Privacy Policy

Effective date: 7 November 2026

Penvia is an email app for iPhone, iPad and Mac made by Penvia Labs Yazılım ve Teknoloji Ltd. Şti. ("Penvia Labs", "we", "us"). This policy explains what happens to your information when you use Penvia and this website. In short: your email stays on your devices and with your email provider. Penvia has no server that receives your mail, and we do not track you or show ads. The one optional exception that involves your sign-in: if you switch on Instant alerts for a Yahoo, iCloud or other IMAP account, Penvia's mail-watch service keeps that account's sign-in, encrypted, so it can watch for new mail (section 2a).

At a glance

1. Your email and accounts

• Penvia connects directly from your device to your email provider (for example Google, Microsoft, Apple iCloud, Yahoo or your own mail server) to read, send and organise your mail.
• Messages, attachments, contacts and search indexes are stored only on your device, in Penvia's private storage protected by your device's data protection. Your sorting choices stay on your device unless you turn on the optional iCloud sync described in section 3. Saved Files searches are stored locally and can be cleared from the Files menu.
• Mailbox access tokens, refresh tokens and passwords are kept in Apple Keychain on your device and are used to connect directly to your provider. They are never sent to us or to iCloud, with one exception you control: if you switch on Instant alerts for a Yahoo, iCloud or other IMAP account, that account's sign-in is sent to Penvia's mail-watch service so it can watch for new mail (section 2a). The optional Gmail push-registration path sends a separate Google identity token to the relay for validation; it is not a mailbox access token and is not stored as a registration field. No account credentials are synced through Penvia's iCloud preference sync.
• If Spotlight is on (Settings, on by default), the names and addresses of the people you email are added to your device's own Spotlight index so you can find a chat from Search. No email content is indexed, and nothing leaves the device. Turning it off removes them.
• Sorting and Apple Intelligence. Penvia sorts mail into Chats and Updates on your device, from your own choices, whether you have written to the sender, your Contacts (if you allowed access) and standard email headers such as List-Unsubscribe. On devices with Apple Intelligence, for a sender Penvia can't place this way, Apple's on-device model looks at the sender's name and domain, the subject and up to the first 200 characters of the email; the answer is kept on your device for that sender, and the email text is not stored. Smart replies and suggested follow-ups also use Apple Intelligence on your device. None of this is sent to us or to any third-party AI service. You can turn off "Use Apple Intelligence" or "Sort automatically" in Settings › Chats › Sorting.
• Orbit (promises). If "Find promises in my mail" is on (Settings › Penvia Intelligence; Off, Suggest or Auto-add), Apple's on-device model reads the text of emails in your Chats, including emails you sent, to find what you asked for or promised and what others promised you. Penvia keeps the promise (a short title, the person, a due date) and the exact sentence it was found in on your device, until you remove the promise, turn the switch off or remove the account. With Sync with iCloud on, reminders are kept in your private iCloud as described in section 3. Nothing from Orbit is sent to us or to any third-party AI service. Siri's "What do I owe today?" and the Orbit widget answer from a summary stored on your device.
• Orbit (Reply to and Waiting for). Orbit asks before it starts. If you turn on "Track replies automatically", Penvia looks, on your device, at the emails in your Chats from the last 30 days to see who wrote last in each conversation, whether you have read it, and when. To avoid false reminders it also reads the first line of short new replies (to recognise a closing such as "Thanks!") and standard headers that mark an automatic reply. No AI is used for this, nothing is changed in your mailbox, and nothing is sent to us. Turning the switch off removes these automatic items from Orbit, the widget, Siri and the app badge; follow-ups you added yourself stay until you remove them.
• Finding server settings. When you add an account at a domain Penvia doesn't already know, Penvia looks up its mail-server settings: from your domain's own autoconfiguration address (which receives your email address, as your provider already has it), from Thunderbird's public ISP database at autoconfig.thunderbird.net (which receives only the domain name, never your address), and from your domain's public DNS records, which Penvia looks up through Cloudflare's DNS service at cloudflare-dns.com to find the domain's mail servers (it also receives only the domain name). Nothing from these lookups is sent to us, and nothing from them is kept on a Penvia server.
• Signing in with Microsoft or Google. Outlook / Microsoft 365 accounts (and Gmail accounts, where Google sign-in is offered) sign in on Microsoft's or Google's own page in Apple's secure sign-in sheet. Penvia receives the access tokens your provider issues and keeps them in Apple Keychain as described above; we never see your password. Other accounts sign in with the password or app-specific password you enter, which is sent only to your provider.
• Sender logos and remote images (optional). If you turn on sender logos, Penvia asks the sender's own website (for example example.com/apple-touch-icon.png) for its icon; that website sees your device's IP address, as with any web request. Remote images in an email load only when you allow them, and then the sender's servers see the same kind of request. Both are off by default.
• We do not read your email. Penvia's servers never receive it. If you switch on Instant alerts for a Yahoo, iCloud or other IMAP account, section 2a explains exactly what our service stores and what it can technically do with it.

