The shortest privacy policy we could honestly write.

Unlike Mail is operated by Adamanture Private Limited (“we”, “us”), the data controller for the personal data described here. Privacy questions, requests, and grievances: support@adamanture.com.

• Account identity — the email address you sign in with, the account identifier your provider (Google, Microsoft, or Zoho) gives us during OAuth, and the display name and avatar it shows us, so we can label your accounts. Used to run your account; nothing else.
• Billing records — once you pay: your plan, the amounts and currency, dates, your billing country, the payment method you used (for example card or UPI), and Razorpay’s identifiers for the payment, subscription and refund. Card, UPI and bank details go to Razorpay and never reach our servers (§ 07).
• Operational logs — timestamps, status codes, and error traces, content-free, kept briefly to keep the service healthy and debuggable.
• Security activity history — sign-ins, account changes, and sync events from your devices (which platform, when), shown to you in the app so you can see what touched your account. Content-free; it goes when your account does.
• Push notification token (mobile only) — turn notifications on in the Android app and the device registers a token with Google’s Firebase Cloud Messaging, which we store against your mailbox so we can wake the app. The notifications themselves are contentless: we send an empty poke, and your device fetches and decrypts the message locally. No part of your mail passes through the notification system. Remove the account or turn notifications off and the token goes with it.
• Crash reports (Android only) — if the app crashes, the device sends a report to Google’s Firebase Crashlytics so we can fix it: the stack trace, device model, OS and app version, free memory and disk, and when it happened. Before a report leaves the device we strip email addresses and credentials from its text, and it never includes your messages, contacts or keys. Google holds reports for 90 days; they are not linked to your account.

Our database also holds material that is opaque to us by construction: your wrapped keys, sealed provider tokens, and sealed message data. The keys that open them exist only on your devices. The full inventory — stored, never-stored, and transient — is published on the Compliance & Trust page, and the mechanism on the blueprint. A breach of our database is a breach of noise.

• Message plaintext of sealed mail — of any mail; the server processes your mailbox in RAM to render your inbox and keeps no content
• Your passphrase, keys, or anything derived from them
• Advertising profiles, tracking pixels, anything resold to anyone — and no usage analytics inside the app: the one diagnostic signal we take is the content-free crash report in § 03. (Visit counting on this marketing site is covered in § 08.)
• Your contacts for any purpose beyond showing them to you
• Your IMAP password — an IMAP login is a permanent, full-mailbox credential, so we accept it only in the Windows and Android apps, encrypted on your device. It never reaches our servers, which is exactly why IMAP isn’t offered on the web.

We make nothing from reading your mail. It’s promise #4 on the mission page, and the architecture enforces it better than any policy could.

Your mail lives at your provider — Google, Microsoft, or Zoho — exactly as before; Unlike Mail is a client, not a new mailbox. On the web, while you’re signed in, our server fetches and processes your mail in RAM to serve your session, then forgets it. Our native apps — Windows and Android — talk to your provider directly, so your mail needn’t transit our servers at all. Sealed messages are encrypted on your device before any server — ours or your provider’s — sees them. Mail exchanged with people not on Unlike Mail is ordinary email, governed by your provider’s privacy policy, not ours.

Google user data. Unlike Mail’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We ask for the narrowest Gmail scopes the client can work with — read, modify, and send on your behalf — and use that access for nothing but running the mailbox you signed in to. Not for advertising, not for resale, and not read by a human except with your explicit consent, to resolve a support issue you raised, or where the law requires it.

Razorpay is our payment processor. When you pay, Razorpay’s checkout collects your card, UPI or netbanking details and your contact details, and processes them under its own privacy policy. We don’t collect or store them; we receive the outcome of the payment and the billing records listed in § 03.

Billing emails. Receipts, payment alerts, notices before an automatic charge and reminders that your access is ending are sent through Amazon SES to the address of your connected mailbox. They come from billing@adamanture.com (Adamanture Private Limited), and replies go to support@adamanture.com. Reminders that your access is ending can be turned off; receipts, payment alerts and notices before a charge are always sent.

Payment records outlive the account. If you delete your account, we keep payment records — amounts, currency, dates, billing country and payment identifiers — for 8 years, because the Companies Act, 2013 (section 128) requires us to keep our books of account. After deletion those records are no longer linked to you. Razorpay keeps its own records under its own policy.

The app sets a single HttpOnly session cookie so you stay signed in. No advertising cookies, no cross-site trackers, no fingerprinting, no analytics.

This marketing site (unlikemail.com) uses Google Analytics 4 to count visits and see which pages are read. It runs only on unlikemail.com, after the page has loaded, and sets first-party cookies (_ga and _ga_*) holding a random identifier. Google receives the pages you view, where you came from, your browser and device type, and an approximate location derived from your IP address, and processes them under Google’s privacy policy. We don’t use it for advertising, and it is never linked to an Unlike Mail account. To opt out, block those cookies or use Google’s opt-out add-on. Cloudflare serves the site and sees the ordinary request data any web host sees.

Delete your account and we delete your rows — identity, wraps, ciphertext — within 30 days, backups included on their rotation. Revoking our OAuth access at your provider cuts our mailbox access instantly, independent of us. Operational logs expire on a short fixed schedule. And because everything sensitive was ciphertext, deletion is belt-and-suspenders: the data was useless the whole time.

One exception: payment records. They are kept for 8 years for accounting, no longer linked to you (§ 07). Deleting your account also cancels auto-renew; time you have already paid for isn’t refunded (see Refunds & Cancellation).

Wherever you are, we honor: access (a copy of what we hold about you — it’s short), correction, erasure (except the payment records we must keep, § 07), portability (your mail is already portable — it’s your mailbox), and objection. EU users: our lawful basis is contract performance (running the service you asked for). India: requests under the DPDP Act 2023 go to our grievance contact. All of it: support@adamanture.com, answered by a human, usually within days not months.

• Age: Unlike Mail is for adults. Creating an account requires confirming you are 18 or older, and we record that confirmation. We don’t knowingly hold data from anyone under 18 — tell us at support@adamanture.com and we’ll delete the account.
• Changes: if this policy changes materially, we’ll email you before it takes effect and keep the old version available. No silent edits.
• Contact: support@adamanture.com — a human reads it.