LetterRayPrivacy Policy
LetterRay is a mail client with server-side sync: you connect your mailboxes and the app shows them on every device. To do that we have to process your mail. This page explains what we collect, why, where it is stored and how to delete it.
1. Who processes your data
The data controller is Evgeny Anisimov, sole proprietor (Russian Federation), the operator of LetterRay (website letterray.com, app letterray.app). Privacy contact: support@letterray.app.
2. What we process
| Data | Purpose | Retention |
|---|---|---|
| LetterRay account email, name and password | Sign-in, email verification, password recovery | While the account exists. The password is stored only as an argon2id hash |
| Mailbox credentials: address, IMAP/SMTP servers, password or app password, OAuth tokens | Receiving and sending your mail on your behalf | While the mailbox is connected. Stored encrypted (AES-256-GCM) |
| Messages of connected mailboxes: headers, senders and recipients, subjects, bodies, attachments | Showing mail on every device, search, new-mail notifications | A window of recent mail: up to one year depending on the plan, and never fewer than a few hundred messages per folder. Bodies not opened for a month are removed from the server and fetched again on demand. Older mail is fetched on request and removed after 7 days without access |
| Address book: addresses and names you have corresponded with | Recipient suggestions while composing | While the account exists |
| Devices and sessions: device name, platform, last activity, push notification tokens | Multi-device sign-in, notification delivery, remote sign-out | Sessions expire after 60 days of inactivity; tokens live while the device is subscribed |
| Settings: theme, language, signature, muted senders | Syncing settings across devices | While the account exists |
| Usage events: sign-up, mailbox added, plan screens shown, payments, sync paused | Understanding how the service is used and accounting for subscriptions. First-party service records; with visitor consent, selected events are also sent to Yandex Metrica to measure advertising | While the account exists |
| Subscription data: plan, term, payment amounts and statuses | Providing paid features and accounting | Financial records are kept for the periods required by law, including after account deletion |
We never see card details: payments are handled by a payment provider and we receive only the amount, status and payment identifier. We do not read your correspondence and do not use it for advertising or for training models. Remote images in messages are not loaded by default, so senders cannot track opens.
3. Where data is stored
LetterRay servers and the database are located in the Russian Federation. Database backups are made daily and kept for 14 days; after account deletion the data disappears from backups once that period passes.
4. Who receives data
- Your mail providers (Google, Microsoft, Yandex, Mail.ru and others): we connect to their servers over IMAP and SMTP on your behalf.
- Notification services: Apple Push Notification service, Firebase Cloud Messaging (Google) and browser push services. A new-mail notification carries the sender name and the subject.
- Postmark (ActiveCampaign, USA): delivery of verification codes and password reset links. Only your email address is transferred.
- The payment provider when you subscribe: your email address and the payment amount.
We do not sell data. Correspondence is not shared with analytics or advertising systems. Data may be disclosed under a lawful request from public authorities.
5. Your rights and controls
- Name, settings and connected mailboxes can be viewed and changed in the app.
- Disconnect a mailbox: Settings → Mailboxes. Its messages and credentials are removed from the server immediately.
- Delete the whole account: Settings → Account → Delete account. All mailboxes, messages, contacts, devices and settings are removed. Mail at your providers stays untouched.
- Sign out another device: Settings → Devices.
- Request a copy of your data or ask a question: support@letterray.app. We answer within 30 days.
6. Security
Connections to the app and to mail servers are protected with TLS. Account passwords are hashed, mailbox passwords and tokens are encrypted, session tokens are hashed. Every device gets its own session that can be revoked separately. Server access is restricted.
7. Cookies and analytics
With your consent, the website and web app use Yandex Metrica (Yandex LLC, Russia). It receives browser and connection data, cookie identifiers, advertising tags, public page visits and events: downloads, opening the app or subscription page, registration, email verification, mailbox connection, checkout and confirmed payment amounts. Emails, names, email addresses, passwords and card details are not sent. Session Replay and automatic form recording are disabled. The counter is isolated from the mail interface. Use the Analytics button to change your choice; declining does not limit the service. Declining stops new collection; existing cookies can be removed in your browser settings. See Yandex privacy policy. Metrica is not loaded without consent. The sign-in token is kept in the browser's or app's local storage only so you do not have to enter the password every time.
8. Children
The service is not intended for anyone under 16. If you learn that a child has created an account, write to us and we will delete the data.
9. Changes
We will announce material changes to this policy in the app or by email in advance. The current version is always available on this page.