Privacy Policy

1 Overview

ZeroIn ("the app") is an email client application developed and published by Bartosz Wójcik, whose homepage and only official domain is zeroin.email. This Privacy Policy explains how ZeroIn handles information when you install and use the application on your device. It applies to every ZeroIn build — desktop, mobile, beta and general release.

ZeroIn has a local-first architecture. The application connects directly from your device to whichever email provider you choose — Google, Microsoft, or any IMAP/SMTP server — using that provider's own API or protocol. Your email is stored in a database on your device.

The app is currently in closed beta. Where a beta build behaves differently from the general release, this policy notes the difference.

2 Google user data

This section sets out, in one place, how ZeroIn accesses, uses, stores, shares, protects, retains and deletes data obtained through Google APIs. It applies when you connect a Gmail or Google Workspace account to ZeroIn.

2.1 What ZeroIn accesses

When you connect a Google account, ZeroIn asks for your consent on Google's own screen, on your device, and requests exactly the following scopes. No other Google API is requested or used.

ZeroIn does not request and does not hold access to Google Drive, Google Calendar, Google Photos, Google Chat, or any other Google service.

2.2 How ZeroIn uses it

Google user data is used solely to provide the email and contact features you can see in ZeroIn's own interface: displaying, searching, threading, organising, composing, sending and synchronising your mail and contacts, and telling you whether a message is authentic.

It is not used for anything else. In particular it is never used to build a profile of you, to target or measure advertising, to train or improve any machine-learning or artificial-intelligence model, or for any purpose unrelated to running the app on your device.

2.3 Where it is stored, and who can read it

All Google user data retrieved by ZeroIn is written to a database on your own device only (see Section 5) and to your operating system's secure credential store in the case of OAuth tokens. None of it is transmitted to the developer, and none of it passes through any infrastructure we control, because we operate none.

Nobody at ZeroIn can read your Google user data. This follows from the app's architecture rather than from a policy commitment: the data is not held on any server, and we have no administrative access to your device. We therefore have no means of using the limited exceptions Google's policy permits — access with your explicit affirmative consent, access necessary for security purposes, or access required by law — and we have made no arrangement to obtain one.

2.4 Who it is shared with

Two optional features send information derived from your mailbox to a third party in order to provide functionality visible in ZeroIn's interface. They are listed below:

Neither feature sends message content, subjects, your own address, your account name, or any OAuth token. Each can be switched off on its own in Settings → Protection, and choosing the Strict security level switches off both for you. With both off, ZeroIn contacts nothing but your email provider.

These are transfers made to provide user-facing features that are prominently visible in the application's interface, and they are permitted on that basis. No other such transfers take place. A full list of every outbound connection the app can make, including these, is in Section 7.

2.5 Limited Use

Specifically, ZeroIn:

• Limits its use of Google user data to providing and improving the user-facing features that are prominently visible in the app's interface
• Does not transfer Google user data, except as necessary to provide or improve those user-facing features (the two derived-data features named in Section 2.4), to comply with applicable law, or as part of a merger or acquisition after obtaining your explicit consent
• Does not use Google user data for serving advertising of any kind, including retargeted, personalised or interest-based advertising
• Does not sell Google user data, and does not transfer it to data brokers, information resellers, or any other party for those purposes
• Does not use Google user data to determine creditworthiness or for lending purposes
• Does not use Google user data to develop, train, or improve any generalised or non-personalised artificial-intelligence or machine-learning model
• Does not allow humans to read Google user data, other than in the narrow circumstances Google's policy permits, which as explained in Section 2.3 we have no means of exercising

2.6 Retention, revocation and deletion

Google user data is kept on your device for as long as you keep the account connected, subject to the retention settings described in Section 8. You can:

• Remove the account in the app — Settings → Accounts → Remove. This deletes every message, thread, attachment and contact belonging to that account from the local database, and deletes its OAuth tokens from the credential store.
• Revoke ZeroIn's access at Google — myaccount.google.com/permissions. ZeroIn's tokens stop working immediately and the app can fetch nothing further.
• Uninstall the app — see Section 12 for what this does on each platform.

Because we hold none of your Google user data, no server-side copy remains after any of these steps, and no deletion request to us is required.

