Privacy Policy for 4Mail

Last updated: October 2026

1. Who is responsible

4Mail by robspace ("4Mail", "the App") is developed and published by Robert Poetzsch under the robspace brand.

Robert Poetzsch
Brückenstr. 8A
65719 Hofheim am Taunus
Germany
Email: support@robspace.de

This policy explains which data 4Mail processes, where it is kept and who can see it. It applies to 4Mail on iPhone, iPad and Mac.

2. Summary

• 4Mail is an email client for your Gmail account and, if you like, further IMAP accounts. The App fetches and sends your mail directly with Google or your mail provider. There is no robspace server that your mail passes through or is stored on.
• We (robspace) never see your mail, contacts, appointments or sign-in credentials. We have no technical way to.
• 4Mail contains no analytics, no advertising, no tracking, no crash-reporting SDKs and no third-party SDKs. It is built with Apple's frameworks; for IMAP it also uses Apple's open-source networking libraries (SwiftNIO), which only connect to your mail provider.
• Everything the App stores stays on your device, unless you pass something on yourself (for example an attachment or a PDF of a mail, section 3.5). When you sign out, 4Mail deletes the sign-in and mail data from this device; if you choose, you end 4Mail's access at Google for all devices (section 3.8).
• Optionally (default: off), 4Mail syncs your settings and ToDos between your devices through your private iCloud. Mail content, subjects and sign-in credentials never go to iCloud (section 12).
• AI summaries are created on the device with Apple Intelligence. Your mail does not leave the device for this.

3. Google user data

This section explains how 4Mail accesses, uses, stores and shares data from your Google Account.

3.1 Access

You sign in to 4Mail with your Google Account. Sign-in happens on Google's own sign-in page; you enter your Google password only there, 4Mail never sees it. Google then asks whether you allow 4Mail access.

4Mail requests exactly one permission: https://www.googleapis.com/auth/gmail.modify ("Read, compose, and send emails from your Gmail account"). This permission does not allow permanent deletion of mail; deleted mail goes to the Gmail trash. 4Mail does not request any other Google service (no Calendar, Drive, Contacts or profile scopes).

3.2 What 4Mail retrieves from Google

• Messages and conversations: headers (sender, recipients, subject, date, technical headers such as Delivered-To and List-Unsubscribe), message body, snippet, and attachments when you open a message or an attachment.
• Metadata: thread and message IDs, labels on a message, read state, change history (historyId) for syncing.
• Labels: names and counts (unread/total) of your Gmail labels.
• Sender identities: your "Send mail as" addresses with display name, reply-to address and signature (Gmail setting sendAs).
• Mailbox profile: your Gmail address and current sync position (users.getProfile).
• Search results: when you search, 4Mail sends your search terms to Gmail and receives the matching conversations.

3.3 How 4Mail uses this data

Only for the features you see and operate in the App:

• Showing, reading and searching your mail, sorted into boxes (by label or by the address it was sent to).
• Marking mail read/unread, archiving, moving to a box, applying labels, moving to trash or restoring from it. 4Mail sends these changes to Gmail.
• Writing, replying to and forwarding mail, including from one of your "Send mail as" addresses. Mail is sent through Gmail.
• ToDos: when you turn a mail into a ToDo, 4Mail creates the label "4Mail/ToDo" in your Gmail account (once) and applies it to that mail. Due date and note stay on the device.
• Counting on the device: unread mail per box, unanswered personal mail, newsletter bundles for the Briefing tab.
• AI summaries on the device (section 5).
• Local notifications about new mail (section 8).
• Unsubscribing from newsletters when you confirm it (section 9).
• Appointment suggestions from dates in mail, which you confirm in the calendar editor (section 7).
• Creating a PDF of a mail or conversation when you tap "Create PDF", to share or save it yourself (section 3.5).

4Mail does not use Google user data for advertising, for profiling, to train or improve AI or machine-learning models, or for any purpose other than the features listed above.

