Privacy Policy

Effective date: October 22, 2026

X-Mail (the "App", Chinese name X-邮箱) is operated by Yishu Labs ("we", "us"). This policy explains how the App handles your information. The core principle: your email stays on your own device.

1. Your data stays on your device

• Email content, attachments, contacts and classification results are stored only on your own device (inside the App's sandbox).
• Our servers do not store your email.

2. Sign-in and credentials

• Your email password or app-specific code is stored in the system Keychain.
• One-tap sign-in for Gmail and Outlook uses OAuth 2.0. Tokens are stored in the Keychain, and the App never obtains your Google or Microsoft account password.
• You can revoke the App's access at any time in your Google or Microsoft account settings.

3. Sending and receiving email

The App connects directly to your email provider over IMAP/SMTP (encrypted with TLS). This traffic does not pass through our servers.

4. AI features

• Summaries, translation, AI replies and AI classification run only when you tap them. When triggered, the text of the relevant email is sent to an AI service for processing. If you do not use AI features, nothing is sent.
• With the default "Yishu AI", content is relayed through Yishu Labs' server (mail-api.yishulabs.com) to third-party model providers (DeepSeek and Tencent Hunyuan in mainland China; OpenAI and Anthropic elsewhere). Our server only relays requests and counts usage; it does not store email content.
• You may instead enter your own AI key in Settings. Content is then sent directly to the provider you choose, without passing through our server.

5. Sender icons

To show a sender's company logo, the App requests the website icon (favicon) directly from the sender's own domain, without any third party. Results are cached on your device.

6. Remote images

Remote images in an email may let the sender know that you opened it. You can turn off "Load remote images" in Settings.

7. Calendar

The App requests calendar permission and writes an event only when you tap "Add to Calendar".

8. What we do not do

• We do not collect advertising identifiers, track you across apps, or sell your data.
• The App currently integrates no third-party analytics SDK.

9. Data deletion

• Signing out of a mailbox under "Me" deletes that mailbox's email and password from your device.
• Uninstalling the App deletes all of its data from your device.

10. Minors

The App is intended for adults. Minors under 18 should use it only with the consent and guidance of a parent or guardian.

11. Changes to this policy

We may update this policy from time to time. Updates will be posted on this page with a new effective date, and we will notify you in the App of material changes. Continued use means you accept the updated policy.

12. Contact us

Questions? Contact Yishu Labs: support@yishulabs.com