2. Push alerts (optional push service)

For Outlook / Microsoft 365 accounts, and for Gmail accounts connected with Google sign-in (not with an app password), Penvia can use a small push service we run on Cloudflare (our processor) so your provider can tell your device that new mail has arrived. It is off by default; you switch it on with the alerts switch in Settings › Notifications. Yahoo, iCloud, other IMAP accounts and Gmail accounts added with an app password do not register with it directly; a Yahoo, iCloud or IMAP account for which you switch on Instant alerts gets its alerts through it as described in section 2a.

What the service receives. When your device registers, it sends your device's Apple push token and push environment, a random per-install ID and, for Outlook, a random per-account ID. For Gmail it also sends a Google identity token (identity only, no mailbox access) so the service can confirm which Gmail address the registration belongs to; the token is checked and not stored. Afterwards, for Gmail, Google sends the service a notification containing your Gmail address and a mailbox change number (historyId); for Outlook, Microsoft sends a notification with a check value and the new message's opaque ID. Cloudflare, like any web service, also processes your device's IP address to deliver requests; the service uses it only for rate limiting and does not store it.

What the service stores, and for how long. - your device's Apple push token, push environment and a random registration ID, with creation, update and watch-expiry times; - an account key: for Gmail, a keyed one-way hash (HMAC-SHA-256) of your Gmail address; for Outlook, a keyed hash of a random check value (not derived from your address); - one-way hashes of the random per-install ID, of the per-account ID (Outlook), and of the registration's own secret; - for Gmail, the latest mailbox change number (up to 30 days) and short-lived duplicate markers (1 hour); for Outlook, a keyed hash of each new message's opaque ID (up to 7 days), so one email produces one alert; - for a Yahoo, iCloud or IMAP account with Instant alerts on (section 2a), the account key is a keyed hash of the opaque mailbox ID that the mail-watch service issued (no address, server or password reaches the push service), plus a one-way hash of each new message number as a duplicate marker, so one email produces one alert.

A registration is kept while push is in use and is deleted automatically at most 2 days after its Gmail watch or Outlook subscription ends (never longer than 30 days without renewal). Switching that alerts switch off or removing the account asks the service to delete it at once; if Apple reports that the push token is no longer valid (for example after you delete the app), it is also deleted.

The service never receives message content, subjects, senders, mailbox access tokens, refresh tokens or passwords, and it does not store your email address in readable form. Because we hold the key for the hash, a registration can be matched to a Gmail address that is already known to us, so we treat it as linked to you. In the App Store's privacy details this is declared as Identifiers › Device ID and Contact Info › Email Address, used only for app functionality, linked to you and not used for tracking. When an alert arrives, your device fetches the sender and subject directly from your provider to show them.

2a. Instant alerts for Yahoo, iCloud and other IMAP accounts (optional)

Yahoo, iCloud and other IMAP providers don't notify other services about new mail, so instant alerts for these accounts need a server that stays signed in to the mailbox. This is off by default and switched on separately for each account (that account's Alerts settings), with what it involves explained right under that switch. Gmail and Outlook alerts (section 2) work differently: they come from Google's and Microsoft's own push APIs, and no password is ever sent to Penvia for them.