3.4 Where the data is stored

Only on your device, in the App's database (SwiftData) and a search index (SQLite) inside the App's own storage. On iPhone and iPad the folder is encrypted by iOS Data Protection (available after first unlock); on the Mac it is protected by the App sandbox and, if turned on, FileVault. The folder is excluded from device backups (iCloud Backup, Finder backup, Time Machine). Details are in section 4.

If you turn on iCloud sync, 4Mail also keeps settings, ToDos and identifiers (for example thread IDs of mail ToDos and Gmail label IDs) in your private iCloud database, but no mail content. Section 12 lists exactly what.

Google's sign-in key (refresh token) is kept in the device keychain with the "this device only" setting: it is not synced via iCloud Keychain and not included in device backups. The short-lived access token is held in memory only.

The connection to Google is encrypted (HTTPS) and uses no network cache.

3.5 Sharing

4Mail does not share Google user data with anyone: not with robspace, not with advertising networks, data brokers or any other third party. Data is never sold.

Data leaves the device only in these cases, each triggered by you:

• to Google, when 4Mail sends your changes, outgoing mail or search requests to Gmail;
• to your private iCloud database at Apple, if you turn on iCloud sync: only the settings, ToDos and identifiers listed in section 12, no mail content. Only you have access through your Apple Account; robspace cannot see this database;
• to the newsletter sender, when you confirm an unsubscribe (section 9);
• to Apple Calendar on your device, when you save an appointment suggestion in the calendar editor (section 7). What then happens to the event depends on the calendar account you pick there;
• to apps, people or places you choose in the share sheet when you open, share or save an attachment;
• to apps, people or places you choose when you create a PDF of a mail (see below).

PDF of a mail: In a mail, "…" → "Create PDF" (on the Mac also File → "Export as PDF…") turns the open mail or the whole conversation into a PDF. The PDF is created on the device; no robspace or other server is involved. It contains what the reader shows: subject (also as the PDF title), sender, recipients (To, Cc; never Bcc), date, message text, links and inline images; attachments are only listed by name, not included. Images from the internet appear only for mail whose images the reader loads (section 10); for the PDF 4Mail loads them again directly from the sender's servers. The PDF leaves the device only when you tap the share button and pick a destination in the system share sheet (for example Files, AirDrop, Mail, Messages or another app), or on the Mac save it with "Save…" to a place you choose. 4Mail picks no recipient and sends the PDF nowhere by itself. From then on, the app, service or person you chose holds a copy, under their own terms; a copy you saved on the Mac stays there until you delete it. The temporary file in the App is deleted when you close the PDF view, at the next launch and when you sign out (section 4).

3.6 No human reads your data

Nobody at robspace reads your mail or other Google data. We have no access to it. If you forward a mail to us for support yourself, we see only what you send.

3.7 Limited Use

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Sources: Google Workspace API User Data and Developer Policy, Google API Services User Data Policy.

3.8 Revoking access and deleting data

• Sign out on this device: Settings → Sign out → "Sign out, keep own ToDos" or "Sign out and delete own ToDos", or Settings → Accounts → "Remove account". 4Mail deletes the sign-in key and the mail data from this device (section 6). It deliberately does not revoke access at Google: Google's revocation applies to the whole Google Account and would sign 4Mail out on your other devices too.
• End access on all devices: Settings → Sign out → "Sign out and end access on all devices". 4Mail signs out on this device and revokes its access at Google (oauth2.googleapis.com/revoke); 4Mail is then signed out on every iPhone, iPad and Mac with this Google Account. If you are offline, 4Mail remembers the revocation and completes it once the device is online again (it is dropped if you sign in again before that).
• At Google: at any time at https://myaccount.google.com/permissions → 4Mail by robspace → remove access. 4Mail can then no longer access your mailbox on any device; delete the data on the devices by signing out or deleting the App. This is also where you remove a grant that was given only partly at sign-in (for example with the Gmail checkbox cleared): 4Mail discards such a sign-in on the device but does not revoke it itself.
• Deleting the App: On iPhone and iPad, iOS deletes all of the App's data on the device, including settings. On the Mac, the data stays in the App's container (~/Library/Containers/RobEarth.-Mail) until you remove it. The system does not always remove the keychain entry, so sign out in the App or revoke access at Google before deleting.
• iCloud: delete data in your iCloud in 4Mail under Settings → iCloud → "Delete data from iCloud…" (section 12).

