Privacy notice
Effective 4 October 2026
Unison Mail is a personal email application for Mac, iPhone and iPad, operated by Punyashlok Bhakta. Contact: punyashlok@gmail.com.
Summary
- When the notification service is connected, a private server keeps an encrypted copy of your Gmail mail, up to 60 GB in total, so the apps can open and search mail quickly.
- The server holds an encrypted Gmail sign-in token for each Gmail account that uses notifications or Send Later.
- Read receipts, remote images and detailed notification previews are on by default. Each can be turned off in Settings.
- AI features run on your device. No mail is sent to an AI service.
- Data is not sold, used for advertising or used to train AI models. Unison contains no analytics, advertising or crash-reporting software.
Accounts and sign-in
| Provider | Access requested | Where the sign-in is kept |
|---|
| Gmail | Full Gmail access (https://mail.google.com/), which allows reading, organising, sending and permanently deleting mail, plus your email address. You enter your Google password with Google, not with Unison. | Device Keychain. For accounts with notifications or Send Later, an encrypted copy of the refresh token is also stored on the private server. |
| Google profile | Your email address and the Google Drive app-data folder (drive.appdata), which only Unison can read. Read once to carry over settings and mail state that earlier versions kept there. | Device Keychain. |
| Microsoft (Outlook) | Your profile, and permission to read, change and send mail. | Device Keychain only. The server does not handle Microsoft accounts. |
| iCloud Mail | An app-specific password you create with Apple. The device connects directly to Apple's mail servers. | Device Keychain only. |
Your mail stays with your provider. Unison stores mail, drafts and settings on your devices.
Private server
The private server is a Hostinger virtual server in Mumbai, India, at unison.parmci.com, run by the operator. It serves Gmail accounts only.
Mail cache
When the notification service is connected on a device (Settings, Connect notifications), the server keeps a copy of the mail of every Gmail account on that device:
- Full conversations, including headers, plain text and HTML, with no age limit. The first download skips Spam and Trash. After that, every conversation that changes is kept, including new spam and mail moved to Trash.
- Attachments from Inbox mail of the last 7 days, fetched in advance. Other attachments are fetched when you open them. Attachments over 8 MB as stored by Gmail (about 6 MB of file) and conversations over 16 MB are not kept.
- A search index stored as keyed hashes rather than readable words.
- Account addresses are stored as hashes. Conversation identifiers are stored as they are.
Cached mail is encrypted with AES-256-GCM. The cache is limited to 60 GB in total; when it is full, the conversations with the oldest latest message are removed first. Mail is otherwise kept without a time limit. Only your registered devices can read the cache.
Cached mail is deleted:
- for a conversation, when it is deleted in Gmail;
- for the whole account, when the service is disconnected (Disconnect service) on its last device or the account is removed from Unison.
Turning off new-mail alerts does not disconnect the service and does not delete cached mail.
If none of your devices contacts the server for 30 days, the server stops using the account. Cached mail then stays until the size limit removes it or you ask for its deletion.
Notifications
- The server checks each account for new mail every 2 seconds, or every 30 seconds while Gmail's change signals through Google Cloud Pub/Sub are arriving.
- For each device the server stores the Apple push token, notification preferences (including priority senders, per-sender choices and Screener allow and block lists) and sync checkpoints.
- Detailed previews, which show the sender, subject and first 180 characters, are on by default. On devices with Unison's notification extension the preview is encrypted, so Apple's push service sees only a generic alert. Otherwise Apple carries the preview text. The account address and message identifiers are always sent to Apple with the alert.
- Private previews in Settings replace the preview with a generic alert.
- Delivery records are kept for 30 days and notification acknowledgements for 90 days. A device that has not contacted the server for 30 days, or whose push token Apple reports as no longer valid, is removed.
Mail actions and settings
- Actions such as archive, label and read status can be queued on the server and applied to Gmail from there. A short history of mail changes, at most 30 days, lets your other devices update quickly.
- Your Unison settings profile, and your reminders, drafts and other mail state, are stored encrypted on the server. Older copies in Google Drive are read once to carry them over.
Send Later
When you schedule a message, the server stores its Gmail draft reference, the send time, your account address, an encrypted Gmail refresh token and an encrypted copy of the draft, including attachments, so your other devices can manage the schedule. The server sends the message at or after the chosen time, even with your devices offline. The token and draft copy are removed when the message is sent or the schedule is cancelled, and the job record 30 days later. Schedules created earlier through Google Apps Script continue there until they finish or are cancelled.
Read receipts
Read Receipt is on by default for new messages, replies and forwards. You can turn it off for one message in the composer or for all messages in Settings.
- A Gmail message with Read Receipt on is sent through the private server. The full message passes through the server and is sent through Gmail's mail server with your authorization, as one copy per recipient, each with its own small image. The message body is not stored.
- To and Cc stay visible to recipients. Bcc is removed from the delivered headers. A standard return-receipt request is also added.
- Gmail files every recipient copy in Sent. For accounts with the notification service connected, extra copies that nobody has replied to are moved to Trash a few minutes after sending. A copy is moved back to Sent if a reply arrives while it is still in Trash.
- The server stores the subject and recipients encrypted, and the times the image was requested: at most 200, with requests within one minute combined. It does not store IP addresses, location or browser details. IP addresses are used only in memory, to limit request rates.
