Heron
FR Download
Back to home

This document is being finalized: highlighted items are still to be completed.

Heron Privacy Policy

Version of 20 October 2026

1. Data controller

[DATA CONTROLLER — name or company, address]. Contact for any question or request about your data: contact@heronmailapp.com.

2. Data we keep

  • Your Heron account: name, email address, password (stored only as a non-reversible hash), app preferences, date you accepted the terms.
  • The mailboxes you add: address, display name, signature, IMAP/SMTP servers, username, and the mailbox password or Google / Microsoft authorization tokens. These secrets are encrypted (AES-256-GCM) before being stored and are only used to connect to your mailboxes.
  • An index of your messages (to display lists and notify you quickly): sender, recipients, subject, date, a short excerpt of the beginning of the text (about 200 characters), read / flagged state, whether it has attachments, folder and conversation identifiers. Full message bodies and attachments are not kept: they are read from your mail server when you open them.
  • Messages waiting to be sent (undo delay, scheduled send): full content and attachments, until they are sent or cancelled.
  • Snoozed messages: identifier, subject, original folder and reminder time.
  • An address book derived from your messages (names, addresses, number of exchanges), to suggest recipients.
  • Your devices: notification token, language and notification settings of each device.
  • Technical logs (IP address, requests, errors) for security and troubleshooting, kept for [PERIOD].

3. Why, and on what basis

This data is used only to provide the service you request (performance of a contract): syncing your mailboxes, sending your messages, notifying you, keeping your settings on all your devices. Technical logs rely on our legitimate interest in securing the service. We do not sell your data, show ads, or analyze the content of your messages for commercial purposes.

4. Third parties

  • Your email providers (Google, Microsoft, Apple, etc.), to which the service connects on your behalf.
  • Expo / Apple / Google to deliver push notifications to your phone (subject and sender of the notified message).
  • Gravatar and senders’ websites (or Google’s and DuckDuckGo’s icon services) to show a sender’s photo or logo: only the sender’s address (hashed, for Gravatar) or domain name is sent.
  • Our hosting provider: [HOSTING PROVIDER AND COUNTRY].

5. Remote images

By default, the app blocks images loaded from the Internet in emails, which are often used to track whether and when you opened a message. You can show them for one message, for a trusted sender, or always, in the settings.

6. Retention

Data is kept as long as your account exists. Removing a mailbox erases its credentials and index; deleting your account (Settings → Delete my account) immediately erases all of the data above, except technical logs, kept for [PERIOD]. Your email at your provider is never deleted by this operation.

7. Security

Traffic with the service is encrypted (HTTPS), mailbox passwords and access tokens are encrypted in the database, and server access is restricted.

8. Your rights

You can access, correct, delete or export your data, object to or restrict its processing by writing to contact@heronmailapp.com. You can also lodge a complaint with [SUPERVISORY AUTHORITY — e.g. the CNIL in France].

9. Changes

If this policy changes materially, the app will ask you to accept it again.