Privacy Policy
This Privacy Policy explains how personal information is accessed, processed, stored and shared when you use the NikkiMail application or website.
1. Who is responsible for your information
NikkiMail is operated by AB15 Media and Technology Limited, a company registered in Scotland with company number SC902666. Its registered office is 38 West Craigbank Crescent, Aberdeen AB15 9AU, United Kingdom. AB15 Media and Technology Limited is the data controller responsible for the personal information described in this policy.
Privacy questions and requests may be sent to support@ab15mediatech.com.
Google, Apple and other third parties may act as separate controllers for information they process under their own services, terms and privacy policies.
2. NikkiMail’s processing architecture
Gmail API requests are made by the NikkiMail application on your device directly to Google.
NikkiMail does not operate a server that receives or stores your Gmail messages, message bodies, attachments, mailbox metadata or Google OAuth access tokens.
Limited Gmail-derived information is stored locally on your device so that cleanup analysis, history and recovery information can remain available between sessions.
Information may leave your device where this is necessary to:
- communicate with Google and perform a feature you request;
- send an unsubscribe request to a sender’s endpoint;
- process a purchase through Apple;
- deliver and secure the NikkiMail website;
- respond to information you voluntarily send to support; or
- comply with a binding legal obligation.
3. Information processed by NikkiMail
Google Account information
When you connect Google, NikkiMail processes information needed to identify and display the connected account, including your Google account email address, display name and granted permissions.
Google OAuth credentials are managed through Google Sign-In. NikkiMail never asks for or receives your Google password.
Google Sign-In software
Google Sign-In and related Google software components included in the application may collect or process information declared by Google in their software privacy manifests. Depending on the sign-in flow and device, the declared categories can include name, email address, phone number, coarse location, user and device identifiers, limited usage data and other technical information.
Google declares these categories for application functionality and, for certain identifiers, usage information and other technical data, analytics. NikkiMail reflects these declarations conservatively in its Apple App Store privacy information even though every category may not arise in every sign-in.
NikkiMail does not use this information for advertising or tracking and does not operate a server that receives Google Sign-In analytics or diagnostic records. Google may receive and process information through its software under the Google Privacy Policy.
Gmail metadata
To analyse and clean your mailbox, NikkiMail may process:
- Gmail message and thread identifiers;
- sender names and email addresses;
- subject lines and Gmail snippets;
- message dates and size estimates;
- Gmail labels and categories;
- mailing-list identifiers;
- unsubscribe headers;
- limited authentication headers used to assess whether an automatic unsubscribe request is safe;
- Gmail history identifiers and synchronisation cursors; and
- estimated and current matching-message counts.
This metadata may itself contain personal information about you, senders, recipients or other people appearing in your mailbox.
Selected email previews
Routine mailbox analysis does not download full message bodies.
If you explicitly select “View email”, NikkiMail retrieves the selected message from Gmail and extracts readable text for a text-only preview.
If a message contains only HTML, the HTML may be processed locally to derive plain text. NikkiMail does not render the HTML, execute scripts or load remote images or tracking resources.
The preview may include sender and recipient information, the subject, date, snippet, readable text, and attachment filenames, media types and estimated sizes.
Attachments themselves are not downloaded by the preview feature. The selected message body is not written to NikkiMail’s routine local mailbox cache.
Mailbox settings and actions
When you choose a cleanup feature, NikkiMail may process message identifiers, sender addresses, action selections and action results in order to:
- move messages to Gmail Trash;
- restore supported messages from Trash;
- inspect Trash;
- permanently delete messages from Trash;
- create, inspect or remove Gmail filters;
- maintain a local record of blocked or cleaned senders; and
- maintain cleanup and recovery statistics.
Google storage information
If you enable the storage feature, NikkiMail may process Google storage quota figures, including total usage and available quota, so they can be displayed in the application.
Purchase information
Apple processes subscription purchases and payment details.
NikkiMail may receive StoreKit product, transaction and entitlement information needed to provide paid features. NikkiMail does not receive your full payment-card details.
A small counter recording completed free cleanup actions may be stored in the iOS Keychain. It does not contain Gmail content, message identifiers, sender details or your connected email address.
Legal acceptance record
Before Google sign-in, NikkiMail records the version of the Terms you accepted and the date and time of acceptance in local application storage. This record does not contain Gmail content or your connected Google account details and is not sent to a NikkiMail server.
Support communications
If you contact support, we process the information you choose to provide, such as your email address, message, screenshots and diagnostic details.
You should not send email contents, passwords, access tokens or other sensitive information unless it is necessary for the support request.
Website information
The NikkiMail website does not require an account and contains no NikkiMail advertising or behavioural analytics scripts.
