Privacy Policy

1. Who we are

Reclaimed is operated by “Sėkmės istorija”, MB (also written Sekmes Istorija MB), a Lithuanian company, registration number 304195344. Registered address: Naujadvario g. 26, LT-46404 Kaunas, Lithuania.

For enquiries, privacy questions or to exercise your rights, email hello@reclaimed.email or write to the address above, marked “Reclaimed privacy”. The planned dedicated address privacy@reclaimed.email is not yet activated; use hello@reclaimed.email or the postal route instead. Please do not send mailbox passwords, authentication tokens or private email contents.

We are the controller for personal data we receive to run our website, handle support and administer a Reclaimed account. We do not receive your local mailbox merely because you install the app. Your email provider independently processes your account and mail under its own terms. If you use Reclaimed for an organisation, that organisation remains responsible for its handling of correspondence and other people's data; any processor service we supply requires an appropriate agreement.

2. At a glance

• Native Free mail works locally without a Reclaimed account. Account-backed extra capacity needs sign-in. A configured browser app requires an account and processes connected mail on Reclaimed servers.
• No advertising trackers, automatic analytics or automatic diagnostics uploads are included in the reviewed app or marketing site.
• We do not sell personal data, share it for cross-context behavioural advertising, or use Google email data to train general-purpose AI models.
• Native mail, drafts and settings are not app-encrypted. Native credentials use operating-system protection; hosted data is not end-to-end encrypted.
• Remote email images are blocked until allowed. Subscription checks are separate from optional settings recovery; turning recovery off does not stop signed-in entitlement checks.

3. Notice at collection

Signatures. If you choose Add to your Reclaimed inbox in our separate signature builder, the builder places a signature package on your clipboard and opens Reclaimed. The app reads it only after that handoff, asks which account to use, and stores its text, HTML layout and defaults with your local account settings. These settings are not app-encrypted. Signature contents are not uploaded by the handoff. Optional settings recovery, if configured, includes signatures. Other apps and OS clipboard history or clipboard sync may have access to the clipboard. Signature image URLs remain external: the composer blocks remote images, but recipients may load them from their original host.

Downloads. Windows installer downloads use GitHub Releases. When you follow a download link, GitHub receives your IP address and standard request metadata under its own privacy policy. The main website does not set a download-tracking cookie.

This table distinguishes this website/support from the separately hosted account and browser services. It is separate from mail processed locally by the Windows app. We do not receive your mailbox just because you visit this site or install the app.

We do not sell personal information, share it for cross-context behavioural advertising or use it for targeted advertising. We offer no financial incentive for personal information. We do not collect precise location, biometrics or government identification as a website feature. Correspondence you choose to send can nevertheless contain sensitive information. Credentials and local mail stay subject to the device and mail-provider disclosures below.

4. Connecting and using your email

You choose which accounts to connect. Reclaimed accesses identity, folders, message identifiers, headers, participants, subjects, dates, flags, text/HTML and attachments as needed for the email features you use. Native suggestions and rule matching run on your device; browser matching and indexing run on the service. Neither sends mail to an external AI API. You can change or remove rules.

Google: sign-in takes place on Google's pages; Reclaimed does not receive your Google password. The native client requests https://mail.google.com/ for Gmail IMAP/SMTP, including reading, sending and changing mail, and reads mailbox identity through the Gmail API. The browser implementation requests openid, email, profile and https://www.googleapis.com/auth/gmail.modify. Native access/refresh tokens stay in device secret storage; browser tokens go to the service. Requested permissions do not mean all permitted features have shipped.

Microsoft: native authorisation requests User.Read, Mail.ReadWrite and Mail.Send; browser authorisation also requests offline_access. Organisations may require administrator consent. IMAP/SMTP connections use the credentials and server settings you supply over TLS or STARTTLS.

Reading and syncing contact your provider. Sending transfers recipients (including Cc/Bcc), contents and attachments to your sending provider. Read/flag changes, moves, archives, deletions and unsubscribe commands can change provider mail, contact a sender's site or prepare an outgoing message. Disabling sending does not disable all mailbox changes. Sorting tabs do not necessarily move provider folders.

The browser service is not local-only

A connected browser inbox sends provider tokens or IMAP/SMTP credentials to the service. It stores protected credentials, headers, participants, subjects, text/HTML, full-text indexes, rule definitions and saved onboarding drafts, image preferences, derived placement and action/recovery records. Attachments or remote image data may pass through the server when requested. Hosted data is not end-to-end encrypted; an operator with the necessary keys can access it. This is different from native local mail and the limited optional recovery payload below. See hosting and processing countries; final retention, supplier/transfer review and provider approval remain customer-release gates.

