1. Overview & Core Principle

This Privacy Policy (“Policy”) describes how Owlivion (“we,” “us,” or “our”) collects, uses, stores, and protects personal data in connection with the OwlMail desktop email client and associated services (collectively, the “Service”).

This Policy applies to all users worldwide and addresses the requirements of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Turkish Personal Data Protection Law No. 6698 (KVKK), and other applicable privacy legislation.

OwlMail is open-source software distributed under the MIT License. The source code is publicly auditable, providing full transparency into our data handling practices.

2. Data Controller Information

The data controller responsible for your personal data is:

• Entity: Owlivion
• Product: OwlMail
• Email: privacy@owlivion.com
• Website: owlivion.com

For GDPR and KVKK purposes, Owlivion acts as the data controller for personal data processed through the OwlMail Service.

3. Data We Collect

OwlMail is a local-first application. The vast majority of data never leaves your device. The following table details all categories of data processed:

4. Purpose of Processing

We process personal data solely for the following purposes:

• Core Email Functionality: Sending, receiving, and organizing email via IMAP/SMTP protocols.
• Account Authentication: Authenticating with email providers via OAuth 2.0 or stored credentials.
• AI-Assisted Phishing Detection (opt-in): Analyzing sender addresses and subject lines to identify potential phishing threats.
• AI-Assisted Smart Replies (opt-in): Generating contextual email reply suggestions based on user-provided email content.
• Tracking Pixel Blocking: Detecting and blocking remote tracking pixels embedded in incoming emails.
• Cross-Device Sync (opt-in): Synchronizing account settings, contacts, and preferences across devices using end-to-end encryption via the Owlivion Sync service.
• Personalization: Applying user-configured themes, shortcuts, signatures, labels, and filter rules.

5. Legal Basis for Processing

Under GDPR (Article 6)

• Art. 6(1)(b) — Contractual Necessity: Processing your email account credentials and email content is necessary to perform the Service you requested.
• Art. 6(1)(a) — Consent: AI features (phishing detection, smart replies) and Owlivion Sync are activated only upon your explicit, informed opt-in consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Art. 6(1)(f) — Legitimate Interest: Security measures such as tracking pixel blocking and local encryption serve our legitimate interest in protecting users from threats, balanced against your interests and fundamental rights.

Under KVKK (Article 5)

• Art. 5(2)(c): Processing directly related to the establishment or performance of a contract (email service delivery).
• Art. 5(2)(f): Processing necessary for the legitimate interests of the data controller, provided it does not violate the fundamental rights of the data subject (security measures).
• Art. 5(1): Explicit consent for optional AI features and Owlivion Sync.

6. Data Transfers

OwlMail minimizes data transfers to third parties. The following table details all circumstances in which data may be transmitted:

7. International Data Transfers

When you opt in to AI features powered by Google Gemini, data may be transferred to Google servers located in the United States or other jurisdictions. These transfers are conducted in compliance with GDPR Chapter V, relying on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission;
• Google’s Data Processing Addendum and applicable certifications;
• Your explicit consent under Article 49(1)(a) GDPR, obtained at the point of opting in to AI features.

Owlivion Sync servers are located in Turkey (EU adequacy decision pending individual assessment). End-to-end encryption ensures that even in the event of a lawful data request, decrypted content is inaccessible to Owlivion or any third party.

For KVKK compliance, international data transfers are conducted in accordance with Article 9 of the KVKK and relevant board decisions of the Personal Data Protection Authority of Turkey (KVKK Kurulu).

8. Data Retention

• Local Data (emails, credentials, settings): Retained on your device until you delete them or uninstall OwlMail. Owlivion has no access to or copies of this data.
• AI Processing Data: Data sent to Google Gemini is processed in real-time and not stored by Owlivion. Google’s retention policies apply to data received by the Gemini API.
• Owlivion Sync Data: Retained in encrypted form on Owlivion servers for the duration of your account. Upon account deletion, all synced data is permanently erased within 30 days.
• Sensitive Memory: OwlMail uses the Zeroize library to securely wipe cryptographic keys and passwords from memory after use, preventing residual data in RAM.

