bf176c13df
The README contradicted itself. Line 11's platform badge advertised `Linux | macOS | Android | iOS` while line 87 of the same file said `### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped. Three claims named iOS Keychain and macOS Keychain as active key stores: - README "Key storage" said "On every platform ... (iOS Keychain, macOS Keychain, Android Keystore)" -- for a product whose platform list ends at Android. - privacy-policy.md named `Android Keystore / iOS Keychain` for both credential storage and PGP private keys, which has it doubly wrong: it names a platform that does not ship and omits the two that do. Verified against the implementation rather than reworded from memory. mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service` feature (mailcore/Cargo.toml:58); the Flutter side uses `flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores are Windows Credential Manager, Android Keystore, and the Secret Service (libsecret) on Linux -- now what the docs say. privacy-policy "last updated" moved to 30 September 2026.
2.8 KiB
Korax Privacy Policy
Last updated: 30 September 2026
Who we are
Korax is a PGP-first email client developed and distributed by K-Ops Oy. Questions about this policy can be sent to: korax@k-ops.eu
What data Korax processes
Korax connects directly to your email provider using the IMAP and SMTP protocols. The following data is processed on your device:
| Data | Purpose | Where it is stored |
|---|---|---|
| IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database |
| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) |
| Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache |
| Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database |
| PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database |
What we do not collect
- Korax does not operate any servers that receive your data.
- Your email content, credentials, and keys never leave your device through Korax. All network communication goes directly between your device and your configured mail server.
- Korax does not collect analytics, crash reports, usage statistics, or any telemetry.
- Korax does not display advertising.
- Korax does not sell, share, or transmit your data to any third party.
Permissions
Korax requests only the INTERNET permission, used solely to connect to your configured IMAP/SMTP servers.
Data retention and deletion
All data is stored locally on your device. To delete your data, remove your accounts within the app (Settings → Accounts) or uninstall Korax. Uninstalling the app removes all locally cached messages and settings.
Security
- Credentials are stored in the OS secure credential store and are not accessible to other apps.
- All connections to mail servers use TLS encryption.
- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext.
Children
Korax is not directed at children under 13 and does not knowingly collect data from children.
GDPR (EU residents)
Korax processes data solely on your own device under your control. Because no data is transmitted to or stored by K-Ops Oy, we do not act as a data controller or data processor under the GDPR for your email content. You have full control over your data at all times.
Changes to this policy
If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
Contact
Privacy questions: korax@k-ops.eu