隐私政策 Privacy Policy
中文
一句话：Quire 没有自己的邮件服务器。你的邮件、令牌和密码只保存在你自己的设备与钥匙串里，开发者无法访问，也不会出售或用于广告。
1. 我们访问哪些数据
Quire 是一个邮件客户端，只在你主动添加账号后才会访问对应邮箱：
- Gmail（Google 账号）：邮件内容与元数据（发件人、收件人、主题、正文、附件、标签）、发送邮件、以及 “Send mail as” 别名列表，用于显示、搜索、归档、标记已读、回复和以别名发信。申请的权限：
gmail.modify、gmail.send、gmail.settings.basic、email。 - Outlook（Microsoft 账号）：邮件读写与发送、基本资料（
Mail.ReadWrite、Mail.Send、User.Read、offline_access）。 - QQ、Proton Mail（经本机 Bridge）及其他 IMAP/SMTP 邮箱：你提供的授权码或密码，仅用于连接对应邮箱服务器。
- 通讯录（可选）：如你授权，仅在本机读取联系人照片作为发件人头像，不上传。
2. 数据保存在哪里
- 邮件缓存：保存在你设备本地的数据库中，用于离线查看与全文搜索。不会同步到 iCloud，也不会上传到我们的服务器（我们没有此类服务器）。
- OAuth 令牌、授权码、密码、AI 服务 API Key：只保存在设备钥匙串中，并设置为不同步。
- 设置（分组、排序、短名、签名、通知偏好、AI 服务地址与模型名，以及你添加的邮箱地址列表）：可通过你自己的 iCloud 在你的设备间同步，由 Apple 托管；其中不含邮件内容、令牌、密码和 API Key。
3. 数据如何被使用与共享
- 数据仅用于在应用内向你提供邮件功能，不用于广告、画像或出售，不与第三方共享，除非下列你主动启用或不可避免的情形。
- 邮件服务商：应用从你的设备直接连接 Google、Microsoft 或你的 IMAP/SMTP 服务器。
- AI 功能（可选，默认关闭）：启用后，相关邮件内容会从你的设备直接发送到你自己配置的 AI 服务（如 Anthropic、OpenAI 或兼容网关），用于简报、摘要、回复草稿与问答。不经过我们的服务器。你可以将任意邮箱加入「不使用 AI」名单，其邮件不会被发送；Proton 默认在名单内。AI 服务商如何处理数据，取决于你选择的服务商及其政策。
- 发件人头像：为显示品牌头像，应用会向发件人域名自己的网站请求公开的图标文件（
/apple-touch-icon.png、/favicon.ico），并通过 Cloudflare 的 DNS-over-HTTPS 查询该域名的 BIMI 记录。这些请求包含发件人域名与你的网络地址，不包含邮件内容。 - 推送中转（可选，默认关闭）：仅当你自行配置了中转服务器时启用。中转只保存「邮箱地址 → 设备推送标识」的对应关系，用来通知设备“有新邮件”，不接触邮件内容。
- 不含任何统计分析、广告或第三方追踪组件。
4. Google 用户数据的使用与限制（Limited Use）
Quire 对从 Google API 获得的信息的使用与向任何其他应用的转移，将遵守 Google API Services User Data Policy，包括其中的 Limited Use 要求。具体而言：
- 仅将 Google 用户数据用于提供或改进面向用户的邮件功能；
- 不将其转让给第三方，除非为提供上述功能所必需、遵守法律或经你同意；
- 不将其用于投放广告，不出售；
- 不允许人员阅读你的邮件，除非你明确同意、为安全或法律所必需。（我们没有服务器，也没有任何途径读取你的邮件。）
- 不使用 Google 用户数据开发、改进或训练通用的人工智能或机器学习模型。你自行启用 AI 功能时，是你主动将所选邮件发送给你自己选择的服务商。
5. 你的选择与数据删除
- 在应用「设置 → 邮箱」中移除某个地址或账号，即删除其本地缓存与钥匙串中的令牌。
- 也可随时在 Google 账号权限页或 Microsoft 账号的应用权限页撤销 Quire 的访问。
- 删除应用即清除设备上的全部本地数据；iCloud 中的设置可在系统「iCloud 设置」中管理或删除。
6. 儿童
Quire 不面向 13 岁以下儿童，也不会有意收集其信息。
7. 变更与联系
政策更新会在本页公布并更新日期。问题或请求：[email protected]，或在 GitHub Issues 留言。
English
In short: Quire has no mail server. Your messages, tokens and passwords are stored only on your own device and Keychain. The developer cannot access them, and they are never sold or used for advertising.
