Privacy Policy — Mail Merger

In short: your email account, your recipient lists and your messages stay on your phone. Emails go straight from your phone to your own email provider (such as Gmail), never through our servers. The app sends Google's Firebase services a small amount of usage and crash data that never includes addresses, names or message text. There are no ads and no account to create, and we don't sell any data.

Who we are

The app is published on Google Play by Mediant Technologies, the trading name of Janesh Kumar, an individual developer based in New Delhi, India (“we”, “us”). You can reach us at medianttechnologies@gmail.com.

Data that stays on your phone

This data is kept in the app's private storage on your phone and is not uploaded to us or to any third party.

Data	What the app does with it
Your email account	Your address, and either the mail server settings and app password you enter, or your Google or Microsoft sign-in. A password is encrypted with a key held in Android's Keystore, which never leaves your phone. A Google sign-in is kept by Google Play services on your phone, and a Microsoft sign-in by Microsoft's sign-in library in the app's private storage.
Recipients	The names, email addresses and other columns you paste, import or pick, used to personalize and send each email. Saved lists stay until you delete them.
Contacts	Read only when you tap to pick from your contacts: the names and email addresses of the contacts you choose. Your contacts are never changed.
Files you import (CSV, Excel)	Read when you pick a file, to take the columns you choose. The file itself is not changed or copied.
Messages and attachments	The subject, text, templates and the files you attach. Attachments are copied into the app so a send can finish later or be retried.
Send history and reports	Who each send went to and whether each email was sent or failed, with the reason. A report is saved as a CSV file only when you choose where to save it.
Do-not-mail list	Addresses you've asked the app never to email, checked before every email.

The app opts out of Android cloud backup, so none of this is copied to a backup. Uninstalling the app deletes all of it.

Sending your emails

The app signs in to the mail service of the provider you choose (Gmail, Outlook, Yahoo, Zoho or your own server) over an encrypted connection, and sends each email from your own account. Your provider receives the emails, as it does for any email you send, and keeps copies under its own privacy policy. Emails never pass through our servers, and we can't see them.

Signing in with Google

If you choose Sign in with Google, the app asks Google for two permissions only: to send email on your behalf (the gmail.send scope) and to know your email address. It can't read, search, change or delete any email in your mailbox. The app uses this access only to send the emails you write in the app, to the recipients you choose, through the Gmail API, directly from your phone. The access token never leaves your phone except to go to Google.

Mail Merger's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't store, transfer or sell your Google user data, don't use it for advertising, and don't let anyone read it. You can remove the app's access at any time in the app (Sign out and remove) or at myaccount.google.com/permissions.

Signing in with Microsoft

If you choose Sign in with Microsoft, the app asks Microsoft only for permission to send email as you (the Microsoft Graph Mail.Send scope) and for your basic account details (name and address), and sends your emails through Microsoft Graph directly from your phone. Outlook keeps a copy of each in your Sent Items, as it does for any email you send. The app can't read your mailbox. You can remove the app's access in the app or at account.live.com/consent/Manage (work and school accounts: myapps.microsoft.com).

When you turn on the unsubscribe line, emails also carry a standard header that lets your recipients' mail app show an Unsubscribe button. Pressing it sends a reply to your own address.

Data the app sends to service providers

The app uses the following Google services. None of them receives your email account, your recipients' addresses or names, your subjects, your message text or your attachments.

Service	What is sent	Why
Firebase Analytics (Google)	Counts and outcomes only: how many people a send went to, how many were sent and failed, how many files were attached, whether it was scheduled, your plan, and when an upgrade screen is shown or a purchase is completed. Together with the standard data the SDK collects: an app-instance ID, device model, Android version, app version, language, approximate country and usage times.	To understand which features are used and improve the app.
Firebase Crashlytics (Google)	Crash and error reports: the technical error, device model, Android version, app version and an installation ID.	To find and fix crashes.
Google sign-in (Google Play services) and the Gmail API	Your Google sign-in, and the emails you send when you use it.	To send your emails from your Gmail or Google Workspace account. Covered by Google's terms; not used by us for anything else.
Microsoft identity platform	Your Microsoft sign-in, and the emails you send when you use it.	To send your emails from your Outlook.com or Microsoft 365 account, under Microsoft's Privacy Statement.
Google Play Billing	Handled by Google Play under your Google account.	To buy and restore the Plus and Max subscriptions. We never see your payment details.

These providers process data on our behalf under Google's terms, see Google's Privacy Policy and Privacy and Security in Firebase. Their servers may be outside India.

What we don't do

We don't upload, read or store your email account, your recipient lists or your emails.
We don't show ads or use advertising identifiers.
We don't sell or rent personal data, and we don't share it with anyone except the service providers above.
The app doesn't ask you to create an account, and it can't read your inbox.

Emails sent on the Free plan

On the Free plan, each email ends with a short line saying it was sent with Mail Merger, with a link to the app on Google Play. The line is added before the email is sent, so your recipients see it. Plus and Max don't add it.

Permissions

Permission	Used for
Internet and network state	Signing in to your mail service and sending, and the services above.
Contacts (read)	Picking recipients from your contacts. Asked for only when you tap that option.
Notifications	Showing a send's progress and when it finishes.
Foreground service	Keeping a send running while the app is in the background.

How long we keep data

We hold no data about you on our own servers.
Analytics data: kept by Google Analytics for Firebase for the retention period set in our project (never more than 14 months), then deleted automatically.
Crash reports: kept by Crashlytics for 90 days.

Your choices and rights

You can delete saved lists, templates, sends and your account details inside the app, or remove everything by uninstalling it. Usage and crash data aren't linked to your name or email address; if you'd like them removed sooner, see Delete your data or email us. We reply within 30 days.

Your responsibility as the sender

You choose who to email and what to send, so you are responsible for having your recipients' permission and for following the laws and your email provider's rules that apply to you. See our terms of use.

Children

The app is not directed at children under 13, and we don't knowingly collect personal data from them.

Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top. For significant changes we'll also tell you in the app.

Contact

Questions or requests: medianttechnologies@gmail.com, Mediant Technologies, New Delhi, India.