1. Scope and data controller
This policy covers WreMail for macOS and Windows, this website and support communications. WreMail is a WreCore product. The controller of personal data you send us for enquiries and user support is Paweł Paluszkiewicz, trading as wregionie.pl Paweł Paluszkiewicz, ul. Wisławy Szymborskiej 3, 59-970 Zawidów, Poland, tax ID PL6151977813, REGON 021500806. Contact: hello@wrecore.com.
WreMail connects directly to your chosen mail provider. WreCore does not operate an intermediary server storing your mailbox and does not automatically receive its contents. Your mail provider and, for work accounts, your organisation determine their own rules for processing email.
2. Email and information stored on your computer
The app accesses your account address, folder names, headers, senders and recipients, message contents, attachments and flags such as read or starred status. It uses this information to display, search, synchronise, compose, send and organise email. Server changes follow your actions or rules and automations you have enabled.
Local storage includes email copies, a search index, drafts, the sending queue, contacts and groups, events, tasks and their files, settings, signatures and appearance. The calendar and tasks are local features; connecting Google or Microsoft does not itself synchronise their calendars or address books.
This information remains on your device and in destinations you choose for exports or backups. Ordinary mailbox access does not require a separate WreCore account. The app contains no advertising or behavioural analytics tools.
3. Passwords, tokens and app lock
Account passwords, OAuth refresh tokens and your own AI API keys are kept in the operating system credential store. They are not included in profile exports or archives. Access tokens authenticate connections to your chosen provider.
The optional app lock protects access to the interface with a password, Touch ID on a supported Mac or an additional TOTP code. The lock password is verified using Argon2id. The interface lock does not encrypt mail files or the entire local database. Disk protection also depends on your operating system and user account security. Synchronisation and scheduled actions may continue in the background while the interface is locked.
4. Connecting Google and Gmail
When you choose a Google account, authentication takes place in your browser on Google's pages. WreMail requests openid, email and https://mail.google.com/. The first two identify the account and email address. Mail permission enables Gmail access through IMAP/SMTP, including reading messages and attachments, sending, changing folders and flags, and deleting messages in accordance with your actions. It does not grant access to Google Drive or Google Calendar.
Information obtained through Google APIs is used and transferred under the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data policy. It is used only for the user features described here. We do not sell this information or use it for advertising, advertising profiles or training general-purpose AI models. We do not allow human access except as permitted by those policies, such as your explicit permission for help with a specific issue or a legal or security requirement.
Gmail data may reach the recipient of an email, your export destination or your chosen AI provider only through a feature you initiate and subject to these restrictions. You can revoke access in your Google account connections settings.
5. Connecting Microsoft and Microsoft 365
OAuth authentication takes place on Microsoft's pages. WreMail uses openid, profile, email, offline_access, https://outlook.office.com/IMAP.AccessAsUser.All and https://outlook.office.com/SMTP.Send. These identify your account, maintain authorisation, enable reading and managing mail through IMAP, and sending through SMTP.
This connection does not grant Microsoft Graph calendar, contacts or files permissions. Protocol availability and required approvals depend on your provider and organisation's administrator. Revoke access through your Microsoft account permissions or your administrator. See the Microsoft Privacy Statement for the provider's practices.
6. Optional AI assistant
AI is off by default. If you configure it, you use your own API key and choose OpenAI or Anthropic. A request goes directly from the app to that provider only when you initiate an action. WreCore does not relay this transmission.
Depending on the action, the request may include the subject and text of the current email or draft, your instruction, the selected language and your conversation with the assistant. The panel lets you inspect the source before running the action. Attachments, images and the other messages in the thread are not automatically included in the request.
The provider also receives technical connection and API account information. Retention, access and possible processing outside the EEA depend on your agreement and account settings with that provider; we do not promise zero retention on its systems. Review OpenAI's policy or Anthropic's policy and the relevant API terms. The Google data restrictions above still apply. Disabling AI stops future actions but does not retrospectively delete data already sent to a provider.
