Privacy promise

Last updated: May 5, 2026

Vela is an iOS email client. It connects directly to your mail provider — Gmail, Microsoft Outlook, Apple iCloud Mail, or any standards-compliant IMAP / SMTP server. Vela does not operate mail servers. Your mail does not touch a Vela machine. This document explains what data Vela accesses, where it goes, and the commitments we make about it.

1. The short version

• Mail is stored on your device, encrypted at rest.
• Vela has no servers that hold your mail.
• We do not sell, share, or transmit your mail to any third party.
• We do not use your mail for advertising, profiling, or training machine learning models.
• AI features run on your device. We don't have an AI relay; nothing about your mail is sent to OpenAI, Anthropic, or any other AI provider.
• You can delete every byte by signing out or deleting the app.

2. Google API services — Limited Use disclosure

Vela uses Google APIs to access your Gmail mailbox when you choose to connect a Gmail account. Vela's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Scopes Vela requests, and why

When you connect a Gmail account, Vela requests these specific OAuth scopes:

• https://www.googleapis.com/auth/gmail.modify — to read your messages so they can be displayed in the app, and to modify message labels (mark as read, archive, star, move to folder, delete) on your behalf when you act on a message in Vela.
• https://www.googleapis.com/auth/gmail.send — to send messages on your behalf when you compose and send mail in Vela.
• openid + email + profile — to identify your account during sign-in and display your email address in the account picker. No directory or contact data is requested.

Vela does not request any scope it doesn't actively use. We do not ask for gmail.readonly, gmail.compose, gmail.metadata, or any administrative or directory scopes.

4. What data leaves your device

Mail content does not leave your device. The exceptions are narrow and listed in full here:

• Direct provider sync. When Vela fetches new mail or sends a message, it talks directly to Gmail, Microsoft Graph, IMAP, or SMTP. Nothing routes through Vela's infrastructure.
• Apple iCloud backup. If you have iCloud Backup enabled in iOS Settings, Apple may include Vela's encrypted local data in your iCloud backup. This is governed by Apple's privacy policy, not Vela's.
• Apple StoreKit. Subscription receipts for Vela+ go to Apple as part of in-app purchase. No mail content; just subscription status.
• Apple Push Notification service (APNs). If you opt in to new-mail notifications, a small push payload (sender, subject, account ID — never message body) is sent to APNs by your mail provider so iOS can show the notification.

5. What never leaves your device

• The full text of any email message you've received or sent.
• OAuth tokens, app passwords, or any other authentication material — these live in the iOS Keychain, encrypted by the system.
• Your full message archive, search index, and cached attachments.
• Drafts you've started but not sent (drafts may sync back to your provider's drafts folder if you've connected an account; see Section 6).
• AI summaries, smart-reply suggestions, and tone-meter scores. These are computed on your device using Apple's Foundation Models on iOS 18+ or local heuristics on older devices.

6. Drafts round-trip

Vela mirrors drafts to your mail provider's drafts folder so a draft you started on iPhone shows up in the provider's web UI. This sync uses the same direct connection as inbound mail — drafts go straight from your device to your provider, not through Vela.

7. AI features

Vela+ unlocks an on-device AI that produces a one-line summary of each thread, three smart-reply suggestions, and a tone score for drafts you're composing. On iOS 18 and later this uses Apple's Foundation Models, which run entirely on the device. On earlier iOS versions, Vela falls back to local heuristics. Vela does not transmit any thread content, draft text, or summary to a remote AI service, Vela's servers, or any third party.

8. Aliases & Hide My Email

When you mint an alias on an iCloud account, the alias is created through Apple's Hide My Email service via your Sign in with Apple flow. Apple is the controller of those aliases. For non-iCloud accounts, Vela uses plus-addressing (you+token@yourdomain.com) which is a property of your own mailbox and is not handled by Vela.

9. Tasks & calendar sync

Vela+ users can opt in to two-way sync with Apple Reminders and Apple Calendar. Sync uses Apple's EventKit framework, which exposes your reminders and events to Vela locally. Tasks and events created in Vela are written into Apple's stores; existing reminders and events are read from them. Vela does not transmit this data anywhere.

10. Diagnostics & analytics

Vela does not include any third-party analytics SDK (no Google Analytics, Mixpanel, Segment, Sentry, or Firebase Analytics). The app does not track your usage, retain device identifiers, or report crashes to any third party.

On-device diagnostics — message counts, last sync timestamp, errors — are visible to you in Settings → Diagnostics. They are not transmitted anywhere.

11. Children

Vela is rated 4+ and is not directed at children. We do not knowingly collect any personal information from anyone, including children under 13. The App Store enforces age-rating compliance.

12. Subscription billing

Vela+ subscriptions are managed by Apple's App Store. Apple receives and processes payment information; Vela does not. Apple notifies the app of your current entitlement (Free / Vela+) via StoreKit. Refunds and cancellations are handled through your Apple ID.

13. Account deletion

You can disconnect any mail account at any time in Settings → Accounts. Doing so removes all local mail for that account, deletes its OAuth tokens or app password, and stops all sync. Deleting Vela from your device removes the entire local store. Either action is immediate; nothing is retained on Vela's side because nothing was ever stored on Vela's side.

14. Changes to this policy

If we materially change how Vela handles your data, we will update this page and bump the "Last updated" date at the top. For non-trivial changes we will surface a notice inside the app.

15. Contact

Questions about this policy or about how Vela handles your data: support@velamail.app.