4. What 4Mail stores on the device

Account markers (in the mail folder, excluded from device backups): sender addresses you marked as important; senders for which you chose "no reply needed" (with a count); own addresses you excluded from the Briefing; sender addresses whose images you chose to always load ("Trusted senders"); dismissed "reply due" hints (thread ID and date of the last message); dismissed appointment suggestions and the link "appointment created from this mail" (thread ID to event ID); identifiers of messages already notified (so no notification comes twice); your recent search terms.

General settings (UserDefaults): your choices for Briefing times and content, AI on/off, notifications, calendar suggestions, default ToDo due time and view, layout, what to show after archiving, the App version last shown in "What's New", whether iCloud sync is on and for which areas, plus the list of newsletters you unsubscribed from via 4Mail and the name the Briefing greets you with (both deleted when you sign out). No sender addresses or mail content are stored here.

Share log: Under Settings → iCloud → Sync details you can pass on the sync log as text with "Share log" through the share sheet, for example to our support. This happens only when you trigger it, and only to the recipient you choose. The text contains only what the "Sync log" row above lists, no mail content, addresses or subjects. 4Mail never sends the log on its own.

Sync log, action records and backup copies live in the mail folder and are deleted with it when you sign out. Removing a single account also deletes the backup copies, because they may contain that account's data.

5. Summaries with Apple Intelligence

If Apple Intelligence is available on your device and turned on in 4Mail (Settings → Briefing & AI), 4Mail lets the on-device language model (Apple Foundation Models) summarise individual messages and assess whether a reply is expected and whether a reply deadline is mentioned. In doing so:

• Only the on-device model is used, not Apple's Private Cloud Compute or any other server. The message text does not leave the device.
• 4Mail does not send mail content to Apple as feedback and does not train any model.
• Numbers in the Briefing (open replies, ToDos, appointments, newsletters) are counted by 4Mail itself, without AI.
• Results are kept in the cache (section 4) and deleted with the message or when you sign out.
• AI can be wrong. Every line in the Briefing links to its source.

You can turn the AI features off at any time; the Briefing then keeps counting without AI.

6. Signing out: what is deleted and what stays

When you sign out (Settings → Sign out), 4Mail deletes the sign-in key from this device's keychain and deletes from the device: both App databases with all mail data and mail ToDos, the search index, the Briefing, the label list, opened attachments and PDFs, the sync log, the list of unsubscribed newsletters, recent search terms, network and web caches, all account markers (section 4), the iCloud sync state, the greeting setting and this device's iCloud switches, and resets the app icon badge. Access at Google is revoked only with "Sign out and end access on all devices" (section 3.8).

Only the general settings without reference to mail (section 4) are kept. Own ToDos without a mail are kept only if you choose so when signing out.

Signing out does not delete data in your iCloud, so your other devices keep it. To remove it, use Settings → iCloud → "Delete data from iCloud…" before signing out (section 12).

7. Calendar

For the Agenda (appointments next to mail and ToDos), 4Mail asks for access to your calendars. If you grant it, 4Mail reads your appointments on the device only; they are not transferred anywhere. 4Mail does not change existing appointments.

If 4Mail recognises a date in a mail, it can suggest an appointment. It is saved only if you confirm it: on iPhone and iPad in Apple's calendar editor, on the Mac in a 4Mail event form. There you also pick the calendar. If that calendar belongs to an online service (for example iCloud or Google Calendar), the system syncs the event there under that service's rules.

You can withdraw calendar access at any time in iOS Settings.