Porkbun, which hosts the website, may process ordinary technical information such as IP address, browser information, requested pages, timestamps and security logs in order to deliver and protect the website.
4. Google permissions
NikkiMail uses progressive permissions and requests additional Google access only when a selected feature requires it.
The current permissions are:
- Gmail read-only access for mailbox analysis and selected previews;
- Gmail modify access when you choose to move or restore messages;
- Gmail settings access when you choose to create, inspect or remove blocking filters;
- full Gmail mail access when you explicitly choose permanent deletion; and
- Google Drive app-data access when you enable Google storage quota information.
Granting a Google permission authorises the relevant technical access. It does not cause NikkiMail to use that access for advertising, data brokerage or unrelated purposes.
You can decline an additional permission, although the corresponding feature will not operate.
5. Purposes and lawful bases
Providing the service
Google account information, Gmail metadata, selected previews, mailbox actions, quota information and entitlement information are processed because this is necessary to perform the service you request under our contract with you.
Security and misuse prevention
Limited technical and account information may be processed where necessary for our legitimate interests in securing NikkiMail, preventing misuse, diagnosing failures and protecting users.
These interests are pursued in a proportionate manner and do not permit Gmail content to be used for advertising or unrelated profiling.
Support
Support correspondence is processed as necessary to respond to your request and perform our contract with you. We may also retain limited correspondence where necessary for our legitimate interests in maintaining support records, resolving disputes and improving the reliability of support.
Purchases, accounting and legal compliance
Transaction records may be processed as necessary to perform the purchase contract and comply with tax, accounting, consumer protection and other legal obligations.
Website delivery and security
Ordinary website logs may be processed for our legitimate interests in delivering, maintaining and securing the NikkiMail website.
Legal requirements
Information may be processed where necessary to comply with a legal obligation or binding legal process.
NikkiMail does not treat the Google OAuth permission screen as consent under data protection law where another lawful basis applies.
6. Local storage and data minimisation
NikkiMail stores its Gmail-derived local state in an account-scoped application-support area on your device.
The stored information can include:
- sender summaries;
- selected message metadata and identifiers;
- message and storage estimates;
- analysis and discovery progress;
- cleanup history;
- blocked-sender information;
- Trash and recovery statistics;
- historical sender-suppression information; and
- the state of an unfinished permanent-deletion operation.
The files use iOS Data Protection and are protected until the first device unlock following a restart. They are marked so that they are not included in ordinary device backups.
Logical storage names are converted into non-readable hashed filenames.
Raw Authentication-Results, DKIM-Signature and List-Unsubscribe-Post header values are removed before long-lived analysis data is stored. NikkiMail may retain a sender-provided unsubscribe URL where it is needed for the cleanup feature.
Dormant analysis and large-message cache data older than approximately 30 days is discarded when the cache is next loaded. Other local records remain until removed through the deletion controls described below, the application removes them as part of normal operation, or iOS deletes the application’s storage.
7. Text-only previews
A selected preview is held temporarily while it is displayed.
NikkiMail does not store the full preview body in its routine Gmail-derived cache and does not provide the body to a NikkiMail server.
HTML email is not rendered. Scripts, embedded web content, remote images and tracking pixels are not loaded by the preview interface.
Only attachment metadata is shown. Attachment files are not downloaded.
8. Unsubscribe requests
When you confirm a supported unsubscribe action, NikkiMail may send a standards-based HTTPS request directly from your device to an endpoint supplied by the sender.
The endpoint may receive:
- the unsubscribe token or identifier included by the sender in the URL;
- the standard one-click unsubscribe request;
- your device’s public IP address; and
- ordinary network request information.
NikkiMail does not send the email body or attachments to the unsubscribe endpoint.
Automatic requests are limited to validated HTTPS destinations. NikkiMail does not follow redirects, accept cookies or intentionally contact obvious local or private-network destinations.
The recipient operates independently and its own privacy practices apply to information it receives.
9. Production logs and error handling
NikkiMail is designed not to place Gmail message bodies, raw Gmail API response bodies, OAuth access tokens, sender addresses or subject lines in its own production diagnostic messages.
User-facing Gmail API errors are reduced to a general description and HTTP status rather than displaying the provider’s raw response.
Apple, Google, iOS and third party software components may produce their own operational or diagnostic information under their respective policies and device settings.
10. Sharing and disclosures
NikkiMail does not sell or rent Google user data.
NikkiMail does not use Gmail data for advertising, advertising profiles, data brokerage or unrelated marketing.