1. Data we access
Quire is a mail client. It accesses a mailbox only after you add that account:
- Gmail (Google Account): message content and metadata (sender, recipients, subject, body, attachments, labels), sending mail, and the “Send mail as” alias list — used to display, search, archive, mark as read, reply, and send from an alias. Scopes requested:
gmail.modify,gmail.send,gmail.settings.basic,email. - Outlook (Microsoft account): read/write and send mail and basic profile (
Mail.ReadWrite,Mail.Send,User.Read,offline_access). - QQ, Proton Mail (via local Bridge) and other IMAP/SMTP mailboxes: the app password or authorization code you provide, used only to connect to that mail server.
- Contacts (optional): if you allow it, contact photos are read on-device to use as sender avatars. Nothing is uploaded.
2. Where data is stored
- Mail cache: a local database on your device for offline reading and full-text search. It is not synced to iCloud and not uploaded to any server of ours (we operate none).
- OAuth tokens, authorization codes, passwords, and AI-service API keys: only in the device Keychain, marked non-synchronizable.
- Settings (groups, order, short names, signatures, notification preferences, AI service URL/model names, and the list of mailbox addresses you added) may sync between your devices through your own iCloud, hosted by Apple. They do not include message content, tokens, passwords or API keys.
3. How data is used and shared
- Data is used only to provide mail features inside the app. It is not used for advertising or profiling, not sold, and not shared with third parties except as described below.
- Mail providers: the app connects directly from your device to Google, Microsoft, or your IMAP/SMTP server.
- AI features (optional, off by default): when enabled, relevant message content is sent directly from your device to the AI service you configure (e.g. Anthropic, OpenAI, or a compatible gateway) for briefings, summaries, reply drafts and Q&A. It does not pass through our servers. You can add any mailbox to a “no AI” list so its messages are never sent; Proton is on that list by default. How the provider handles data depends on the provider you choose.
- Sender avatars: to show brand avatars, the app requests publicly available icon files from the sender’s own domain (
/apple-touch-icon.png,/favicon.ico) and looks up the domain’s BIMI record through Cloudflare DNS-over-HTTPS. These requests reveal the sender’s domain and your network address, not message content. - Push relay (optional, off by default): only if you configure your own relay server. It stores just a mapping of mailbox address to device push identifier to signal “new mail”; it never sees message content.
- No analytics, advertising, or third-party tracking components are included.
4. Google user data — Limited Use disclosure
Quire’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide or improve user-facing mail features;
- it is not transferred to others except as necessary to provide those features, to comply with law, or with your consent;
- it is not used for serving advertisements and is not sold;
- humans do not read it unless you give explicit consent or it is required for security or legal reasons. (We operate no servers and have no way to read your mail.)
- Google user data is not used to develop, improve, or train generalized AI/ML models. When you enable AI features yourself, you are choosing to send selected messages to a provider of your choice.
5. Your choices and data deletion
- Removing an address or account in Settings → Mailboxes deletes its local cache and the tokens stored in the Keychain.
- You can revoke Quire’s access at any time from your Google Account permissions or your Microsoft account’s app permissions.
- Deleting the app removes all local data on the device; settings kept in iCloud can be managed or deleted in system iCloud settings.
6. Children
Quire is not directed to children under 13 and does not knowingly collect their information.
7. Changes and contact
Updates will be posted on this page with a new date. Questions or requests: [email protected], or open an issue on GitHub.