What is stored. When you switch Instant alerts on for an account, your device sends that account's incoming mail server address, port, user name and app password to Penvia's mail-watch service, over an encrypted connection. The service signs in once to check them (if the sign-in is refused, nothing is kept), then stores: - the account's server address, port, user name and app password, encrypted (AES-256-GCM). The user name is usually your email address; - an opaque mailbox ID (a keyed one-way hash of the server, port and user name), which is the only name the push service (section 2) ever sees for this mailbox; - for each device that switched alerts on: a one-way hash of that device's random installation ID, a one-way hash of a random secret that only that device knows, and an expiry date. Your device's Apple push token is held by the push service (section 2), not by the mail-watch service; - the number (UID) of the newest message already announced, with the mailbox's UID validity number and a status (for example "watching" or "sign-in failed"), so that after a restart it can continue from the last message it announced. It is designed to avoid repeated or missed alerts, but delivery also depends on your mail server and on Apple's push service, so an alert can occasionally arrive late, twice or not at all.

Why. Only to keep one connection to that account's Inbox, opened read-only (IMAP IDLE), and to notice when a new message number appears, so your device can be alerted within seconds.

What is never stored or read. The service never reads, downloads or stores your emails: no senders, recipients, subjects or content. It sees message numbers only. When new mail arrives it tells the push service only the opaque mailbox ID and the new message numbers; Apple delivers the alert to your device, and Penvia's notification extension on your device fetches the sender, subject and preview directly from your mail server.

Where. On Cloudflare's network (Cloudflare Workers, Durable Objects and Containers), run for us by Cloudflare as our processor. Cloudflare operates data centres worldwide, including in the EU and the US, so this data may be processed outside your country (see section 10).

Who can access it. The sign-in is encrypted at rest with a key that is kept separately from the stored data (a secret of the service, not in its code). The service decrypts it only to sign in to your mail server for this watch. Penvia staff do not read your mail. To be clear about what is technically possible: we operate this service and control its keys, so the sign-in is not hidden from us in the way an end-to-end encrypted secret would be; we limit access to the service's deployment credentials and do not use the sign-ins for anything else. For this reason we treat this data as linked to you. We recommend an app-specific password (Yahoo and iCloud require one): you can revoke it at any time in your Yahoo or Apple account without changing your main password, and the service can then no longer sign in.

How long, and how to stop it. - Switching Instant alerts off for that account, or removing the account from Penvia, removes your device; when no other device of yours still uses it, the stored sign-in and everything above are deleted at once when the service is reachable, and otherwise on the next retry (and in any case after 32 days without renewal, below). - If your devices stop renewing it (the app renews it while you use Penvia), it is deleted automatically after 32 days without renewal. - If your provider refuses the stored sign-in (for example because you changed or revoked the app password), alerts pause and Penvia asks you to check it.

In the App Store's privacy details this is declared as Contact Info › Email Address (the user name), Identifiers › Device ID and Other Data › Other Data Types (the encrypted sign-in), used only for app functionality, linked to you and not used for tracking.

3. iCloud sync (optional, Penvia Pro)

If you turn on "Sync with iCloud", Penvia stores your pins, follow-up reminders, quiet hours, a few preferences, your Chats and Updates choices (sender addresses you moved, and your rules) the list of scheduled emails and your Orbit settings (the switch, waiting and working days, the addresses of people you chose not to track, and which items you marked done — stored as account, conversation and message identifiers, without subject or text) in your own private iCloud (Apple's iCloud key-value storage). We have no access to it. No passwords or sign-ins are synced, and no email content: a scheduled email is synced without its subject or text, with only the recipient's first name, the kind of device that will send it (iPhone, iPad or Mac) and an internal account number. Pins are stored under an internal number, not under email addresses.

Exporting your data

Settings lets you export your mail, drafts and downloaded attachments to a file. The file is not encrypted. Penvia asks you to confirm first; save it only where you alone can open it.

AI assistant plugin (optional, Mac only)

Penvia for Mac can, only if you turn it on, prepare a snapshot of some of your mail for an AI assistant you choose, for example Claude (by Anthropic), ChatGPT (by OpenAI) or Grok Bot (by xAI). It is off by default for every assistant. Each assistant has its own consent screen, which names the assistant and its provider and lists exactly what is shared, and its own choices; nothing is written for an assistant until you accept its screen.

