Privacy Policy
Beacon Mail
Effective date: September 8, 2026
This Privacy Policy explains how Beacon Mail and Potato Studios Development LLC handle information when you use the app or contact us for support.
1. The short version
Beacon Mail is a client for mailboxes you already own. The app connects directly from your device to your chosen provider over IMAP and SMTP. Potato Studios does not operate a Beacon account system, mail relay, message store, tracker-lookup service, analytics backend, or notification relay.
The app is built around an authenticated encrypted container for supported local mail, attachments, drafts, indexes, Beacon-owned contacts, and protected calendar state. Enabled lock and security-event controls can automatically wipe the encryption keys, making the protected local data permanently unreadable.
Your mailbox credentials, messages, attachments, contacts, calendar information, tracker findings, and search content are not sent to Potato Studios by the app. We receive information only when you deliberately contact us or when a third-party platform independently provides information under its own policy.
2. Information the app processes on your device
Mailbox and message data
To show and manage your mail, Beacon Mail processes account identifiers, mailbox and folder names, message headers and bodies, attachments, drafts, search data, delivery and synchronization state, and the mail actions you choose.
Credentials and authentication
The app processes the email address, app-specific password, OAuth token, server settings, and other authentication material needed for the account you configure. Credentials are kept in platform-protected storage and are separated from the message cache.
Contacts, calendars, and cryptographic identities
If you use these features, Beacon Mail processes imported or app-created contacts, permitted system contacts, calendar records in the platform store you select, S/MIME certificates, OpenPGP keys, and signature settings. Mail and tracker data are not placed in calendar widgets.
Settings and security state
The app processes preferences, account and folder identifiers, synchronization state, App Lock settings, and security-event state needed to apply the choices you make. Sensitive values are not intended for logs, analytics, crash metadata, previews, or accessibility labels.
3. How network connections work
- Mail provider — Sign-in, synchronization, search submitted to the provider, and sending connect directly to the provider you configured.
- Remote message content — Remote images are blocked by default. An ordinary remote image may be requested only after the setting or per-message choice that allows it; active content remains blocked.
- External links — Beacon Mail does not resolve, unwrap, or preview links in the background. Opening an HTTP or HTTPS link requires your deliberate action and a warning.
- Tracker analysis — Detection uses bundled rules and on-device analysis. Detected URLs are not sent to Potato Studios or a reputation service.
Your provider, a remote-image host, or a link destination may receive technical information such as your IP address and request timing when your device connects to it. Their handling of that information is controlled by their policies, not this one.
4. Encrypted container, key wipe, and backups
When on-device storage is enabled, protected message, attachment, draft, index, operation, Beacon-owned contact, and protected calendar-projection records are authenticated and encrypted with a random device content key. Records use account-specific context and integrity checks so altered or misplaced ciphertext fails closed. iOS and macOS also apply platform file protections; Android gates its content key with the app's reboot vault and Android Keystore.
On Apple platforms, credentials use local, non-synchronizing Keychain records. On Android, credential records are encrypted and protected by the content-key system. Credentials are excluded from Beacon's supported cloud-backup and device-transfer data.
When an enabled inactivity, scheduled, manual, restart, or supported security-event control triggers, Beacon Mail wipes the encryption keys that unlock the protected container. Encrypted files may remain as ciphertext, but the protected local mail, contacts, calendar state, and other encrypted records cannot be decrypted or recovered without those keys. Potato Studios does not hold a server copy of the keys.
A limited set of non-secret settings and account identifiers may be restored through encrypted platform backup or Keychain features. Android backup may also carry the passphrase-wrapped content-key envelope, which remains unusable without the passphrase and does not include the mail database. Mail, attachments, private keys, and credentials are excluded from Beacon's supported restoration allowlists.
Beacon-owned contacts and protected calendar projections can live inside the encrypted container. Contacts or calendar records you choose to place in system or provider accounts remain governed by those platform stores and their backup or synchronization settings.
No storage or encryption system is perfectly secure. A device that is already unlocked may display decrypted information, and local encryption does not prevent your mail provider from retaining synchronized mail.
5. Information Potato Studios may receive
Beacon Mail contains no developer analytics or message-content reporting. The app does not send Potato Studios your mailbox address, provider credentials, message content, contacts, calendar records, tracker URLs, or search history.
If you email support or use the Potato Studios contact page, we receive the address you contact us from, the contents of your request, and any files or details you choose to include. Do not send passwords, authentication codes, private keys, or private message content.
App stores, operating-system providers, mail providers, and other services you choose may process information under their own policies. Those services may provide Potato Studios limited store, purchase, distribution, or support information, but they do not become a Beacon mail backend.
6. Sale, advertising, and disclosure
We do not sell or rent personal information, and Beacon Mail does not use mailbox data for advertising or behavioral profiling.
Support communications may be processed by the email and hosting providers used to receive and answer your request. We may also preserve or disclose information we actually hold when reasonably necessary to comply with law, respond to valid legal process, prevent fraud or abuse, protect rights and safety, or resolve a dispute.
Because Potato Studios does not receive your mailbox data through Beacon Mail, a request served on Potato Studios cannot produce a developer-held copy of data the company never received. Your mail provider and your device remain separate data holders.
7. Retention and your controls
Local app data remains on your device until you remove an account, clear eligible local storage, reset the app, or uninstall it, subject to the platform's backup and restoration behavior. Removing a configured account deletes Beacon's local credential and disposable cached mail for that account; it does not delete mail or the account at your provider.
An Offline folder is different: after a verified conversion, the device may hold the only copy of that mail. Beacon Mail requires export or restoration safeguards before actions that could destroy Offline-only records. Uninstalling or resetting the app can permanently destroy an unexported Offline folder.
We retain support communications only as long as reasonably needed to answer the request, keep appropriate business records, protect the service, and meet legal obligations. You may ask us to delete support information you previously sent, subject to applicable retention requirements.
8. Account removal and provider deletion
Beacon Mail has no separate Beacon account to delete. To remove a mailbox and its local data from the app, follow the steps on the account removal page.
Deleting messages, folders, or the entire account at Gmail, iCloud Mail, or another provider is a separate action governed by that provider. Beacon Mail never represents local cleanup as provider deletion.
9. Your privacy rights
Depending on where you live, you may have rights concerning personal information Potato Studios actually holds, such as support correspondence. These may include access, correction, deletion, restriction, objection, or portability rights. We may need to verify your identity and will respond as required by applicable law.
Requests about provider-held mailbox data must be directed to your mail provider. Controls for data stored by Beacon Mail are available on the device.
10. Children
Beacon Mail is a general-purpose email client and is not directed to children under 13. A parent or guardian should supervise use by a minor and the minor must be permitted to use the configured mail account.
11. Changes to this policy
We may update this Privacy Policy as Beacon Mail changes. We will revise the effective date and provide any additional notice required by law. Material changes do not silently convert Beacon Mail into a developer-operated mail or analytics service.
12. Contact
For privacy questions or requests concerning information Potato Studios holds, use the support address below.