8. Notifications and background refresh

4Mail checks for new mail in the background when iOS or macOS allows it. There is no robspace push server (if iCloud sync is on, Apple's iCloud tells the device with a silent notification that settings or ToDos have changed): notifications about new mail, the morning/evening Briefing and the "please sign in again" notice are created locally on the device with Apple's notification system.

For each box you choose whether notifications appear and whether they show a preview (sender, subject, recipient address). With preview, these details may be visible on the lock screen, depending on your iOS settings. Without preview, the notification only says "New mail in …".

Pre-computing AI summaries in the background only runs while the device is charging.

9. Unsubscribing from newsletters

If a newsletter offers an unsubscribe option (List-Unsubscribe header), 4Mail shows a button for it. Unsubscribing happens only after you confirm in a dialog that names the destination:

• One-click unsubscribe (RFC 8058): 4Mail sends a single request to the address the sender provided. It contains only List-Unsubscribe=One-Click, no cookies and no data from your account. As with any web request, the sender's server sees your IP address. 4Mail offers this only if the mail carries a DKIM signature matching the sender, and refuses destinations on a local network.
• Unsubscribe by email: 4Mail opens a pre-filled message to the given address in its own editor. You check it and send it yourself through your Gmail account.
• Unsubscribe on a web page: 4Mail opens the page in a browser (on iPhone and iPad in a Safari view inside the App); whatever you enter there goes to the operator of that page.

The sender's own privacy policy applies to processing on their side.

10. Images and links in mail

Images and other content a mail would load from the internet (for example tracking pixels) are blocked by default. Scripts in mail never run. If you tap "Load images" on a mail, 4Mail loads that mail's images from the sender's servers; they then see your IP address and the time, and tracking pixels reveal that you opened the mail.

With "Always load from …" you add a sender address to your list of trusted senders (exact address, not a whole domain; manage under Settings → Reading → Trusted senders). For mail from these senders 4Mail then loads images automatically, directly from their servers, with no server in between; these senders therefore learn when you open each of their mails. Images load automatically only if your own mail provider confirmed the sender (DMARC pass, or SPF/DKIM aligned with the sender's domain, read from the mail's Authentication-Results headers). 4Mail stores the result of this check per mail on the device only. If a sender is not confirmed, images stay blocked ("Sender not confirmed – images blocked") and you can load them once with "Load images anyway". The list is kept with your account markers (section 4), deleted when you sign out, and goes to iCloud only as checksums if iCloud sync is on (section 12).

4Mail opens links in mail only after asking you and showing the destination, and then in your browser. The privacy policy of that website applies there.

In Settings, 4Mail also links to the community page on github.com ("Community & Feedback"), this website and, for iCloud Mail, Apple's pages on app-specific passwords (account.apple.com, support.apple.com). A tap opens the page in your browser; the App itself sends nothing.

11. Demo without an account

In demo mode ("Take a look first – demo without account"), 4Mail shows invented sample mail. There is no connection to Google, and demo data is held in memory only.

12. iCloud sync (optional)

iCloud sync is off by default. You turn it on under Settings → iCloud and choose there which areas are synced. 4Mail then keeps the data listed below in the private CloudKit database of your Apple Account, so your other devices with the same Apple Account and the same Gmail account can pick it up. There is no robspace server involved; robspace has no access to your private iCloud database.

What may be in your iCloud (depending on the areas you choose):

• Boxes: kind, Gmail label ID, your own name, order, size, colour, symbol, default sender, notification and ToDo settings; saved searches with your search text (people in them only as a checksum, without names).
• Addresses: nickname, initials and colour of your own addresses.
• ToDos: own ToDos in full (title, note, due date, state). For ToDos from mail only the mail's thread ID, due date, your note, state and a title you typed yourself, never the subject.
• Briefing and settings: times, content, AI on/off, greeting name, ToDo defaults; important senders, "no reply needed", excluded own addresses and trusted senders for images (all only as checksums); dismissed reply hints (thread ID and date of the last message).