What a snapshot can contain, for the accounts you choose:

• email subjects and dates, each chat partner's name and email address, attachment file names, types and sizes, the names of your file collections, and the address of each chosen account;
• message text only if you also turn on "Also share message text" for that assistant (plain text, up to 12,000 characters per email);
• never attachments themselves, pictures, HTML, drafts, the outbox, passwords, sign-ins or tokens; Spam, Trash and drafts are left out. Gmail accounts cannot be included (see section 9).

The snapshot is a file in Penvia's own storage on your Mac. Penvia itself sends nothing to any AI provider or to us. The assistant reads the snapshot through the Penvia plugin, which you set up yourself, when you ask it about your mail: Claude Desktop runs the plugin on your Mac; ChatGPT reaches it on your Mac through OpenAI's Secure MCP Tunnel; Grok Bot runs on its own computer, so you copy the snapshot there yourself. What the assistant reads leaves your Mac and is handled by its provider under that provider's terms and privacy policy, not this policy. The provider is not our service provider; you share this data with it through your own account. No AI assistant is ever used to sort your mail or for any other Penvia feature; the plugin is read-only and nothing comes back into Penvia.

You can stop sharing with each assistant separately at any time in Settings › Privacy and data › AI assistants. Penvia then deletes that assistant's consent file and snapshot from your Mac, and the plugin can no longer read them there. A copy you moved to another computer is not reachable from Penvia: delete it there; it stops working when its consent expires, at most 7 days after Penvia wrote it. Answers an assistant has already given stay in that assistant's history until you delete them there. The feature is not available on iPhone or iPad.

4. Purchases

Subscriptions are processed by Apple through the App Store. We receive no payment details. Penvia checks your subscription status with Apple on your device.

5. Contacts, camera and photos

If you allow it, Penvia reads your Contacts on your device to show names and photos; the camera is used only when you scan a document; photos are saved only when you ask. Nothing from these is sent to us.

6. Support and feedback

If you email support@penvia.app or feedback@penvia.app, we receive what you send, including the app version, operating system and device model that Penvia pre-fills (you can delete them). We use it only to answer you and improve Penvia, and delete it when no longer needed.

7. Service providers and other parties

Penvia works without a Penvia account and without a Penvia mail server. These parties are involved only as described in this policy:

• Your email provider (for example Google, Microsoft, Apple iCloud, Yahoo or your own mail server) receives your requests directly from your device and holds your mail under its own terms and privacy policy.
• Apple delivers alerts through the Apple Push Notification service, processes purchases through the App Store (StoreKit), stores your synced choices in your private iCloud if you turn on Sync with iCloud, and provides Apple Intelligence, which runs on your device. Apple's privacy policy: apple.com/legal/privacy.
• Cloudflare runs Penvia's optional push service and optional mail-watch service as our processor (sections 2 and 2a), answers the DNS lookups described in section 1 (domain name only) and hosts this website. Cloudflare's privacy policy: cloudflare.com/privacypolicy.
• Google and Microsoft provide sign-in and the Gmail API and Microsoft Graph for those accounts, and send the change notifications described in section 2 when push is on.
• Mozilla publishes the Thunderbird ISP database at autoconfig.thunderbird.net, which receives only the domain name (section 1).
• AI assistant providers (Anthropic, OpenAI, xAI) receive nothing from Penvia. They receive data only if you turn on the optional AI assistant plugin and your own assistant reads it, as described in section 3.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

8. What we do not do

No advertising, no analytics or tracking SDKs, no selling of data, no profiling, no AI processing of your mail on our servers, and no sharing with any third-party AI service unless you turn on the optional AI assistant plugin yourself (see "AI assistant plugin" above).

9. Google user data

Penvia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide Penvia's email features to you on your device. Gmail accounts cannot be included in the optional AI assistant plugin snapshot. We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models, and we do not transfer it to anyone for that purpose.

