Privacy Policy
This policy explains what information the Nette mobile app and service (“Nette”, “we”, “us”) collect, how we use it, who we share it with, and the choices you have. Nette is operated by Afila. If you have questions, contact us at support@afila.io.
The short version
- Nette connects to your Gmail account, with your permission, to check incoming email for spam, scams and phishing.
- We store email metadata (such as sender, subject, a short preview, dates and read state) and our analysis results. We do not store the full content (bodies) or attachments of your emails.
- To analyse an email, we send its sender, subject and text to OpenAI. Under OpenAI’s API terms, this data is not used to train OpenAI’s models.
- We do not sell your information, we do not show ads, and we do not use your email data for advertising.
- You can disconnect a Gmail account or delete your Nette account in the app at any time; this revokes our Google access and deletes the related data.
Contents
- Information we collect
- What we do not store
- How we use information
- AI analysis by OpenAI
- Google user data and Limited Use
- How we share information
- Service providers
- Retention and deletion
- Security
- Your rights and choices
- International transfers
- Children
- Changes to this policy
- Contact us
1. Information we collect
Account information
- Name and email address you provide when you sign up.
- Password, stored only as a one-way hash (Argon2id). We never store your password in readable form.
- Verification and reset codes we email you. These are stored only as a keyed hash and expire after 10 minutes.
- Sign-in sessions: hashed session tokens and the app’s user-agent string, so you stay signed in securely.
- Plan and credit balance (for example, how many free AI analyses remain this month).
Gmail account information (received from Google APIs)
When you link a Gmail account, you sign in with Google and grant Nette access. We request the Gmail scope gmail.modify plus your basic Google account email address. We then store:
- The linked Gmail address and the connection status.
- Google OAuth access and refresh tokens, encrypted at rest with AES-256-GCM. They are never sent to the app or to anyone else.
- Email metadata for messages in your inbox: Gmail message and thread identifiers, sender name and address, recipients (To and Cc), subject, the short preview (“snippet”) Gmail provides, the date received, the Message-ID and References headers (used to thread replies), and read/unread state.
- Sender authentication result: whether the sender passed Gmail’s DMARC check, used to recognise genuine mail from trusted organisations.
- Analysis results: the risk score and level, a one-sentence summary and short reasons produced for each analysed email.
- Sync state: Gmail history and push-notification identifiers, so we only fetch what changed.
- Your sender lists: addresses you mark as trusted or blocked.
Device information
- An identifier the app generates for your device installation, the platform (iOS or Android), your device language, and a push notification token so we can send alerts to that device.
Subscription information
If you buy a Pro or Business subscription, the payment is handled by Apple (App Store) or Google (Google Play); we never receive your card or other payment details. We use RevenueCat to validate store purchases: the app and our server share your Nette account identifier (a random ID, not your email address) with RevenueCat, and RevenueCat tells us which plan you have. We store your subscription status: plan, store, product, renewal or expiry date, and whether it will renew.
Technical information
- IP address, used briefly to rate-limit requests and protect the service from abuse. Rate-limit counters expire automatically within an hour.
- Server logs recording request method, path, response status, timing and errors. Passwords, tokens and authorization headers are removed from logs before they are written.
2. What we do not store
- Full email bodies and attachments. When you open an email in the app, download an attachment, or when an email is analysed, we fetch it from Gmail at that moment, process it in memory, and do not save it in our database.
- Emails you send through Nette. The message and any attachments pass through our server to Gmail and are not kept.
- Your Google password. You sign in on Google’s own page; we only receive the access you grant.
- Card or bank details.
3. How we use information
We use the information above only to provide and improve the features you see in Nette:
- to show your inbox in the app and keep it in sync with Gmail;
- to assess new emails for spam, scams and phishing and show you the result;
- to send you push notifications about suspicious or likely-scam emails;
- to carry out actions you request on your Gmail account: marking messages read or unread, moving messages to the trash, and sending or replying to email;
- to apply your trusted and blocked sender lists;
- to create and secure your account, verify your email address, and reset your password;
- to track your plan and analysis credits;
- to keep the service secure, prevent abuse, fix problems, and comply with the law.
We do not use your information for advertising, we do not build advertising profiles, and we do not sell or rent your information to anyone.
4. AI analysis by OpenAI
Nette uses OpenAI’s API to assess emails. For each new email that needs an assessment, we send OpenAI:
- the sender name and address and the subject line;
- the text of the email body, limited to the first 10,000 characters (formatting is stripped; attachments and images are not sent);
- whether the sender passed DMARC authentication.
Emails from senders on your blocked or trusted lists, and authenticated mail from well-known trusted domains, are not sent to OpenAI. If you ask the app to translate an assessment, we send OpenAI only the assessment text (summary and reasons), not the email itself.
OpenAI processes this data as our service provider to return the assessment. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models, and OpenAI may keep it for a limited period for abuse and misuse monitoring before deleting it. We do not use your email content to train any AI or machine-learning models.
AI assessments can be wrong. Treat them as guidance, not a guarantee, and use your own judgment before clicking links, opening attachments or sending money or information.
