1. Who this policy covers
This policy covers the Wand apps for iPhone, iPad and Mac and the website at tidywand.app. “Wand”, “we” and “us” refer to the seller identified for Wand in the App Store listing.
2. Mailbox data
The app connects directly from your device to the email provider you select. It requests message identifiers, dates, sizes, labels or folders and selected sender, list and authentication headers needed to group mail and verify actions. It reads subjects briefly on your device to identify and protect receipts and orders, and when you request message examples. Only derived protection flags are retained; subjects are not added to the persistent metadata index or sent to our servers. Message bodies and attachment contents are not requested or indexed.
Mailbox metadata, plans, policies and action evidence stay in the app container on your devices. Passwords and OAuth state are stored in Apple Keychain. Wand does not operate a server that receives or stores this mailbox data.
When Company logos is on, Wand sends only a validated public company domain to its no-request-log image proxy. The proxy requests a logo from Logo.dev without forwarding your device IP address. Neither your full email address, sender name nor message data is sent. Personal mailbox domains are excluded. You can turn Company logos off in Settings.
3. Actions and unsubscribe
When you approve an action, the device sends the exact request to your provider and stores evidence of the outcome locally. A standards-based one-click unsubscribe sends the provider-supplied request directly to the validated list endpoint. A mailto unsubscribe is handed to Apple Mail or, when you explicitly approve it and configure supported SMTP, sent directly to the mail server.
When you approve stop-and-clear with future-mail protection, Wand also moves new unprotected mail from that exact account and sender stream to Trash during later inbox checks. This is reversible while your provider retains the mail, can be disabled in Activity, and is not represented as a confirmed unsubscribe. Background checks depend on your device and connection. Legacy cleanup approvals do not silently acquire this future-mail permission.
4. Optional Private Sync
If you enable Private Sync, privacy-minimal settings, screener decisions, exact policy intent and aggregate action summaries are stored in your private iCloud database. Mailbox addresses, sender identities, subjects, message IDs, bodies, attachments, passwords, OAuth tokens, provider references and the local metadata index are excluded. Apple processes iCloud data under its own terms.
5. Gmail OAuth
The Gmail connection uses Apple's system browser with Google's OAuth page, S256 PKCE and an app-specific callback. Wand does not embed Google Sign-In or another third-party tracking SDK. Gmail message processing still occurs directly between your device and Google; Wand does not receive it on a developer server.
6. Apple purchases and reliability metrics
Apple processes App Store purchases and subscription status. Wand receives verified entitlement state, product and expiry information, not payment-card details. The app does not include a third-party crash or advertising SDK. Apple may provide developers with aggregated or privacy-protected App Store and TestFlight diagnostics according to your Apple settings and Apple’s policies.
When Share reliability metrics is on, Wand sends daily aggregate reliability and product-interaction counts, provider kind where relevant, app version, platform and broad timing bands to tidywand.app. Counters cover connection, first inventory, reviewed cleanup plans, provider-verified cleanup, restore and protection, paywall presentation, first locally verified purchase, support opening, share-sheet opening, rating requests and one-time day-7 and day-30 return milestones. They do not say which inbox, sender, message, action or person produced an event.
Wand does not send mailbox addresses, sender or list identity, subjects, message or account IDs, provider references, credentials, tokens, raw errors or a persistent device identifier. A random identifier exists for one upload batch only, is used to prevent duplicate counting and is removed within 35 days. The operations service is configured not to retain source IP addresses. These non-linked product-interaction and performance metrics are used only to detect unsafe or unreliable releases and improve app functionality.
7. Support reports
A support report is created locally only when you choose Export. It contains broad count bands, platform and app versions, typed provider health and identifier-free action states. It excludes addresses, sender and list names, subjects, message IDs, account and operation IDs, credentials, tokens, hostnames, provider references and raw errors. The app does not upload the file. If you choose to send it, the recipient you select will process that copy.
8. Your choices and deletion
- Use Allow future mail in Activity to stop exact-stream future protection.
- Turn off Company logos to stop public company-domain logo requests.
- Turn off Share reliability metrics in Settings; unsent aggregate batches remain local and are not uploaded.
- Disable or reset on-device personalisation in Settings.
- Disable Private Sync or reset its privacy-minimal records.
- Remove an inbox to delete its local index, history, policies and credentials and attempt provider grant or rule revocation.
- Manage or cancel subscriptions in Apple subscription settings.
- Do not export or send a support report.
Wand has no separate developer account. There is therefore no developer account record to request from us. Provider and Apple account data must be managed with the relevant provider.
9. Retention and security
Local mailbox data remains until you remove the inbox or app. Routine action evidence supports restore and audit behaviour and is removed with the account. Uploaded aggregate reliability rows and their one-batch de-duplication identifiers are removed within 35 days. Data is protected by the app sandbox, iOS Data Protection and Keychain. No system can promise absolute security; suspected unsafe mutation or disclosure disables the affected path and preserves privacy-safe evidence for recovery.
10. Children and changes
Wand is a general productivity app and is not directed to children. We will update this policy when data practices or included SDKs change and will revise the effective date. Material changes will be presented before the affected feature is used where appropriate.
11. Contact
Privacy questions: privacy@tidywand.app. Support: support@tidywand.app.