Closiq Mail — Privacy Policy

What the service stores, where it lives, who else sees it, and for how long.

Last updated 30 August 2026. Operated by Closiq Inc.

The short version.

Closiq Mail is a private mail service for our own team. Accounts are created by an administrator; there is no public sign-up. We do not sell data, we do not show advertising, and the app contains no analytics, advertising or crash-reporting SDKs of any kind. Your mail is stored on infrastructure we operate. The one thing worth reading carefully is the section on remote images, because opening a message can tell its sender that you opened it.

1. Who this covers

This policy covers the Closiq Mail apps for iPhone and iPad, the web client, and the server that backs them. It applies to people whose mailboxes were created by an administrator of a domain we host.

2. What we store

Category	What it includes
Account	Your login email, display name, mailbox addresses and signatures, and an optional recovery email address used only for password resets.
Mail	The complete message: sender and recipients, subject, body text and HTML, all headers, and every attachment. We keep the original raw message as received, not just a parsed copy.
Search index	A full-text index of message subjects and body text, so search works without re-reading stored files.
Contacts	Addresses and names are recorded automatically from mail you receive and send, to power address auto-complete. This is not imported from your device's contacts, and the app never requests access to them.
Your organisation of it	Drafts, labels, filter rules you create, snooze times, and read/archived/trashed state.
Security	Your password as a PBKDF2-SHA256 hash (never in readable form), two-factor secrets and recovery codes, device session tokens, and an administrative audit log of account changes.
Abuse prevention	Counts of failed sign-ins, message volumes per sender, and the IP address of requests, used to rate-limit and to block abusive senders.

3. Where it is stored

The service runs on Cloudflare, which processes essentially all of it: the application itself, the database of accounts and message metadata, the stored message bodies and attachments, and inbound and outbound mail delivery. Cloudflare is our infrastructure provider and processes this data on our behalf.

Stored message bodies and attachments are additionally copied to a server we operate ourselves, on our own hardware, reached over an encrypted tunnel. Mail therefore comes to rest on equipment we physically control as well as at Cloudflare.

Data is not restricted to any single country, and the service behaves the same way in every region.

4. Who else receives data

People you email. Mail you send is delivered to its recipients and their mail providers, which is the point of the product.
Google, only if you connect a Gmail account. This is entirely optional. If you do, we request read and send permission for that Gmail account only, import your inbox and sent mail, and store your Google refresh token encrypted. Mail sent from a Gmail-backed mailbox is handed to Google to deliver. Disconnecting revokes the token; mail already imported stays in your mailbox. We never request permission to delete or relabel anything in Gmail.
Push notification services, for the web client only. The notification body is encrypted before it leaves our server, so the push service sees that a notification was sent and to which device, but not its contents. The iPhone and iPad apps do not use push notifications at all and never contact Apple's notification service.
Endpoints you configure yourself. If you set up a webhook, we send it the events you subscribe to, which can include subjects, message snippets and recipient lists. This is off unless you turn it on.
A sender's own server, when you tap unsubscribe on one of their messages.

We do not sell or rent data, and we do not share it for advertising. There is no analytics, advertising, attribution or crash-reporting SDK in the apps; the iPhone and iPad app has no third-party code in it at all. Cloudflare does keep its own operational logs as our infrastructure provider, which we do not control.

5. Remote images, and what opening a message reveals

Images in email load automatically, and there is currently no setting to turn that off.

Senders commonly include a tiny invisible image specifically to detect when a message is opened. Because your device fetches that image directly, the sender's server can learn your device's IP address, and therefore your approximate location and internet provider, along with the exact time you opened the message, and can tie that to you specifically. This happens again each time you reopen it.

What we do prevent: scripts in email never run, remote fonts, stylesheets and embedded frames are blocked, and nothing a message loads can store a cookie that survives. Those measures stop a message from attacking your account, but they do not stop the image itself from being fetched. If this matters to you, avoid opening mail from senders you do not trust.

6. What the app stores on your device

Your session tokens, in the iOS Keychain.
Attachments you open for preview are written to the app's temporary folder. iOS clears that folder when it needs space, and it is removed entirely when you delete the app.
Mail you are viewing is held in memory only. The app does not maintain an offline database of your mail.

The app requests no access to your contacts, location, camera, microphone or photo library. Attaching a photo uses the system picker, which hands over only the file you choose and grants the app no access to the rest of your library.

7. How long it is kept

Mail is kept until you delete it. There is no automatic expiry, by design.
Moving a message to Trash is reversible. Delete Forever and Empty Trash remove the stored copy of the message and its attachments as well as the record of it, and cannot be undone.
Deleting a mailbox removes its messages, attachments, drafts, contacts, labels and filters, and queues the stored files for deletion.
We take a daily backup of the account database and keep two weeks of it, so a deleted item can persist in a backup for up to that long before ageing out.
Security and abuse records, such as the audit log and rate-limit counters, are retained separately from your mail so that deleting mail does not erase the record of administrative actions.

8. Your choices

Delete individual messages, or empty Trash, at any time from the app.
Block a sender so their mail is refused before it is ever stored.
Disconnect a linked Gmail account at any time.
Ask your administrator to delete your mailbox entirely, or write to us at the address below and we will do it.

9. Children

Closiq Mail is a workplace tool provided to members of our organisation and is not directed at children. We do not knowingly create accounts for children.

10. Changes and contact

If this policy changes in a way that materially affects what we collect or who receives it, we will update the date at the top and notify account holders by email.

Questions, or a request to delete your data: [email protected].