5. Google user data and Limited Use
Nette's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Gmail data only to provide and improve the user-facing features described in this policy: spam, scam and phishing detection, alerts, and the inbox and email actions you choose in the app.
- We transfer Gmail data to others only as needed to provide those features (for example, to OpenAI for analysis, and the sender and subject of a risky email to Google Firebase Cloud Messaging and Apple to deliver an alert), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use or transfer Gmail data for serving advertisements, including retargeting, personalised or interest-based advertising.
- We do not sell Gmail data, and we do not use it to determine credit-worthiness or for lending purposes.
- We do not use Gmail data to develop, improve or train generalised or non-personalised AI or machine-learning models.
- No person at Afila reads your email unless you give us explicit permission for specific messages (for example, when you ask support to look into one), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
You can review or remove Nette’s access at any time in your Google Account at myaccount.google.com/permissions. If you do, Nette can no longer read or act on that mailbox until you link it again.
6. How we share information
We share information only:
- with the service providers listed below, who process it on our behalf and under our instructions;
- with Google, to read and act on your Gmail account as you request;
- when required by law, legal process or a valid government request, or to protect the rights, property or safety of our users, Afila or others;
- in connection with a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.
Push notifications: when an email is assessed as suspicious or a likely scam, we send a notification containing the sender’s name (or address) and the subject line to your device through Google Firebase Cloud Messaging (and, on iPhone, Apple Push Notification service). You can turn notifications off in your device settings.
7. Service providers
| Provider | Purpose | Data involved |
|---|---|---|
| Contabo GmbH | Server hosting (data centre in the United States) | All data we store, as described in section 1 |
| OpenAI | AI analysis of emails and translation of assessments | Sender, subject and body text of analysed emails; assessment text for translation |
| Google (Gmail API, Cloud Pub/Sub) | Reading and acting on your mailbox; notifying us of new mail | Your Gmail account data, as you authorise |
| Google Firebase Cloud Messaging; Apple Push Notification service | Delivering push notifications | Push token; sender and subject of risky emails |
| Email delivery (SMTP) provider | Sending verification and password-reset codes | Your name, email address and the code |
| Apple (App Store); Google (Google Play) | Selling and billing subscriptions | Purchase and billing details you give the store |
| RevenueCat, Inc. | Validating store purchases and subscription status | Your Nette account ID, store purchase receipts and subscription status, basic device and app information |
We may also keep access-restricted copies of our database backups with a backup storage provider. We will update this list if our providers change.
8. Retention and deletion
- Account data is kept until you delete your account.
- Email metadata and analysis results are deleted automatically 180 days after the email was received, or earlier when you disconnect the mailbox or delete your account.
- Translated assessments are cached for up to 7 days.
- Verification codes expire after 10 minutes; expired codes and expired or revoked sessions are deleted by a daily clean-up.
- Server logs are rotated and overwritten automatically, typically within days.
- Backups of our database are kept for up to 30 days, so deleted data can remain in backups for up to 30 days before it is overwritten. Backups are used only to recover from failures.
Disconnecting a Gmail account
When you remove a Gmail account in the app, we stop Gmail push notifications, revoke our Google access token (unless the same Gmail address is still linked to another Nette account), and delete that mailbox’s stored tokens, email metadata, analysis results and sender lists.
Deleting your account
You can delete your account in the app (you will be asked for your password). We then revoke Google access for every linked mailbox and delete your account, mailboxes, email metadata, analysis results, sender lists, devices and sessions. App Store and Google Play subscriptions can only be cancelled by you in your store account, so cancel your subscription there before deleting your account; the app reminds you. You can also ask us to delete your account by emailing support@afila.io from the address on your account.
9. Security
- All traffic between the app and our servers uses HTTPS (TLS).
- Google OAuth tokens are encrypted at rest with AES-256-GCM; passwords are hashed with Argon2id; session tokens and verification codes are stored only as hashes.
- Our database and cache are not exposed to the internet, and access to production systems is restricted to authorised personnel.
- Each user can access only their own mailboxes and data.
No system is perfectly secure. If we become aware of a breach that affects your information, we will notify you and the relevant authorities as required by law.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. In the app you can view and edit your name, change your password, disconnect mailboxes, edit your trusted and blocked sender lists, and delete your account. For anything else, including a copy of your data, email support@afila.io. We will respond within the time required by applicable law (usually within 30 days) and may need to verify your identity first.
If you are in the European Economic Area or the United Kingdom, you can also lodge a complaint with your local data protection authority. We process your information to perform our contract with you (providing the service), for our legitimate interests (security, abuse prevention and service improvement), to comply with legal obligations, and, where required, with your consent (for example, the Gmail access you grant).
11. International transfers
Our servers are in the United States. Some service providers, such as OpenAI and Google, may also process data in the United States or other countries. If you use the service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
12. Children
Nette is not directed to children under 13, or under 16 in the European Economic Area and the United Kingdom, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact support@afila.io and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the effective date above. If a change materially affects how we use your information, we will notify you in the app or by email before it takes effect.
14. Contact us
Afila
Email: support@afila.io
Website: nette.afila.io