10. Legal bases, transfers and retention

Legal bases (EEA, UK, Türkiye and similar laws). We process the little personal data we handle to provide the features you ask for (performance of a contract), such as the optional push service; on the basis of your consent for optional features you switch on, such as push alerts, Instant alerts for Yahoo, iCloud and IMAP accounts, Sync with iCloud, Contacts access and the AI assistant plugin, which you can withdraw at any time in Settings; and on the basis of our legitimate interests in keeping the push service secure (for example rate limiting) and in answering your messages.

International transfers. Cloudflare and Apple operate worldwide, so push registrations, the mail-watch data in section 2a and the DNS lookups described above may be processed outside your country. Where the law requires it, such transfers rely on appropriate safeguards, such as the European Commission's standard contractual clauses and, for Türkiye, the safeguards required by Law No. 6698 on the Protection of Personal Data (KVKK).

Retention. - Mail, attachments, search indexes and settings on your device: until you remove the account or delete the app (see section 13). - Instant alerts sign-ins and mail-watch data (section 2a): until you switch Instant alerts off for that account or remove the account (deleted at once when the service is reachable, otherwise on the next retry), and at most 32 days after your devices last renewed them. - Push registrations: as described in section 2 (deleted at most 2 days after the Gmail watch or Outlook subscription ends, never longer than 30 days without renewal; change numbers up to 30 days, duplicate markers 1 hour, Outlook message hashes up to 7 days). IP addresses are not stored by the push service. - Domain lookups: not kept by Penvia. - Support and feedback emails: only as long as needed to answer you and improve Penvia.

11. Security

Penvia connects to your provider and to the push service only over encrypted connections (TLS). Sign-ins are kept in Apple Keychain, data on your device is protected by your device's data protection, and you can lock Penvia with Face ID. The push service stores only random IDs and one-way hashes, as described in section 2. The optional mail-watch service (section 2a) stores the sign-ins of accounts you switched Instant alerts on for only in encrypted form (AES-256-GCM, key kept separately), decrypts them only to sign in to that mail server, opens their Inbox read-only and never stores email.

12. Children

Penvia is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect personal data from children. If you believe a child has sent us personal data, for example in a support email, contact us and we will delete it.

13. Your rights

You can delete Penvia's data on your device by removing your accounts in Penvia or deleting the app. Apple Keychain items (sign-ins) may remain on the device after the app is deleted until the device is erased or Penvia is reinstalled and the accounts are removed. Push registrations and Instant alerts sign-ins on our services are deleted as described in sections 2 and 2a. Depending on where you live (for example under the GDPR or Turkish KVKK), you have rights to access, correct and delete personal data we hold; since we hold almost none, contact us at support@penvia.app and we will respond within 30 days.

• EEA and UK (GDPR / UK GDPR): you can ask for access, correction, deletion, restriction, portability and object to processing, withdraw consent at any time, and complain to your data protection authority.
• Türkiye (KVKK, Article 11): you can learn whether your personal data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, ask for correction, deletion or destruction and for those parties to be notified, object to a result arising from automated analysis, and claim compensation for damage caused by unlawful processing. You can also complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
• California (CCPA / CPRA) and other U.S. states: you can ask to know, correct and delete personal information we hold. We do not sell or share personal information, do not use sensitive personal information to infer characteristics, and will not treat you differently for using your rights. Because we do not sell or share personal information, there is nothing to opt out of; Global Privacy Control signals are respected by default.

To use any of these rights, email support@penvia.app. We may ask you to confirm that the request comes from the email address concerned.

14. This website

penvia.app is a static website hosted on Cloudflare Pages. It uses no cookies, no analytics and no third-party scripts. Like any web host, Cloudflare processes your IP address and basic request data to deliver and protect the site.

15. Changes

We will post changes on this page and update the effective date. Significant changes will be shown in the app.

16. Contact

The data controller is Penvia Labs Yazılım ve Teknoloji Ltd. Şti. (PENVIA LABS YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ; Penvia Labs Software and Technology Limited Company), Emniyettepe Mah., Necati Molder Cad. No: 59, 34060 Eyüpsultan, İstanbul, Türkiye.

Penvia Labs · support@penvia.app · feedback@penvia.app · https://penvia.app

© 2026 Penvia Labs Yazılım ve Teknoloji Ltd. Şti.