- Image requests can be blocked, prefetched, cached or forwarded by mail services, so they are not proof that a person read the message. They identify the recipient copy, not necessarily the person viewing it.
- Receipt history for sent messages has no end date. It is kept until you delete it in Unison, or until the account is removed from Unison on its last device with the notification service connected. Receipts for messages that were never sent expire 180 days after their intended send time.
- Deleting a receipt in Unison erases its subject, recipients and times. A record that the receipt existed, and an encrypted per-recipient delivery record that prevents a copy being sent twice, remain until the account is removed.
Remote images
Remote images are on by default. Your device loads them directly from the sender's servers, which can tell the sender your IP address and when the message was opened. Hidden images, and images the message declares as 2 pixels or smaller, are removed before a message is shown. Tracking images that do not declare a size still load. You can turn remote images off in Settings.
Sync between your devices
- Settings: through the private server, as described above.
- Mail state, which includes drafts with their text, recipients and attachments, reminders, mail activity, and the subjects and recipients of messages sent with read receipts: through the private server, stored encrypted with AES-256-GCM as one record per item, at most 200 MB for each profile Google account. Each device reads only what changed since its last read. This needs Unison 4.50 or later and the private service connected on each device; a draft with more than about 20 MB of attachments stays on the device it was written on.
- Earlier versions kept mail state in the Google Drive app-data folder of your profile Google account, without Unison's own encryption. Each device reads those files until it has carried them over once, and no longer writes them. They are not deleted automatically; you can delete them in Google Drive under Settings, Manage apps, Unison Mail, Delete hidden app data.
AI features
Summaries, briefs, suggested replies and questions about your mail run on your device using Apple's on-device model. No mail is sent to an AI service, and nothing is used to train AI models. Unison is set to use Apple Private Cloud Compute for AI requests once Apple makes it available to the app. It will then be used automatically, without a separate setting. This notice will be updated before that change.
Contacts and calendar
- Contacts you allow Unison to read are used on your device to suggest names and addresses when you write.
- With calendar access, Unison reads your calendar on your device to show whether an invitation clashes and to suggest free times.
- Neither is sent to the private server.
Backups
- Backups you make in Unison (settings, snippets, signatures, account colours, custom splits and drafts) are stored in Unison's iCloud Drive folder, or wherever you save an exported copy.
- The server database (accounts, tokens, receipts, schedules, settings, reminders, drafts and other mail state, but not the mail cache) is copied daily into a snapshot encrypted with age. The key that decrypts these snapshots is kept only on the operator's Mac. Snapshots are kept on the server for 30 days. Copies are taken to the operator's Mac every six hours while it is awake and online, and are kept there until the operator deletes them.
- Hostinger makes weekly backups of the whole server: the database, the mail cache and the encryption key. A person with access to one of these backups could decrypt the stored tokens, cached mail and receipt details. Backups taken before 3 October 2026 can also contain the snapshot decryption key and an unencrypted copy of the database.
- Backups are not used unless the server is restored.
Logs
The server logs error codes and the route and duration of slow requests. It does not log message content, email addresses or IP addresses. Service logs are limited to 15 MB. The web server does not keep access logs.
Use and sharing
Data is used only to provide Unison's features. It is not sold or used for advertising, credit decisions or training AI models. Unison's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Services involved:
- Google: Gmail, sign-in, Google Drive app data and Cloud Pub/Sub.
- Microsoft: Outlook mail.
- Apple: iCloud Mail, push notifications, iCloud Drive and on-device AI.
- Hostinger: hosting of the private server.
Removal
- Removing an account from Unison on the last device with the notification service connected deletes the account's notification data, cached mail, settings profile, receipts, delivery records and scheduled jobs. Reminders, drafts and other mail state belong to your profile Google account: they are deleted with that account, for every mail account at once, and stay when another account is removed. Removing an account while the service is not connected deletes nothing on the server.
- If a Send Later message is still queued at that moment, its job and draft copy are kept until it is sent or cancelled and deleted 30 days later. The receipts, delivery records and a record of the account address used for Send Later are kept with no end date. Contact the operator to delete them.
- Disconnecting the service on the last device stops server checks and deletes the cached mail. Receipts, the settings profile, reminders, drafts and other mail state, and Send Later data stay while the account remains in Unison.
- The server does not withdraw your Google authorization. You can withdraw it at myaccount.google.com/permissions; that stops future use but does not delete data already stored.
- Google Drive mail-state files, backups, and device records used for Send Later remain after removal. Contact the operator to delete remaining server data and backup copies.
- Data on your devices stays until you remove the app or delete it in the app.
Security
Connections use HTTPS. Tokens, cached mail, receipt details, settings profiles, mail state (reminders, drafts and activity) and Send Later copies are encrypted on the server with AES-256-GCM. Some records are stored unencrypted: notification preferences (including priority senders, per-sender choices and Screener lists), account addresses in Send Later and mail-action records, conversation identifiers, and for mail state each record's time stamp, device identifier and size and each profile's record count, total size and last update. The encryption key is kept on the server, so a person with administrator access to the server could decrypt this data. No system can guarantee uninterrupted delivery or complete security.
Changes
This notice is updated when data handling changes. The effective date above shows the latest version.