Your data and your choices

Privacy policy

ZZMailer is an iPhone app that helps you review unwanted Gmail messages and move only the messages you confirm to Gmail Trash. This policy describes the iPhone app and this website.

Effective 30 September 2026

Google account access

When you choose to sign in, ZZMailer uses Google OAuth to receive your account identifier and email address. It asks for permission to read and modify Gmail messages so it can scan the Inbox period you select and move messages you explicitly confirm to Trash. The app does not send mail, create drafts, or permanently delete messages, even though Google's description of the requested Gmail permission is broader.

How Gmail data is used

For a scan you start, the app retrieves message identifiers, headers, dates, snippets, attachment indicators, and available plain-text message bodies directly from Gmail. It uses that data to assess messages with an AI model on your iPhone and to show suggestions for your review. You can deselect any suggestion. ZZMailer sends a Trash request to Gmail only after you confirm the selected messages and count.

ZZMailer does not use Gmail data for advertising, sell it, or use it to train AI models. Gmail content and OAuth tokens are not sent to a ZZMailer server or to a cloud AI provider. The app connects to Google's authentication, account information, and Gmail services to provide the features you request.

How we protect your data

ZZMailer uses the following safeguards to protect sensitive Google account and Gmail data:

• Encrypted connections. The app uses HTTPS (TLS encryption) to connect directly to Google's authentication, account information, and Gmail services. This protects account credentials and Gmail data while they travel between your iPhone and Google.
• Protected credentials on your iPhone. OAuth tokens and connected account details are stored in the iOS Keychain with a device-only, when-unlocked access setting. These Keychain items are accessible only while your device is unlocked and cannot migrate to another device through a restored backup.
• Protected sign-in. Google OAuth sign-in uses Proof Key for Code Exchange (PKCE) with SHA-256 and validates the sign-in callback and a random state value. These checks help protect the authorization code and ensure the response belongs to the sign-in you started.
• On-device AI processing. Message assessment runs locally on your iPhone. Gmail content and OAuth tokens are not uploaded to a ZZMailer backend or a cloud AI service for processing.

Storage and deletion

OAuth access and refresh tokens, together with the connected account identifier and email address, remain in the iOS Keychain so you can stay signed in. Scanned messages, assessment results, selections, and cleanup outcomes are held in app memory for the current scan and review flow; the app does not save a mailbox archive. Starting another scan, finishing the review flow, or signing out clears that scan state.

Signing out clears the app's current sign-in state and attempts to delete the stored Keychain credentials and revoke the Google token. Credential deletion or revocation may fail, for example if the Keychain is unavailable or Google cannot be reached. You can independently remove ZZMailer's access in your Google Account connections settings.

Messages you confirm for cleanup are moved to Gmail Trash and remain subject to Gmail's own retention and recovery rules. You can restore them in Gmail while they remain in Trash. ZZMailer does not keep a separate copy.

Sharing and limited use

ZZMailer's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. The app uses Google user data only to provide the sign-in, scan, review, and user-confirmed Trash features described here. It does not transfer that data to independent third parties.

This website

The ZZMailer homepage and these policy pages are static. They do not connect to Gmail, ask you to sign in, or receive your mailbox content. The site does not set analytics or advertising cookies through its own page code.

Changes and contact

We may update this policy as the app changes. The effective date above identifies the current version. For privacy questions or requests, email tongli0809@gmail.com.