9. Your Rights — GDPR (Articles 15–22)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15): Obtain confirmation of whether your personal data is being processed and request a copy of such data.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data where no compelling reason exists for continued processing.
• Right to Restriction (Art. 18): Request restriction of processing in specific circumstances (e.g., while accuracy of data is contested).
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right Not to be Subject to Automated Decision-Making (Art. 22): Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to Withdraw Consent (Art. 7(3)): Withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Since OwlMail stores data locally on your device, you can exercise most of these rights directly by modifying or deleting your data within the application. For Owlivion Sync data, contact privacy@owlivion.com.

You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Your Rights — CCPA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) afford you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected.
• Right to Opt-Out of Sale/Sharing: Owlivion does not sell or share personal information as defined by the CCPA/CPRA. No opt-out is necessary.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: Owlivion does not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service.

To exercise these rights, contact privacy@owlivion.com. We will verify your identity before processing your request and respond within 45 days as required by law.

11. Your Rights — KVKK (Article 11)

If you are located in Turkey, the Personal Data Protection Law No. 6698 (KVKK) grants you the following rights:

• Learn whether your personal data has been processed;
• Request information about the processing if your data has been processed;
• Learn the purpose of processing and whether the data is used in accordance with that purpose;
• Know the third parties to whom your data has been transferred, domestically or abroad;
• Request rectification if the data is incomplete or inaccurate;
• Request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK;
• Request notification of rectification, deletion, or destruction operations to third parties to whom data has been transferred;
• Object to any result arising exclusively from automated processing that is to your detriment;
• Claim compensation for damages arising from unlawful processing of personal data.

To exercise your KVKK rights, submit a written request to privacy@owlivion.com with the subject line “KVKK Basvurusu.” We will respond within 30 days as required by law. You may also file a complaint with the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu).

12. Cookies & Website

The OwlMail website (owlivion.com) is designed with privacy in mind:

• No Cookies: We do not set any cookies, including analytics, advertising, or tracking cookies.
• No Analytics: We do not use Google Analytics, Mixpanel, Amplitude, or any third-party analytics service.
• No Ad Trackers: We do not deploy advertising pixels, retargeting scripts, or social media tracking buttons.
• IP Geolocation: The website may use a client-side IP geolocation request (via ipapi.co) solely to determine your preferred language (Turkish or English). This request is made from your browser directly to the third-party service; Owlivion does not log or store your IP address.

13. Children’s Privacy

OwlMail is not directed at individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us through the Owlivion Sync service, please contact us at privacy@owlivion.com and we will promptly delete such data.

14. Data Security Measures

We implement the following technical and organizational measures to safeguard your data:

• AES-256-GCM Encryption: All locally stored email data is encrypted using the AES-256-GCM authenticated encryption algorithm.
• OS Keychain Integration: Passwords and OAuth tokens are stored in your operating system’s native secure credential store (macOS Keychain, Windows Credential Manager, Linux Secret Service).
• HKDF Key Derivation: Cryptographic keys are derived using the HKDF standard from the Ring cryptographic library.
• Zeroize Memory Wiping: Sensitive data such as passwords and cryptographic keys are securely wiped from memory immediately after use.
• TLS/SSL: All network communications (IMAP, SMTP, API calls) are encrypted in transit using TLS 1.2 or higher.
• End-to-End Encryption (Sync): Data synchronized via Owlivion Sync is encrypted on your device before transmission. Owlivion servers cannot decrypt your synced data.
• Tracking Pixel Blocker: OwlMail automatically detects and blocks remote tracking pixels in incoming emails, preventing senders from monitoring your activity.
• Open-Source Auditing: The full source code is publicly available under the MIT License, enabling independent security audits.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page;
• Provide notice through the OwlMail application or our website;
• Where required by applicable law, obtain your consent before implementing changes that materially affect the processing of your personal data.

We encourage you to review this Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated Policy.

16. Contact / Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

• Privacy Inquiries: privacy@owlivion.com
• General Contact: info@owlivion.com
• Website: owlivion.com

We endeavor to respond to all legitimate requests within 30 days. In certain circumstances, response time may extend to 60 days where the complexity or volume of requests warrants it, in which case we will notify you of the extension and the reasons for it.