Email addresses (yours and senders') and the account itself appear in iCloud only as a checksum (HMAC-SHA256 with a random key kept only in your private iCloud database). The address cannot be computed back from the checksum.

What never goes to iCloud: sign-in credentials and tokens, message bodies, subjects, snippets, attachments, sender names, addresses in plain text, AI summaries, Briefings, the search index and the Gmail sync position.

Clock: If your device's clock differs from iCloud's servers by more than five minutes, 4Mail stamps changes with iCloud's time so that syncing between devices keeps the right order. The measured difference is recorded in the sync log.

Encryption: 4Mail stores the content of every record in CloudKit fields that are encrypted on the device (encryptedValues). If you turned on Advanced Data Protection for your Apple Account, only you hold the keys; without it, Apple holds the keys and the data is encrypted in transit and on Apple's servers. CloudKit does not separately encrypt the technical names of records and zones (for example a Gmail label ID, a thread ID or a checksum). Apple's privacy policy applies to iCloud.

Turning off and deleting: under Settings → iCloud you can turn sync off and keep or delete the data in iCloud. "Delete data from iCloud…" removes either this account's data or everything of 4Mail from your iCloud. The data on your devices stays; other devices keep their own copy. Signing out does not delete iCloud data (section 6).

13. Other mail providers (IMAP)

Besides Gmail you can add accounts of other providers that offer IMAP and SMTP (for example iCloud Mail, GMX, web.de, T-Online, Posteo, mailbox.org). Gmail and Google Workspace can be connected this way too, with an app password you create in your Google Account (only with 2-Step Verification; for Workspace only if your admin allows it). This uses no Google programming interface and no Google permission, only the standard servers imap.gmail.com and smtp.gmail.com; 4Mail never asks for your actual Google password. Outlook.com, Hotmail and Microsoft 365 are connected with "Sign in with Microsoft" (section 14). Proton Mail is not supported. Section 3 (Google user data) applies to Gmail accounts you connect with "Sign in with Google"; this section applies to IMAP accounts, including Gmail with an app password. The commitments in sections 3.3–3.6 (no sharing, no sale, no advertising, no AI training, no human reading) apply to IMAP accounts in the same way.

• Connection: 4Mail connects directly to your provider's servers, always encrypted (TLS 1.2 or later, or mandatory STARTTLS). If a server offers no encryption or it fails, 4Mail stops; there is no fallback to unencrypted connections and no "accept the certificate anyway". No robspace server is involved.
• Password: Your password (for iCloud Mail an app-specific password, for Gmail and Google Workspace a Google app password) is kept only in this device's keychain with the "this device only" setting: never in iCloud Keychain, never in device backups, never in iCloud sync. You enter it yourself on each further device.
• Setup (autoconfiguration): To find the server addresses, 4Mail first uses a built-in table of known providers (compiled from their official help pages). If your domain is not listed, 4Mail looks up your domain's mail server record (MX) in DNS; if it belongs to a provider in the table, 4Mail uses that provider's servers. Otherwise 4Mail requests the configuration file from your domain's provider (https://autoconfig.<domain>/… and https://<domain>/.well-known/autoconfig/…) and then the domain's DNS SRV records. Only the domain of your address (the part after "@") and, as with any request, your IP address go to the domain's server or your DNS server; no credentials, no cookies. 4Mail does not query any central provider database on the internet, and shows server addresses taken from DNS SRV records only as a suggestion for you to confirm. You can also enter the servers yourself.
• What 4Mail retrieves and stores: folders, headers, message bodies and attachments as with Gmail (sections 3.2–3.4 and 4 apply accordingly): in the App's cache, a search index and an index file per account, all in the device's mail folder, encrypted and excluded from device backups. The account list (address, display name, servers, user name, chosen archive folder, no password) is kept there too.
• What 4Mail changes on the server: read/unread and flagged (IMAP flags), moving to folders, archive and trash, and for ToDos the IMAP keyword $ToDo on the message. Mail is sent through your provider's SMTP server; 4Mail puts a copy in your Sent folder if the provider does not do so itself. When you search, 4Mail may send the search to your provider's server.
• Removing an IMAP account (Settings → Accounts → "Remove account"): 4Mail deletes the password from the keychain and all of this account's data from the device (cache, search index, index file, entry in the account list). The mail on the server stays unchanged.
• iCloud sync: Section 12 applies to IMAP accounts accordingly, with a separate area per account (named after the checksum of the address). Instead of a Gmail label ID, boxes carry the name of the IMAP folder; server settings and passwords are never synced.

