers use TLS encryption.
|
|
- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext.
|
|
|
|
## Children
|
|
|
|
Korax is not directed at children under 13 and does not knowingly collect data from children.
|
|
|
|
## GDPR (EU residents)
|
|
|
|
Korax processes data solely on your own device under your control. Because no data is transmitted to or stored by K-Ops Oy, we do not act as a data controller or data processor under the GDPR for your email content. You have full control over your data at all times.
|
|
|
|
## Changes to this policy
|
|
|
|
If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
|
|
|
|
## Contact
|
|
|
|
Privacy questions: **korax@k-ops.eu**
|