Google Limited Use: Reclaimed adheres to the Google API Services User Data Policy and Google Workspace user data and developer policy, including Limited Use. Google data is used for the described user-facing email/account functionality, not advertising, credit assessment, data brokerage or general-purpose AI training. Human access is limited to the specific support, security and legal exceptions permitted by the applicable provider policy, not routine reading of your mail.

5. What stays in the native app

Native storage includes account configuration, rules and matching values, cached headers and bodies, full-text indexes, read/starred/Done/Snooze state, image permissions, pending operations, contacts, recent successful-send recipients (including Cc/Bcc), signatures, drafts, Outbox and draft attachment copies. Reclaimed does not automatically read your device address book.

Native credentials and tokens use operating-system-protected storage; Windows also uses a current-user DPAPI-encrypted store. Other native app files are not app-encrypted. Device permissions and disk encryption protect them only if enabled. People with access to an unlocked account, backups or exports may read them.

Images and external content: email content is sanitised and scripts/forms are blocked. Native remote image loads can reveal your IP, request metadata and viewing to the host; some URLs use HTTP. A browser-service image proxy normally presents the service's IP, but unique tracking URLs can still identify the message. Opening links, unsubscribe destinations or files invokes other services/apps under their own practices. Allowing images is not a guarantee that all tracking is removed.

Notifications: incoming OS notices show the matching rule, sender and subject by default, including on a lock screen or in OS history. Enable notification Privacy mode for generic notices, or disable notices. In-app cards can also show operation details.

Optional on-device AI

The experimental native setup assistant downloads a model/runtime from Hugging Face and GitHub only if you choose it. Download hosts receive ordinary connection metadata, such as your IP, not mail or your organisation note from this feature. Inference uses a bounded sample of cached sender addresses, subjects and indexed plain-text bodies plus your optional preferences, without an external AI API, attachment/image fetching or training on your mail. Suggestions are drafts until selected and saved.

Temporary analysis inputs are unencrypted local files. Cleanup runs after analysis/cancellation and retries on later launch/use after interruption, subject to filesystem access. The model remains until Remove download. Accepted rule names and matching phrases become normal settings and can be uploaded if you separately enable recovery. Ordinary support logs exclude AI prompts/responses. The current local model runtime is Windows x64 only; mobile/macOS support is not implied.

6. Accounts, sandbox plans and optional recovery

Shared account origin: https://app.reclaimed.email/ serves the browser and updated native account clients. Older installed builds need updating to use it. Native Free mail does not require an account; account-backed extra capacity and browser mail do. Registration and reset-code requests are temporarily unavailable while verification email is being configured; existing sign-in is separate. This does not change direct native mail.

Registration uses your email, verification/reset challenges and a separate Reclaimed password stored as a salted hash. Device names, identifiers and revocable session records secure access. Creating an account does not connect mail, opt into settings recovery or subscribe you to marketing.

Sandbox capacity is separate from recovery

The service stores plan selection, monthly/yearly quote, period/cancellation state, counts, device resource claims, opaque rule IDs, mailbox identity hashes and confirmation/request fingerprints. Hashes are account-linked and can be matched to a known address; they are not anonymous. These checks can continue while signed in even when recovery is off. Protected native entitlement caches permit non-Free sandbox access for at most 24 hours, or an earlier cancellation end; authorization expiry does not promise physical deletion of their stored records. Sandbox plan information explains confirmations and cancellation. There is no payment processor, card collection or future-charge authorization.

Optional settings recovery

Only when separately enabled, recovery uploads mailbox definitions (addresses, labels, server names and usernames), rules and matching values, preferences, saved contacts, signatures and Done/Snooze state. Message-state recovery includes original identifiers, sender addresses, dates and subject hashes. Matching values and signatures can contain sensitive information.

The structured recovery payload excludes mailbox passwords/tokens, full message bodies/previews, attachments, recent recipients, drafts and Outbox ownership. This exclusion is not a claim about hosted browser mail. Cloud settings are not end-to-end encrypted and can be accessed by the service operator. Do not place secrets into synced values.

You can disable recovery, revoke devices, export portable settings or delete the account. Disabling recovery does not disable signed-in capacity checks; signing out does not erase stored data or disconnect hosted browser inboxes. The settings export is not a full mailbox, all browser rules or complete subscription-data export. Contact us for other operator-held records. Account deletion does not erase provider mail or native local files. These source capabilities are not a claim of live service availability.