Your mail provider's privacy policy applies to processing on their side.

14. Microsoft accounts (Outlook.com, Hotmail, Live, MSN, Microsoft 365)

You connect Microsoft accounts with "Sign in with Microsoft". You enter a password only on Microsoft's own sign-in page; 4Mail never sees it.

• Sign-in: OAuth 2.0 with PKCE via login.microsoftonline.com, without a Microsoft SDK and without a robspace server. 4Mail requests these permissions: read and change mail over IMAP (IMAP.AccessAsUser.All), send mail over SMTP (SMTP.Send), lasting access (offline_access), plus openid, email and profile. From the sign-in, 4Mail keeps only your email address and your organisation's identifier (for work and school accounts) to pick the right servers. For work or school accounts, your administrator may have to approve 4Mail first.
• Connection: 4Mail fetches and changes mail over IMAP at outlook.office365.com and sends over SMTP via smtp-mail.outlook.com (personal accounts) or smtp.office365.com (Microsoft 365), always encrypted and directly from the device.
• Sign-in key: 4Mail stores the lasting key (refresh token) only in this device's keychain with the "this device only" setting: never in iCloud Keychain, never in device backups, never in iCloud sync. The short-lived access token is held in memory only.
• What 4Mail retrieves, stores and changes on the server: as for IMAP accounts (section 13): folders, headers, message bodies and attachments only on the device; changes (read, move, archive, trash, $ToDo) on Microsoft's server. The commitments in sections 3.3–3.6 apply in the same way.
• Recipient: Microsoft as your mail provider. Microsoft's privacy statement applies.
• Removal and revocation: Settings → Accounts → "Remove account" deletes the sign-in key and all of the account's data from the device. You revoke access at Microsoft yourself: for personal accounts at https://account.live.com/consent/Manage, for work and school accounts through your account's app overview or your administrator.

15. No analytics, no advertising, no third parties

4Mail contains no analytics, tracking, advertising or crash-reporting SDKs. Apart from Apple's frameworks, the App contains only Apple's open-source libraries SwiftNIO (swift-nio, swift-nio-ssl, swift-nio-transport-services, swift-nio-imap) plus swift-collections, swift-atomics and swift-system for IMAP and SMTP; they send no data to third parties. 4Mail does not track you across other companies' apps or websites and does not use the advertising identifier.

Independently of 4Mail, Apple provides app developers with crash reports and usage statistics if you agreed in the system settings to "Share with App Developers" (iPhone/iPad: Settings → Privacy & Security → Analytics & Improvements; Mac: System Settings → Privacy & Security → Analytics & Improvements). You control this there.

16. Legal bases and your rights

robspace does not collect personal data through 4Mail on its own systems. Processing in the App takes place on your device, under your control and at your instruction (Art. 6(1)(b) GDPR: providing the features you use). Google's privacy policy applies to your Google Account, your mail provider's to IMAP accounts, Microsoft's to Microsoft accounts, Apple's to the App Store.

If you write to support@robspace.de, we process your message to answer it (Art. 6(1)(b) or (f) GDPR) and delete it once it is resolved and no retention obligation applies.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information. Because we receive no data from the App, you can exercise most of these rights directly in the App (sign out, delete).

17. Children

4Mail is not directed at children. The age limits of your Google Account apply to sign-in.

18. Changes

If we change this policy, we update this page and the date above. If 4Mail is ever to access or use Google data in a way not described here, the App will ask for your consent first.

19. Contact

Privacy questions: support@robspace.de