Opirmail Privacy Policy

 Cloud Kenya Limited develops Opirmail for Android and operates its mail server, mx1.opirmail.com. This policy explains what happens to your information when you use Opirmail with an existing mailbox.

Request deletion of your data

Signing in and using your mailbox

Opirmail sends your mailbox email address and password to our mail server to sign you in. It uses folder names, sender and recipient addresses, subjects, dates, read status, message bodies and attachments to display and synchronize your mail. When you search a folder on the server, Opirmail sends your search terms to that server to find matching messages.

When you send, reply or forward, our server processes your message and delivers it to the recipients you select through their email providers. Forwarding can include the original message, embedded pictures and attachments. Our mail and proxy servers process connection records such as the account name, IP address, access time and success or failure of an operation to operate, protect and troubleshoot the service.

Storage on your Android device

• Login. If you choose Remember me, Opirmail encrypts the saved login using a key held in Android Keystore. Otherwise it uses the login in memory. Signing out removes the saved login.
• Offline mail. By default, Opirmail caches the last 30 days of messages and attachments in private app storage for each mailbox. It excludes Trash and Spam/Junk. A local index helps the app open messages quickly. Older entries are removed during cache access and synchronization. With a saved login, synchronization can run in the background. Connectivity and Android battery restrictions can delay updates and cleanup.
• Drafts and address suggestions. Unfinished drafts are saved locally until sent or discarded. After a successful send, recipient addresses are remembered on the device for future suggestions. This feature does not read your phone contacts. Cached mail, drafts and address suggestions can remain after sign-out.

Pictures, links and attachments

Pictures are hidden initially. Embedded pictures can be read from the message itself. If you confirm that you want to load external pictures, Opirmail requests them over HTTPS from the hosts specified by the sender. Those hosts can see your IP address and any identifier in the picture URL, which may tell the sender that you opened the message. The app can save the loaded pictures with the cached message. Tapping a web link opens the destination in your browser, where the destination site's privacy practices apply.

Opening an attachment gives the receiving app read access to that file. Saving an attachment copies it to the location or document provider you select. Temporary copies used to open files are eligible for cleanup at startup after 24 hours. Files you export, and copies kept by another app or provider, can remain after you clear or uninstall Opirmail.

Security and diagnostics

Opirmail verifies the mail server certificate and hostname and uses TLS for incoming and outgoing mail connections. This encrypts traffic between your phone and our server. Our server and the receiving mail system can process message contents for delivery. Android isolates the local mail database in app-private storage. The database has no separate application-level encryption. Android backup of the app's private data is disabled.

Opirmail includes no advertising, analytics or automatic crash-reporting SDK and does not use the Android advertising ID. If you copy and send error details to support, we receive the information you choose to send.

How to delete data or request deletion

• Remove local data. In Android Settings, open Apps → Opirmail → Storage and select Clear storage or Clear data. This removes local drafts, cached messages and attachments, saved credentials and address suggestions. Your server mailbox remains available. Delete exported files separately from the location where you saved them.
• Delete messages from your mailbox. Delete moves messages to Trash. Empty Trash removes those messages from the active mailbox. Recipients control copies already delivered to them.
• Request server-side deletion or mailbox closure. Email support@owncloud.co.ke with the subject “Opirmail data deletion request”. Include the mailbox address and identify the messages, data or account you want deleted. Keep your password private. If your employer manages the mailbox, you can also contact its mailbox administrator.

Server mailbox data, backups and connection logs are managed under the applicable mailbox service agreement. The 30-day device cache period applies only to the phone. For the retention periods that apply to your mailbox, including any backups or logs retained after deletion, contact Own Cloud Kenya Limited.

Privacy contact

For questions about this policy or your data, email Own Cloud Kenya Limited at support@owncloud.co.ke. Updates will appear on this page with a revised date.