Privacy Policy

1.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

• Account Information: Email address for OAuth authentication (Gmail, Outlook, etc.)
• Encrypted Email Content: Encrypted messages you send and receive through Haamly (we cannot read these)
• Encrypted Metadata: Encrypted subject lines, sender addresses, and recipient addresses (we cannot read these)
• Contact Approvals: Your list of approved and pending contacts (stored encrypted)
• Subscription Preferences: Your mailing list subscription choices
• Cryptographic Keys: Public keys for end-to-end encryption (stored on our servers), private keys (stored only on your devices)
• Support Communications: Information you provide when contacting customer support via bug reports

1.2 Automatically Collected Information

We automatically collect certain information when you use the Service:

• Usage Data: Login timestamps, features used, and interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Server logs, error reports, and performance data
• Cookies: Session cookies for authentication and functionality

1.3 Third-Party Service Data

When you connect third-party email services (Gmail, Outlook), we collect OAuth tokens and access permissions necessary to provide the Service. We do not store your third-party service passwords.

3.1 Encryption

Haamly implements end-to-end encryption for messages between Haamly users:

• AES-256-GCM Encryption: Each message encrypted with a unique random key
• X3DH Key Exchange: Establishes secure channels with forward secrecy
• RSA-OAEP Key Wrapping: Per-recipient key wrapping for multi-device support
• Zero-Knowledge Metadata: Message content, subject lines, sender, and recipient information are encrypted on your device before reaching our servers
• Blind Index Privacy: Server routes messages using HMAC tokens, never seeing actual addresses
• Client-Side Keys: Private decryption keys never leave your device

Important: We encrypt metadata (who you're emailing and message subjects) in addition to message content. This means Haamly servers cannot read your message content, subject lines, or see who you're communicating with.

Messages are encrypted in transit using TLS/SSL. When you use OAuth to authenticate with external email services (Gmail, Outlook), your identity is verified through those providers, but they cannot access your encrypted Haamly messages.

3.2 Data Storage

Your encrypted data is stored on secure cloud servers (Railway platform). We implement a zero-knowledge architecture:

• Encrypted at Rest: All message content and metadata is stored in encrypted form
• Local Decryption: Messages are decrypted only on your devices using keys that never leave your devices
• No Server Access: Haamly servers cannot decrypt your messages, even if compelled by legal orders
• Device-Side Storage: Messages are also stored locally on your devices using IndexedDB (browser storage)

We implement reasonable physical, technical, and administrative safeguards to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Our zero-knowledge design ensures that even in the event of a server compromise, your message content and metadata remain protected.

3.3 Data Retention

We retain your information for as long as your account is active or as needed to provide you services. You may request deletion of your account and data at any time. After deletion, we may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution).

4.1 Service Providers

We may share data with third-party service providers who perform services on our behalf (e.g., hosting, analytics, payment processing). These providers are contractually obligated to protect your data.

4.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Prevent fraud or abuse
• Respond to emergency situations

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. You will be notified of any such change.

4.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.