3 Other email providers

Your relationship with your email provider is governed by their policy, not this one: Google, Microsoft, or the terms of whichever IMAP/SMTP provider you use.

Microsoft Graph

When you connect an Outlook or Microsoft 365 account, ZeroIn requests the following permissions. The same rules apply as for Google user data: local storage only, no transfer to us, no advertising, no model training.

You can revoke ZeroIn's access at account.live.com/consent/manage.

IMAP, POP3 and SMTP

For any other provider, ZeroIn connects with your username and password over the standard protocols. Connections are encrypted with TLS; a plaintext port is upgraded with STARTTLS and the server's capabilities re-read afterwards. If a server cannot offer an encrypted connection, ZeroIn ends the connection rather than falling back to an unencrypted one, unless you have explicitly accepted an insecure connection for that account.

4 What data ZeroIn handles

Stored on your device only

The following is written to your device and does not leave it unless you export it yourself:

• Email messages, threads and attachments downloaded from your provider
• Account credentials, and OAuth access and refresh tokens (in the operating system's secure credential store)
• Contacts, built from your correspondence and, for Google accounts with contact sync enabled, from Google Contacts
• Application settings, security level, window layout and open tabs
• Notes, labels, folders, virtual folders and project metadata you create
• Signatures, templates, custom themes and RSS feed subscriptions
• A rendered copy of each message you have opened, cached so it reopens instantly

Never collected, in any build

Crash reporting and diagnostics — opt-in, off by default

Crash reporting and performance diagnostics are opt-in and switched off by default in every build, including the closed beta. A beta build asks once, before the app starts, and stores your answer; if you decline, the reporting library is not started. You can change the answer at any time in Settings → About.

If you enable it, ZeroIn sends crash reports, error summaries and performance timings (for example, the duration of a sync or a database open), tagged with the app version and build number. Log lines are scrubbed at two points before they can leave the device: when each line is written, which removes credentials and tokens so they are never stored; and again, more extensively, at upload, which removes email addresses, home directory paths, message identifiers, file names, and URL paths and query strings. Network breadcrumbs are removed entirely, because the sequence of hosts contacted can reveal information about your mailbox.

Crashes are not reported automatically. A crash is written to a local file. The next time you open ZeroIn, you are shown the full report, can edit it, and are asked whether to send it. Closing that window counts as declining, and the file is deleted in either case. A report is sent only with your confirmation.

Diagnostic data is processed by Sentry, our crash-reporting processor. If you submit a bug report through the in-app "Report an issue" screen, a corresponding issue may also be created on our private, invite-only GitHub repository so you can follow its progress. If you attach a screenshot to a bug report, you are first shown the exact image at full size, with names and message text already pixelated, and can remove it before sending.

5 Where data is stored

ZeroIn stores your mail in an Isar database in a platform-appropriate application-support directory. The app shows you the exact path for your installation at Settings → Backup & Reset; beta builds keep their data in a separate beta subfolder so a beta install and a release install never share a mailbox.

• Windows: %APPDATA%\com.procreative.zeroin\zero_in\databases\
• macOS: ~/Library/Application Support/zero_in/databases/
• Linux: ~/.local/share/zero_in/databases/
• Android: External application storage, chosen so your mail survives a reinstall
• iOS: The app's Documents directory, which iCloud backup covers

Encryption at rest — what is and is not protected

What that does and does not mean in practice:

6 How data is used

Everything ZeroIn stores is used exclusively to provide the app's functionality to you, on your device:

• Messages are stored locally for offline access, fast search and thread grouping
• Credentials and tokens are used to authenticate with your provider when syncing and sending
• Contacts drive address auto-complete and the list of correspondents the phishing checks compare against; for Google accounts with sync enabled, they are additionally read from and written back to Google Contacts
• Settings are stored to remember your preferences between launches
• Message content is analysed on your device to check sender authentication and score phishing signals

We do not use any of your data for profiling, advertising, machine learning, model training, or any purpose other than running the app.

7 Connections the app makes

The table below lists every outbound connection ZeroIn can make. You can verify this in Settings → Protection → Network Log, which shows each request made in the current session, whether it was allowed or refused and why, and a count of refusals. That screen and this table are derived from the same definition in the source code, so they match.

