bf176c13df
The README contradicted itself. Line 11's platform badge advertised `Linux | macOS | Android | iOS` while line 87 of the same file said `### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped. Three claims named iOS Keychain and macOS Keychain as active key stores: - README "Key storage" said "On every platform ... (iOS Keychain, macOS Keychain, Android Keystore)" -- for a product whose platform list ends at Android. - privacy-policy.md named `Android Keystore / iOS Keychain` for both credential storage and PGP private keys, which has it doubly wrong: it names a platform that does not ship and omits the two that do. Verified against the implementation rather than reworded from memory. mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service` feature (mailcore/Cargo.toml:58); the Flutter side uses `flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores are Windows Credential Manager, Android Keystore, and the Secret Service (libsecret) on Linux -- now what the docs say. privacy-policy "last updated" moved to 30 September 2026.
58 lines
2.8 KiB
Markdown
58 lines
2.8 KiB
Markdown
# Korax Privacy Policy
|
|
|
|
_Last updated: 30 September 2026_
|
|
|
|
## Who we are
|
|
|
|
Korax is a PGP-first email client developed and distributed by **K-Ops Oy**. Questions about this policy can be sent to: **korax@k-ops.eu**
|
|
|
|
## What data Korax processes
|
|
|
|
Korax connects directly to your email provider using the IMAP and SMTP protocols. The following data is processed on your device:
|
|
|
|
| Data | Purpose | Where it is stored |
|
|
|------|---------|-------------------|
|
|
| IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database |
|
|
| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) |
|
|
| Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache |
|
|
| Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database |
|
|
| PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database |
|
|
|
|
## What we do not collect
|
|
|
|
- Korax does **not** operate any servers that receive your data.
|
|
- Your email content, credentials, and keys never leave your device through Korax. All network communication goes directly between your device and your configured mail server.
|
|
- Korax does **not** collect analytics, crash reports, usage statistics, or any telemetry.
|
|
- Korax does **not** display advertising.
|
|
- Korax does **not** sell, share, or transmit your data to any third party.
|
|
|
|
## Permissions
|
|
|
|
Korax requests only the **INTERNET** permission, used solely to connect to your configured IMAP/SMTP servers.
|
|
|
|
## Data retention and deletion
|
|
|
|
All data is stored locally on your device. To delete your data, remove your accounts within the app (Settings → Accounts) or uninstall Korax. Uninstalling the app removes all locally cached messages and settings.
|
|
|
|
## Security
|
|
|
|
- Credentials are stored in the OS secure credential store and are not accessible to other apps.
|
|
- All connections to mail servers use TLS encryption.
|
|
- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext.
|
|
|
|
## Children
|
|
|
|
Korax is not directed at children under 13 and does not knowingly collect data from children.
|
|
|
|
## GDPR (EU residents)
|
|
|
|
Korax processes data solely on your own device under your control. Because no data is transmitted to or stored by K-Ops Oy, we do not act as a data controller or data processor under the GDPR for your email content. You have full control over your data at all times.
|
|
|
|
## Changes to this policy
|
|
|
|
If we update this policy, the new version will be published at this URL with an updated "Last updated" date.
|
|
|
|
## Contact
|
|
|
|
Privacy questions: **korax@k-ops.eu**
|