7. Website, diagnostics and support

This preview serves its fonts, icons and screenshots from the same website. It has no advertising, analytics, tracking pixels, browser-storage identifiers, signup forms or payment collection. Our website code sets no cookies. Theme, calculator and example-inbox choices last only in the current page; we do not save them to cookies, localStorage or sessionStorage. The cookie notice and privacy choices explain this in more detail. Screenshots contain fictional test mail, not customer correspondence.

Railway hosts the website, with Cloudflare providing DNS, HTTPS edge delivery and network security. Both necessarily process connection data such as IP address, requested path and browser request headers. Our Node server does not write per-request access logs; its process log records startup/errors. This does not mean the infrastructure has no logs: Railway and Cloudflare may retain operational and security records under their policies. See Railway privacy and Cloudflare privacy. Cloudflare's network is global; this is not a promise that all connection metadata stays in the EU. There is no account database, payment processor, mailing-list service or analytics service on this website.

App diagnostics are local, bounded event timestamps and error categories, not message bodies, addresses, server responses or tokens. The two log sets each hold up to 512 KB. Sharing diagnostics prepares a sanitised report and opens your device's share controls; nothing is automatically sent to us. Up to three temporary reports are kept, with older reports removed on a subsequent export.

If you email support, we receive your address and anything you choose to include through Spacemail by Spaceship, our mailbox provider. See Spaceship privacy. Please minimise personal information and redact screenshots. Support correspondence is kept while the request is active and then only as necessary for follow-up, security, legal duties or a specific dispute; we review continued need and respond to deletion requests. Provider backup retention is not a promise of immediate erasure. We do not add support senders to a marketing list. There is no checkout on this website; any future billing or marketing collection needs its own timely notice.

8. Purposes and legal grounds

Where EU/EEA or UK data-protection law applies to our processing, we use the following grounds. A provider's OAuth permission authorises technical access; it is not blanket consent to unrelated uses.

Provide requested software/account services

Contract necessity, or steps you request before a contract, for account administration and requested support. Local software processes the mail you choose for the features you use.

Keep the service secure and respond to enquiries

Legitimate interests in preventing abuse, troubleshooting, protecting accounts and resolving requests, balanced against your privacy. This is not a ground for advertising or unrelated mail analysis.

Optional uses that require consent

We request a specific choice where required. You can withdraw it for future processing without making earlier lawful processing unlawful. No optional advertising/analytics consent is sought in this preview because those technologies are absent.

Meet a binding legal obligation

Only the records and disclosures required by applicable law or valid legal process.

Providing a mailbox connection is necessary for its email features; providing data to optional recovery is not necessary for local-only use. We do not use automated rule placement to make legal or similarly significant decisions about you. Correspondence may contain sensitive categories of information: local processing does not give us permission to reuse it. Business users must establish their own lawful grounds; any future hosted processing needs a suitable assessment and agreement.

9. Recipients and processing countries

Data goes to your selected mail providers/recipients for requested features; image hosts, websites and external apps when chosen; and us and our mailbox supplier for support. Optional model-download hosts receive connection metadata. The separate account/browser service processes the account, subscription, recovery and hosted-mail data described above. Authorised personnel and suppliers may access only what their role and applicable provider restrictions permit. Legally required disclosures or corporate transactions need applicable safeguards and notice.

Your device and chosen mail providers may be in different countries; we do not promise EU-only processing. The operator is in Lithuania. Railway hosts the backend origin and its private persistent data volume in Amsterdam, Netherlands; Cloudflare supplies public DNS/HTTPS edge delivery and security. Edge, operational/support and provider metadata may be processed elsewhere. Final supplier/subprocessor agreements and transfer assessment remain customer-release requirements, not completed merely by hosting. Restricted transfers require applicable adequacy or lawful safeguards and necessary supplementary measures. You can request details; this notice does not claim agreements or assessments that are not in place.