Rules that hold in every mode

These rules are not configurable and apply at every security level, including the most permissive:

• Every request declares its purpose. There is no general-purpose connection; a request without a declared purpose is refused before it is made.
• Unencrypted connections are refused. Plain http:// is refused even to an otherwise permitted host, in development builds as well as released ones.
• Unknown hosts are refused in every category. A host permitted for mail is not thereby permitted for any other purpose.
• URLs containing a password are refused.
• Message content is not fetched while you read. Images and stylesheets are downloaded during scheduled sync, so opening a message generates no network activity.
• Links are never followed to determine their destination — not on hover, during rendering or during sync. Information about a link is derived from the link itself, so a sender is not notified of a click that did not happen.
• Known tracking and beacon hosts are never contacted at any security level. The blocklist is built into the app and is not downloaded.

Why the timing of image loading matters

A tracking pixel is a small image at a URL unique to the recipient; loading it tells the sender that the message was opened, when, and approximately where. The time of opening is the most informative part, and ZeroIn removes it at every security level: remote content is fetched during scheduled sync, before you open anything, so a message is already fully stored when you read it. A sender monitoring the request learns only that the message was delivered.

There are two exceptions, both requiring you to press a button: Load once on the banner above a message, and clicking a single blocked image. Both show a notice before fetching, neither choice is remembered, and neither bypasses the tracker blocklist.

Features that disclose your correspondents

Both are introduced in Section 2.4 and described in more detail here, as together they determine which services a new installation contacts.

Profile pictures. Retrieving a picture for an address requires querying a service that holds one: Gravatar receives a hash of the address, and favicon services receive the domain. Across a whole mailbox, these queries can reveal your list of contacts to those third parties. Pictures from your own accounts, such as a Google Contacts photo or an avatar supplied by your provider, are not affected, as they come from your provider rather than a third party.

Sender verification. Checking a message's DKIM signature requires querying a public DNS resolver for the sender's key. Over many messages, the resolver can infer which domains send you mail. Disabling this means relying on your provider's authentication header instead of verifying independently. Both options involve trade-offs, which is why this is a setting rather than a fixed rule.

Both are enabled under the Normal level and disabled under Strict. With Strict selected, a new installation connects only to your mail provider.

The website

Two things about zeroin.email, which are separate from the app:

• Google Fonts. The website loads the Inter typeface from Google's servers, so visiting it makes a request to Google, governed by Google's privacy policy. The application itself loads no web fonts at all.
• Beta waitlist (Brevo). If you sign up for the closed or open beta waitlist, the address you submit is stored by Brevo (Sendinblue SAS), which we use to manage the lists and send beta communications. We keep the two lists separate and email you only about the one you joined. Brevo's privacy policy governs their processing. You can be removed at any time via the unsubscribe link in any waitlist email or by writing to the address in Section 15. This concerns only an address you voluntarily typed into a form on the website — it has no connection to any data in the app.

App stores

When you download ZeroIn from the Microsoft Store or Google Play, those platforms' own terms and policies govern the download. We do not receive information about who downloaded the app.

8 How long data is kept

Because your mail is stored on your device rather than by us, retention is mostly something you control. The defaults are:

We hold no copy of your mail, contacts or credentials, so there is nothing on our side with a retention period attached to it.

9 No advertising, no analytics

ZeroIn displays no advertisements. It integrates no advertising SDK, no attribution SDK and no analytics SDK. It uses no advertising identifiers (IDFA, Android Advertising ID) and shares nothing with advertising networks.

It also collects no usage statistics of any kind, in any build, and adds no "sent from ZeroIn" marker to mail you send, including in message headers and structure.

We intend to sustain ZeroIn through a fair, transparent paid tier for advanced features — not by monetising your data. There is no licensing, activation or account check in the app today, and if that ever changes it will be verified on your own machine with no server involved.

10 Children's privacy

ZeroIn is a general-audience application and is not directed at children under 13. We do not knowingly collect any information from children, and the app collects no personal information from any user. ZeroIn is intended for people who already hold an email account with a third-party provider. If you believe a child under 13 has used ZeroIn in a way that raises a privacy concern, please write to us at the address in Section 15.

