Privacy Policy

Last updated: March 2025

1. Controller

T. Stephan
Kookamp 40
46354 Südlohn
Germany
E-Mail: info@exoda.de
Phone: +49 171 3833568

2. Overview of data processing

Exoda Mail Manager (hereinafter "the app") is an email management application that runs on your device (macOS, iOS, or Android). The app processes email data exclusively locally on your device. There is no registration, no cloud storage, and no tracking.

3. What data is processed?

3.1 Email account credentials

To use the app you enter your IMAP/SMTP credentials (server address, port, username, and password). These credentials are stored exclusively locally on your device in a JSON file and are never transmitted to our servers or third parties (except to the respective IMAP/SMTP mail server to establish the connection).

3.2 Email content

The app retrieves emails from your configured mail servers via the IMAP protocol. The following data is processed:

• Sender (From header)
• Recipient (To header)
• Subject
• Email body (plain text or HTML content as plain text)
• Attachments (in particular PDF files for AI analysis)
• Email headers (Message-ID, date, MIME type)

This data is held temporarily in the app's working memory and is not stored permanently on your device (unless you use the backup function).

3.3 Rules and lists

Rules, blacklist entries, and whitelist entries you create are stored locally as a JSON file. These contain email addresses or sender names that you have entered yourself.

3.4 Logbook

The app keeps a logbook of processed emails. The following are stored:

• Time of processing
• Email account concerned
• Subject and sender of the email
• Result of processing (action, spam score, AI assessment)

This data is stored exclusively locally.

3.5 Settings

App settings (e.g. OpenAI API key, auto mode interval, sound settings) are stored locally on your device via the platform-specific settings manager (SharedPreferences / NSUserDefaults).

4. Sharing data with third parties

4.1 OpenAI API

The app uses the OpenAI API (model GPT-4.1-mini) for the following functions:

• Spam detection: analysis of email subject and content for spam characteristics
• Rule application: checking whether emails match the configured rules
• PDF analysis: evaluation of PDF attachments for fraudulent content

The following data is transmitted to OpenAI servers (USA):

• Subject and text content of the email (truncated to relevant sections)
• Sender and recipient address
• Text content of PDF attachments (extracted text)

Important note: OpenAI processes transmitted data in accordance with its own privacy policy. According to OpenAI, data sent via the API is not used to train AI models. Further information is available at: openai.com/policies/privacy-policy.

You must enter your own OpenAI API key in the app. This is stored locally and used only for authentication with the OpenAI API.

4.2 IMAP/SMTP mail servers

The app establishes encrypted connections (TLS/SSL) to the IMAP and SMTP servers you have configured in order to retrieve, move, delete, or forward emails. Data is transferred directly between your device and the mail server – without routing through our servers.

4.3 No other third-party services

The app uses no analytics services (no Google Analytics, no Firebase, no Crashlytics), no advertising networks, no social media plugins, and no other tracking technologies.

5. Storage and deletion

5.1 Storage locations

• Account data, rules, lists: Local JSON files in the app directory
• Logbook: Local JSON file in the app directory
• Settings: SharedPreferences (Android) / NSUserDefaults (macOS, iOS)
• Backup files: Storage location chosen by the user

5.2 Deletion

Uninstalling the app deletes all locally stored data. You can delete individual accounts, rules, and lists at any time within the app. The logbook can be cleared manually.

6. Data security

• All connections to mail servers use TLS/SSL-encrypted connections.
• Communication with the OpenAI API is via HTTPS.
• Credentials are stored locally in the protected app area of the operating system.
• No data is transmitted unencrypted over the internet.

7. Your rights

Since all data is processed exclusively locally on your device and we as developers have no access to your data, you can exercise your rights yourself:

• Right of access: All data is on your device and accessible to you.
• Right to erasure: Delete individual data in the app or uninstall the app completely.
• Right to data portability: Use the backup function to export your data as a JSON file.
• Right to object: You can disable AI analysis at any time by not providing an API key.

8. Transfer of data to third countries

By using the OpenAI API, email content is transferred to servers in the USA. OpenAI has committed to compliance with GDPR principles and offers corresponding standard contractual clauses. You can disable the AI function if you do not wish data to be transferred to the USA.

9. No automated decision-making

Although the app provides AI-assisted recommendations (e.g. spam scoring), all automatic actions are configured by you and can be reviewed, adjusted, or disabled at any time. The logbook provides full transparency on all actions taken.

10. App Store

If you download the app via the Apple App Store or Google Play Store, the respective privacy policies of Apple or Google additionally apply to the download and payment process. We do not receive any personal data about you from the app store.

11. Cookies and web tracking

This website uses no cookies and no web tracking. No personal data is collected by visiting this website.

12. Changes to this privacy policy

We reserve the right to update this privacy policy as needed to reflect changes in app functionality or legal requirements. The current version is always available on this page.

13. Contact

For questions about data protection, please contact:

T. Stephan
Kookamp 40
46354 Südlohn
Germany
E-Mail: info@exoda.de
Phone: +49 171 3833568