PRIVACY
SyncMail privacy notice
Effective September 23, 2026. This notice describes the current Windows and Android beta and the services it can use.
Who provides SyncMail
SyncMail is provided by C&S Ventures of Polk LLC, 106 Leslie Ave, Winter Haven, Florida 33880-1229, United States. Privacy questions can be sent to support@fullscopepos.com.
Information the app handles
SyncMail handles the account details needed to connect to the email provider you choose. These can include your email address, account name, incoming and outgoing server settings, and account password. It also handles messages, folders, read and flagged status, drafts, attachments, signatures, sender names, and app preferences to provide email and synchronization features.
Your mailbox password or provider-issued OAuth tokens are saved in the operating system's secure credential storage on each device. If you turn on hosted Fast notifications for a supported account other than Google OAuth sign-in, an encrypted copy of the connection profile is also stored by the SyncMail notification service while that feature remains enabled. For IMAP accounts, the service decrypts it in memory to maintain a read-only connection to your Inbox. In the separate private Microsoft Graph test, the service uses the Microsoft token to maintain an Inbox-change subscription; Microsoft sends a change signal, and your phone retrieves the mail. Android version 0.76.74 and later do not send Google OAuth credentials to that service; it rejects attempts from older versions.
Where information goes
SyncMail connects directly to your configured IMAP and SMTP servers or, in the private Microsoft test, to Microsoft Graph. Mail, folders, message status, and ordinary drafts remain with your email provider under that provider's terms. Automatic setup can request public settings using only the email domain; it does not include your password.
SyncMail can store encrypted signatures, sender names, preferences, and draft bookkeeping in your own IMAP mailbox so your devices can read them. The email provider stores those encrypted records but does not receive the encryption key from SyncMail. For Microsoft sign-in, a non-secret setup marker containing a random group identifier prevents a second device from creating a competing settings key; the marker does not contain that key.
Google mail access
If you connect a Google account, SyncMail uses Google account data only to provide the email features you request: showing and searching your mail, folders and labels; displaying and saving attachments; sending mail; creating drafts; changing read, starred and folder status; and notifying you about new mail. SyncMail does not use Google account data for advertising, profiling, sale, or training artificial-intelligence models.
The Android and Windows apps keep Google sign-in credentials in operating-system secure storage and connect directly to Gmail for mail use. On Android, the optional on-device Gmail watcher uses a direct Gmail connection while Android permits its foreground service to run. Scheduled checks remain available. The current notification service rejects new hosted Google OAuth connections, and its active hosted Google monitors were removed on September 23, 2026. Earlier encrypted server backups may retain former Google connection profiles for up to 30 days under restricted access; they are not used to monitor mail.
SyncMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
QR scanning on Android
If you open the optional settings-recovery QR scanner, SyncMail uses your camera and Google ML Kit barcode scanning on your device. Camera frames and decoded QR content are not sent to SyncMail's servers or used for advertising. Google documents that the ML Kit SDK collects limited device and application information, per-installation identifiers, performance measurements, API configuration, input and output sizes, feature versions, event types, and error codes for SDK diagnostics and usage analytics. Google says this information is encrypted in transit and is not transferred to third parties. SyncMail does not receive that telemetry and does not enable barcode auto-zoom. See Google's ML Kit data disclosure guidance.
Information stored on a device
SyncMail stores local drafts, attachments, preferences, synchronization queues, and offline message copies needed for normal operation. Credentials and encryption keys use operating-system secure storage. Record identifiers, sizes, revisions, and timestamps can remain visible to the operating system.
If you enable hosted Fast notifications for a supported account other than Google OAuth sign-in and grant permission, the SyncMail notification service keeps a secure read-only Inbox connection or, in the private Microsoft Graph test, renews a short-lived Inbox-change subscription with Microsoft. The service sends a short-lived wake signal through Firebase Cloud Messaging when mail may have arrived. That signal contains an opaque monitor identifier and routing values, but no message body, sender, subject, mailbox password, or OAuth token. Your phone then connects directly to the provider to refresh and show the new-mail alert. Turning hosted Fast notifications off removes the phone registration and its hosted mailbox monitors; a Microsoft subscription that cannot be deleted immediately expires within six days. Encrypted server backups may retain a previous connection profile for up to 30 days under restricted access. Google OAuth mail uses the separate on-device watcher or periodic Android checks instead.
Purchases and cross-platform activation
The paid release uses a small SyncMail license service so one verified purchase can activate supported Windows and Android devices. The service can receive the verification email address you enter, a random app-created device identifier, device platform, product identifier, purchase time, and an Android Google Play purchase token. The token is sent to Google Play to verify the purchase.
The service stores protected identifiers instead of raw email addresses, device identifiers, purchase tokens, or mailbox content. It periodically asks Google Play for refunded, canceled, and charged-back purchases so access can be revoked. Verified in-app account deletion removes the SyncMail entitlement, protected purchase link, device activations, and pending verification records. The service runs on an owner-controlled C&S Ventures VPS, and verification mail uses the owner-controlled server.thegunnook.com mail service as support@fullscopepos.com. Purchase and license records are retained while needed to provide access, prevent fraud, process refunds, and meet accounting or legal obligations.
Advertising and analytics
The current app has no advertising, behavioral tracking, developer-operated analytics, or remote crash-reporting service. Google ML Kit's limited QR-scanner diagnostics are described above. Firebase Cloud Messaging is used only for the private new-mail alerts described above. This notice will be updated before release if that changes.
Links and attachments
SyncMail does not automatically open message links. Normal HTTPS pictures in formatted mail can load automatically; requesting a picture can tell its host your network address and that the message was viewed. SyncMail removes declared tiny tracking pixels, hidden pictures, insecure picture addresses, scripts, and other active content before rendering. A supported web link opens in your external browser only after you select it. An attachment is saved outside the app only after you choose a destination.
Removing information
See Remove SyncMail data for device, mailbox, and license-service instructions. Removing an account clears its credentials and offline mail from that device. It does not delete mail held by your email provider.
Children
SyncMail is a general email client and is not designed for children.
Changes
Material changes will be identified here with a new effective date. Store disclosures will be checked against the exact released build.