7. Remote images and avatars
Remote email images are blocked by default. Loading them after your permission connects your computer to the image host and can disclose your IP address, opening time and any identifier in the image URL. Permission can apply to a message or sender and can be revoked. Additional tracking-pixel protection cannot detect every tracking technique.
If you enable Gravatar avatars, requests to Gravatar/Automattic include a hash derived from the email address and technical connection data including IP. This hash does not guarantee anonymity. You can turn the feature off in settings. See Automattic's privacy policy.
8. Backups, disconnecting accounts and deleting data
Exports and backups are saved to a destination you choose. A full backup can contain email and other local information; optional password encryption is available. WreMail does not provide its own cloud backup service. If you select a folder synchronised by another service, that service's policies also apply to the file.
Disconnect an account in WreMail settings. Removing an account deletes its configuration, related account data in the app and its stored credentials; it does not delete your provider account or server mailbox. You can separately revoke OAuth permission with Google or Microsoft. Revocation alone does not erase copies already downloaded.
Archives, exports, backups and separately saved files or message copies, including in tasks, need separate deletion. Remove AI keys in AI settings. Uninstalling the app may leave data and operating system credential entries behind. WreCore cannot remotely erase your local files or recover a lost encrypted-backup password.
9. Contact form, support and legal bases
When you email us, we receive your email address, signature information, message and attachments you choose to send. Do not send passwords, tokens, API keys or unnecessary email copies. We receive diagnostic material only when you share it with us.
The website form prepares a message in your browser and opens it in your chosen email application. It does not send the message to WreCore itself or store its fields on our server. We receive it only after you send it from your email application. Preparing an enquiry is not an order or marketing consent.
- Offer enquiries and contract-related support: GDPR Article 6(1)(b), steps before entering into or performing a contract.
- Other correspondence, security and necessary legal claims: Article 6(1)(f), our legitimate interests in communication and protecting our services and rights.
- Legal duties, such as responding to a valid rights request: Article 6(1)(c).
Providing contact details is voluntary, but without a reply address and question we may be unable to respond. We do not automatically subscribe correspondents to a newsletter. The website currently accepts no online payments and transfers no data to a payment operator.
10. Website, recipients and international processing
The website has no analytics or advertising tools and sets no tracking cookies of its own. It uses Google Fonts: your browser connects to Google's servers for styles and font files, disclosing information such as your IP address and technical headers. See Google's privacy policy.
When you visit the public website, the infrastructure serving its files may process IP addresses, dates, requested URLs, browser information and request results to deliver the site and prevent abuse. Our legal basis is legitimate interests under GDPR Article 6(1)(f). External fonts are used on the same basis. Our email and IT infrastructure providers process correspondence; authorised staff, advisers or legally entitled authorities may receive information where necessary. Recipients receive only what their tasks require.
Providers you select in the app, remote image hosts, Google Fonts and AI providers may process information outside the European Economic Area under their own terms. Where we entrust personal data to a recipient outside the EEA, we use a required transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with required safeguards. Contact us for information about such transfers and a copy of the relevant safeguards.
11. Retention
Local information remains in the app until you remove it or change its retention settings. Your provider and administrator manage server mailbox retention. The person creating an export or backup and any service storing it manage those copies.
We keep support correspondence for as long as needed to resolve the issue. Afterwards, we retain only what is necessary for a legal obligation or establishing, exercising or defending claims until the relevant period expires. Website technical data is needed during infrastructure operation and security analysis; incident-related material may remain until the incident and related claims are resolved. We do not extend retention for advertising.
12. Your rights and policy changes
Subject to GDPR conditions, you may request access to personal data processed by WreCore, a copy, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We do not make solely automated decisions producing legal effects about you or create advertising profiles.
Email hello@wrecore.com. We normally respond within one month and will explain any lawful extension. You may complain to the Polish President of the Personal Data Protection Office or the relevant supervisory authority in your country. Requests concerning data WreCore does not receive must be carried out on your device or with the relevant provider.
The current policy and its date are published here. We will notify you before a material change in data use takes effect and request separate consent or authorisation where required. Updating this text does not replace that consent. Product use is covered by the WreMail terms.
Questions? Email hello@wrecore.com.