10. Retention, removal and revocation

• Native mail/settings: remain for selected cache/offline features or until removed; drafts and copies can outlast provider deletion. Accounts can disconnect and remove that account's cache/drafts or keep local copies. Global contacts/rules, saved files and device backups are separate.
• Native credentials: account cleanup removes stored account credentials. Revoke Google/Microsoft access or app passwords at the provider too; local disconnection does not guarantee provider revocation.
• Attachment opening copies: native temporary external-opening files are unencrypted, capped at 64 MB, with copies older than one day cleaned on a later opening. No cleanup runs while closed. Files saved elsewhere remain until you delete them.
• Exports: native temporary diagnostic/portable exports keep up to three per type, removing older copies on a later export. Browser settings export downloads portable recovery records, not a full mailbox, all browser rules or complete subscription-data archive. Saved/shared copies are outside Reclaimed's control; contact us for other operator-held data.
• Remember me: off by default. Unchecked native sign-in keeps its session in memory only; unchecked browser sign-in uses a session cookie. Both have an eight-hour absolute server limit. Checked sign-in saves a protected native session or persistent browser cookie for up to 30 days, without sliding renewal. Browser restore settings can preserve session cookies; use Sign out on shared devices. This choice does not save your Reclaimed password or change local mailbox credentials.
• Service authentication: codes expire after 20 minutes and sessions after at most 30 days. Expired records are cleaned at startup and hourly while running; queued delivery stops after five failures. Unverified registrations become eligible for cleanup after seven days, allowing a still-valid challenge to finish.
• Sandbox records: current plan/capacity state remains until changed or account deletion. Confirmation history keeps at most the latest 1,000 plan changes. Native setup reservations expire after ten minutes; preparation history is capped at 1,000 and records whose expiry is more than one day old are pruned on a later preparation, not a daily timer. Session deletion releases that device's native claims and cancels its pending reservation; other device/browser claims are separate.
• Hosted mail/rules: display caches can be evicted for capacity; no fixed automatic lifetime is implemented for all metadata, full-text indexes, onboarding drafts or action records. Sign-out is not disconnection or deletion and can leave mail workers running. Browser disconnection removes that inbox's active hosted connection, credential and cache records; provider copies remain.
• Account deletion: removes active hosted mail, credentials, rules, indexes, recovery/subscription records and sessions. A running remote action may temporarily block deletion until safely settled. It does not delete native local files or provider mail. Database pages, journals and infrastructure copies may retain residual data; active-table deletion is not immediate physical erasure. The initial backend has no operator-managed automated backup service enabled. Final retention, backup/restore and restore-safe deletion procedures remain open customer-release requirements.

Uninstalling does not guarantee removal of local files, OS notification history, backups or exports. Offline native entitlement expiry is not a record-erasure schedule or a guarantee of immediate remote revocation. Contact us for data we hold and use your provider's controls for its copies.

11. Your rights and requests

Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction and a portable copy of personal data; object to processing based on legitimate interests; and withdraw consent where used. These rights have legal exceptions. We do not discriminate against you for exercising applicable privacy rights.

Email hello@reclaimed.email with your request and enough context to locate the records. You can also write to our registered address, marked “Reclaimed privacy”. We may proportionately verify identity using information relevant to the request, without asking for your mailbox password or unnecessary identity documents. Authorised agents can contact us with proof of authority. Requests are normally free; any lawful exception, fee or refusal will be explained before we proceed. You do not need a Reclaimed account to make a request. We cannot remotely access or erase local-only mail we do not hold.

For EU/EEA and UK requests, we normally respond within one month; if a lawful extension is needed, we explain it within that month. The regional section below gives additional deadlines and complaint routes. A shorter applicable deadline takes priority. If we decline a request, we explain the reason and how to challenge it. To appeal, contact the same address with “Privacy appeal” and the original request reference; no account or fee is required. We assess appeals under the applicable local deadline and explain any further regulator complaint route. You can complain to your local authority, including Lithuania's State Data Protection Inspectorate (VDAI), without contacting us first. UK users can contact the ICO.

See regional rights for US state privacy, browser signals and other regional rules. If you need an accessible copy of this notice or assistance making a request, contact us using the same routes.

12. Regional rights

These supplements apply where the relevant law covers our processing. They do not limit mandatory rights or imply that a planned service is available in a country. The common request routes are in Your rights and requests.

13. Security and practical choices

We use protected credential storage, encrypted provider/cloud connections, sanitised email rendering and bounded diagnostics. No system is risk-free. Local mail files and cloud settings are not end-to-end encrypted. Keep devices updated, lock shared computers, enable disk encryption and protect exports/backups. Use only mailboxes and third-party data you are entitled to access.

You control connected accounts, rule values, notification Privacy mode, remote images, offline retention, diagnostic sharing and optional recovery. Removing a rule changes organisation, not the sender's records. Changing local settings does not necessarily delete previously shared copies. Contact us promptly if you suspect a privacy or security incident.

14. Children and policy changes

Reclaimed is a general-purpose productivity tool, not a service directed to children. No child-specific account or parental-consent flow is offered. If you believe a child provided personal data directly to us without required authorisation, contact us so we can investigate and address it. We do not knowingly use children's information for advertising.

We update this policy when features or data practices change and show the revision date above. Material changes will receive a prominent notice before they take effect where required; new optional purposes will not be silently enabled. This notice covers the current Windows app and marketing website, and distinguishes implemented account/browser data flows from deployed services. It is not a claim that those services or unshipped mobile products are available.