Effective 24 August 2026 (updated 31 August 2026)
Mailisimo is made by CJ Designs. It is an email client — it connects to the email accounts you already have (Gmail, Outlook/Microsoft 365, iCloud, Yahoo, or any other IMAP/SMTP provider) and lets you read, organise and send your mail. Mailisimo has no server of its own in that path. Your phone or computer talks directly to your mail provider over an encrypted connection, the same way any email app does, and your mail is stored, encrypted, only on your own device.
The short version: your email stays between you and your email provider.
Mailisimo is software that runs on your device. It is not a service that reads your mail, and there is no Mailisimo-operated infrastructure that your messages pass through — not for reading, sending, organising, searching or reminding you about mail.
There is no analytics SDK and no crash-reporting SDK in the app. Nothing about your usage is collected or transmitted, because there is nowhere for it to go.
| Information | Where it is kept |
|---|---|
| Messages, headers and bodies | A local database on your device, encrypted at rest with SQLCipher (AES-256). The encryption key is held only in your device's Keychain (iOS) or Keystore (Android), never sent anywhere. |
| Attachments | The app's own private storage on your device — not a shared folder other apps can read. Nothing downloads automatically; a file is fetched only when you ask for it. |
| Sign-in credentials and OAuth tokens | Your device's Keychain/Keystore only. Never included in a backup, never logged, never sent to any server we operate. |
| People and contacts derived from your mail | The same local, encrypted database |
| Snoozes, follow-ups, categories and reminders you set | The same local, encrypted database — this never syncs to a server, which also means it does not follow you to a second device yet |
On iOS, the database is excluded from iCloud and device backups and protected until you first unlock your phone after a restart. Uninstalling the app removes the database and the Keychain/Keystore entries with it — there is no copy anywhere else.
How your credentials are handled depends on the provider:
Mailisimo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To connect a Gmail account, Mailisimo requests full mailbox access rather than a narrower Gmail scope. This is deliberate, not incidental: Google's more limited gmail.modify scope can move a message to Trash but cannot permanently delete it, and Mailisimo needed permanent deletion — emptying the Bin — to behave the way people expect an email client to behave.
That access is used only to read, organise, send and delete mail within the app, at your direction. It is never used to build advertising profiles, never used to train models, and never sold, rented or shared with any third party. As described throughout this policy, your Gmail data reaches only your own device: Mailisimo has no server of its own that this data passes through, is stored on, or could be accessed from — including by CJ Designs.
Gmail, Outlook, iCloud and Yahoo are recognised automatically. If you add an account on a provider Mailisimo doesn't already know, it may look up that provider's mail-server settings by sending only the domain part of your email address (for example, example.com — never your full address or password) to Mozilla's ISPDB and to your provider's own autoconfiguration address, and by making a standard DNS lookup for that domain's mail-server records. This happens once, at setup, only for domains Mailisimo doesn't already recognise.
There are two separate sources of contact information in Mailisimo, and neither is ever sent anywhere:
Because imported contacts are read from your device but never transmitted off it, this is on-device-only processing under Apple's and Google's app-store privacy rules — it is not "collected" or "shared" data.
Remote images in a message — including invisible "tracking pixel" images that tell a sender when a message was opened — are blocked by default. You'll see a notice when images were blocked, with a one-tap option to load them for that message, or always for that sender.
We're honest that this isn't the same as being untrackable: a link you tap still reports back to whoever sent it, and loading images for one message does tell that sender you opened it. We don't proxy remote images through a server of ours to hide your IP address from senders — doing so would mean routing your mail content through infrastructure we run, which we've deliberately chosen not to build, in favour of keeping no server in the path at all.
Mailisimo is fully usable with every AI feature switched off — that's the default. If a cloud AI feature (like summarising a thread or suggesting a reply) is ever enabled, only the specific text of the conversation you act on is sent, to a named provider, after a clear on-screen disclosure — never your whole mailbox, never credentials, never other accounts' mail. As shipped today, no production AI backend is configured, so enabling an AI feature reports that it isn't available in this build rather than sending anything.
Removing an account from Mailisimo deletes every message, attachment, contact and reminder stored for it on your device, along with its saved credential, and attempts (best effort) to revoke the sign-in token with your provider. Uninstalling the app removes everything, including the Keychain/Keystore entries, because there is no server-side account of ours to delete and nothing held anywhere else.
Mailisimo is not directed at children and we do not knowingly collect data from them.
If this policy changes, the updated version will be posted at this address with a new effective date.
CJ Designs — support@cjdesigns.app