Information may be transmitted to:
- Google, including through Google Sign-In and related software components, to authenticate the account, provide and secure the sign-in flow, support related analytics, and perform Gmail or storage actions you request;
- Apple, to process purchases, subscriptions and StoreKit entitlements;
- a sender or mailing-list operator, when you request an unsubscribe action;
- Porkbun, to deliver and secure the website;
- the provider used to deliver support email, when you contact support;
- professional advisers or service providers where necessary to operate and protect the service and subject to appropriate confidentiality obligations; and
- a court, regulator, public authority or other party where disclosure is required by applicable law or binding legal process.
Because NikkiMail does not operate a Gmail-content backend, we ordinarily do not possess server-side copies of your mailbox that could be sold, disclosed or supplied in response to a request.
11. Google API Services User Data Policy
NikkiMail’s use and transfer to any other application of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide or secure the user-facing features described in this policy.
12. International processing
Google, Apple, Porkbun and the provider used to deliver support email may process information outside the United Kingdom.
Where NikkiMail arranges a restricted transfer of personal information outside the United Kingdom, an applicable lawful transfer mechanism will be used where required.
Google, Apple and other independent providers describe their own international processing arrangements in their respective privacy policies.
13. Retention and deletion
Sign out
Signing out ends the active NikkiMail session. It does not delete the local Gmail-derived cache, revoke Google authorisation or remove Gmail filters previously created through NikkiMail.
Disconnect Google and delete NikkiMail data
Selecting “Disconnect Google & Delete NikkiMail Data”:
- immediately deletes NikkiMail’s account-scoped local analysis, history, blocked-sender, Trash, recovery and pending-deletion data;
- signs you out; and
- attempts to revoke NikkiMail’s Google authorisation.
Local deletion occurs even if Google’s remote revocation request cannot be completed. If revocation fails, you can remove NikkiMail through your Google Account’s third party access settings.
This action does not delete messages from Gmail. It also does not automatically remove filters already created in Gmail. Those filters must be removed through Gmail or through NikkiMail before disconnecting.
The device-local Terms acceptance record and free-cleanup counter are not Gmail-derived account data and are not removed by this action.
Deleting the application
Deleting NikkiMail ordinarily removes the application’s local container, Gmail-derived cache and device-local Terms acceptance record.
The free-cleanup counter stored in the iOS Keychain may remain after the application is deleted or reinstalled. This counter contains no Gmail or account information.
Provider data
Messages, Trash contents, labels, settings and filters stored by Google remain subject to your Google Account and Google’s retention rules.
Revoking NikkiMail’s permission prevents future access but does not reverse actions already completed in Gmail.
Support and website records
Support correspondence is retained only for as long as reasonably necessary to respond, maintain appropriate business records, establish or defend legal claims and comply with legal obligations.
Website security logs are retained by Porkbun in accordance with its operational and security policies and for no longer than reasonably necessary to deliver and protect the website.
Transaction and accounting records may be retained for the period required by applicable tax and accounting law.
14. Security
NikkiMail uses Google OAuth rather than requesting your Google password.
The app applies progressive permissions, account-scoped local storage, iOS Data Protection, backup exclusion, data minimisation, text-only previews, restricted unsubscribe networking and sanitised production errors.
No electronic storage or transmission method can be guaranteed to be completely secure. You should protect your device and connected accounts and promptly revoke access if you believe they have been compromised.
15. Your data protection rights
Depending on the circumstances and applicable law, you may have rights to:
- be informed about processing;
- request access to personal information we hold about you;
- request correction of inaccurate information;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive eligible information in a portable form; and
- withdraw consent where processing is actually based on consent.
Because NikkiMail does not hold a server-side copy of your mailbox, the most direct way to delete Gmail-derived information is usually the “Disconnect Google & Delete NikkiMail Data” control.
Requests concerning information held through support, website administration or service records may be sent to support@ab15mediatech.com. We may need to verify your identity before completing a request.
You may complain to the UK Information Commissioner’s Office through ico.org.uk. You may also contact the data protection authority in the country where you live where applicable.
16. Automated processing
NikkiMail uses rules, search results, sampling and estimates to rank potential cleanup opportunities.
NikkiMail does not use Gmail data to make solely automated decisions that produce legal or similarly significant effects about you.
You make the final decision whether to perform each mailbox action.
17. Children
NikkiMail is not intended for anyone who is unable to lawfully authorise access to the connected mailbox or agree to the Terms of Service.
We do not knowingly seek to collect children’s information for advertising or profiling.
18. Changes to this policy
We may update this Privacy Policy when NikkiMail, applicable law or third party requirements change.
The revised policy will show a new effective date. If a change materially affects how Google user data is accessed, used, stored or shared, we will provide appropriate notice and request additional agreement or permission where required before the new processing begins.
19. Contact
AB15 Media and Technology Limited
Registered office: 38 West Craigbank Crescent, Aberdeen AB15 9AU, United Kingdom.
Privacy questions, rights requests and complaints may be sent to support@ab15mediatech.com.