11 Your rights

Because your data is stored on your own device, you have direct control over it at all times.

Access

Everything ZeroIn stores is on your device. You can read it in the app, export contacts as CSV or vCard, and export messages as .eml files.

Correction

Contact records and settings are editable in the app at any time.

Deletion

See Section 12.

Portability

Contacts export as CSV and vCard; messages export as .eml. Your mail also remains available through your provider independently of ZeroIn.

GDPR and equivalent rights

If you are in the European Economic Area, the United Kingdom, or another jurisdiction granting data-protection rights, those rights apply to any personal data we hold. The developer is established in Poland and acts as data controller only in respect of the limited information described in Section 7 under "The website" and Section 4 under diagnostics. Your mailbox itself is not held by us, so a request concerning its contents is one for your email provider. For anything at all, write to us at the address in Section 15 and we will help.

You also have the right to lodge a complaint with your national supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO).

12 Deleting your data

To remove everything associated with ZeroIn:

1. Remove the account in the app — Settings → Accounts → Remove. This deletes that account's messages, threads, attachments, contacts and tokens from your device immediately.
2. Revoke the app's access at your provider — Google: myaccount.google.com/permissions. Microsoft: account.live.com/consent/manage. For IMAP accounts, change your password.
3. Delete the local database — uninstall the app, or delete the directory shown at Settings → Backup & Reset. On iOS, uninstalling deletes it. On Windows, macOS, Linux and Android the directory is chosen to survive a reinstall, so delete it explicitly if you want it gone.
4. Ask us to delete anything you sent us — if you opted into diagnostics or filed a bug report, write to privacy@zeroin.email and we will delete the report and any associated tracker entry.

After these steps no ZeroIn data remains on your device and nothing of yours remains with us. Your mail on the server is unaffected and stays under your provider's control.

13 Security

ZeroIn implements the following security measures:

• Credentials and OAuth tokens are held in the platform keystore, never in plain text and never in the message database
• OAuth uses PKCE on every platform, desktop and mobile alike
• All mail connections are TLS; plaintext ports are upgraded with STARTTLS and capabilities re-read afterwards; a downgrade aborts unless you accepted it for that account
• Message HTML is sanitised on the parsed document, so the content that is inspected is the content that is rendered. Scripts, forms, embedded objects and event handlers are removed, and a message cannot access the network, read local files or navigate to another page
• Incoming messages are checked for SPF, DKIM and DMARC, but a "verified sender" mark is shown only when your own provider verified it and the verified domain matches the address you are shown
• Sixteen phishing signals are weighted and scored entirely on your device, and each warning describes the specific issue rather than showing a generic alert
• Links are inspected from the string alone; tracking parameters are stripped, click-tracker wrappers unwrapped, and lookalike domains named
• Known tracking and beacon hosts are refused at every security level
• Attachment filenames are displayed accurately, right-to-left override characters are neutralised and marked, and attachments are never passed to the operating system to open
• Logs are scrubbed before they are stored, so credentials are never written to the stored log
• Screenshots and screen recording can be blocked, including the thumbnail the system takes for the app switcher; Android backups are disabled
• Privacy mode pixelates senders, subjects, bodies and avatars on demand, and is forced on while a feedback screenshot is captured

No method of transmission or storage is completely secure. We implement commercially reasonable measures and document their limitations, but we cannot guarantee absolute security.

A fuller technical account is on our security page.

14 Changes to this policy

We may update this Privacy Policy from time to time, and will update the "Last updated" date at the top of this page when we do. For significant changes — particularly anything that introduces new data collection or sharing, or that changes how the app uses Google user data — we will give prominent notice inside the application before the change takes effect, and where the change materially affects how Google user data is handled we will seek your consent again.

Your continued use of ZeroIn after a change takes effect constitutes acceptance of the revised policy. Previous versions are archived and available on request.

15 Contact us

If you have any question, concern or request about this policy or how ZeroIn handles your data, please write to us. ZeroIn is developed independently, and every enquiry is read personally.

We aim to respond to privacy enquiries within 30 days.