Privacy Policy – TVmail and TVmail Pro

Effective date: 2026-10-10

This policy covers two Android TV apps published on Google Play by CLAPPS:

Both apps are built from the same code and use the same backend (a Google Firebase project), so everything below applies to both, except where a section says "free app only". "TVmail" below means either app.

Contact: ralf@clapps.be

1. Your Gmail data

TVmail asks Google for two Gmail permissions: gmail.readonly and gmail.modify. It uses them only to:

• list, read and search your emails, labels and attachments so they can be shown on your TV;
• mark an email as read when you open it (TVmail removes the "Unread" label and makes no other change to your mailbox: it does not archive, delete, move, label, draft or send email);
• ask Gmail to send a new-mail signal to TVmail's server (a Gmail "watch"), and stop that signal when you delete your account, or when you sign out on the TV that receives the alerts.

Your emails and attachments are fetched directly from Gmail by your TV and are stored only on the TV: in TVmail's private database, in its image cache, and, when you open an attachment, as a file in TVmail's storage on the TV, which is then handed to the viewer app you choose. Search terms you type are sent to Gmail only. For each Gmail label, TVmail writes the subject, sender and preview image of recent emails to the TV's system home-screen database (Android TV's TvProvider), so that they can be shown in home-screen rows. They appear on the home screen only for the rows you add, and they are deleted when you sign out or delete your account.

Our servers never receive the content of your emails, their subjects, senders or attachments.

To show a small icon for each sender, TVmail asks Google's public favicon service (www.google.com/s2/favicons) for the icon of the sender's domain (for example example.com). Only the domain is sent, never the full address or anything from the message. Images inside an email are loaded from the servers that host them, as in any email app.

Google API Services User Data Policy (Limited Use)

TVmail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Gmail data is used only to provide the features described above, which you can see on your TV;
• it is never used for advertising, never sold, and never transferred to anyone except as needed to provide these features, for security, or to comply with the law;
• no human reads your Gmail data, unless you ask us to for a specific message (for example in a support request), it is needed for security (such as investigating abuse), or the law requires it.

2. What is stored on our servers

The backend runs on Google Firebase / Google Cloud (Cloud Firestore, Cloud Functions in the us-central1 region, Firebase Cloud Messaging). It holds:

a) New-mail notification registration. Your Gmail address and the push-notification token (FCM token) of the TV (or TVmail app) that registered most recently (each signed-in TV registers again whenever the app opens and syncs), plus the time of the last update. When Gmail signals new mail, Google sends TVmail's server a notification that contains only your email address and a mailbox change number (Gmail "history ID"). The server looks up the TV's push token and sends that TV a push message with the same two values. The TV then fetches the new email from Gmail itself. There is normally one registration per Gmail address (an address first registered by version 1.5.3 or older with capital letters can have a second one). It is shared by TVmail and TVmail Pro and by all your TVs, and only one TV receives the push, normally the one that registered last.

b) Sign-in hand-off (temporary). You sign in by scanning a QR code on the TV with your phone. That opens tvmail-97ca9.web.app and then Google's sign-in page. When you approve, the authorization code goes to TVmail's Cloud Function. The function exchanges it with Google for your OAuth tokens (an access token and a refresh token). It then stores them, with the granted permissions and expiry times, in a temporary Firestore document named after the random code shown on your TV. The TV reads this document and deletes it immediately. A document the TV never collects can no longer be read after 10 minutes. A scheduled clean-up job deletes it within the next 15 minutes, and a Firestore time-to-live policy removes it as a backup. (With app version 1.5.3 and older, this document holds only a one-time authorization code, which the clean-up job deletes after 15 minutes.)

c) Token refresh. Every hour or so the TV sends its refresh token to a TVmail Cloud Function, which asks Google for a new access token and returns it. The refresh token is not stored on the server. Since version 1.6.0 the app no longer contains TVmail's Google client secret: the current secret is kept only on the server (see Security).

d) Legacy sign-in record. People who signed in with the older "Sign in with Google" button (2023–2025) also have a Firebase Authentication account record: email address, name, profile photo link and Google account ID. Current versions do not create new records. These records are deleted when you delete your account (section 6).

e) Account status (since version 1.7). Accounts that started using the free TVmail app with version 1.7.0 got a 7-day Premium trial. Since version 1.7.1, new accounts start directly with the free features of new accounts, with no in-app trial (Google Play may offer a free trial of the annual Premium subscription, see section 4). Accounts that used TVmail before version 1.7 keep the free features they always had. To apply this the same way on all your TVs, after a reinstall and on a new TV, the server keeps a record keyed by your Gmail address with: the date TVmail first saw the address, whether the address used TVmail before version 1.7, the start and end dates of the trial (accounts that got one), and whether the account started without a trial (version 1.7.1 and later). It is created automatically for any TVmail account, whichever app you use (TVmail or TVmail Pro), when our server handles a request for your address: a new-mail alert registration, a Gmail new-mail signal, a sign-out, an account deletion or a free-app status check. It is used only by the free app, only to decide which features are free for you, and no app or browser can read or change it (Firestore security rules). Signing out does not delete it; deleting your account does (section 6). The free app also remembers, on the TV only, whether TVmail was installed on that TV before version 1.7 (from the app's install date); such a TV keeps the original free features, and the app tells the server so with each status check, which marks the address as having used TVmail before version 1.7. With that information the app may send the anonymous RevenueCat ID of the TV, so the server can ask RevenueCat when that ID was first seen. Only that date is used, and the ID is not stored on our servers.

The sign-in web page on your phone uses no cookies and no analytics. It loads the Roboto font from Google Fonts. For older app versions it also loads the Firebase JavaScript library from Google.

When the server needs to confirm which mailbox a request comes from (push registration, account status, sign-out, account deletion), it first asks Google to confirm that the access token sent by the TV was issued to TVmail, then asks Gmail for the address that owns it. It uses that access token only for this check, to stop the Gmail new-mail signal and, when you delete your account, to revoke TVmail's access (together with the refresh token the TV sends for that purpose, which is not stored), never to read your email.

3. What is stored on your TV

• Your OAuth tokens and settings, in private app storage. This storage is encrypted with a key held in the Android Keystore (AES-256) on devices that support it. On a device where encrypted storage cannot be created, the data stays in TVmail's private storage without that extra encryption.
• Cached emails, labels, attachments you opened, images and home-screen rows, as described in section 1.
• TVmail disables Android backup, so this data is not copied to your Google account backup.

4. Third-party services

Like any internet service, these services see the IP address of your TV when it connects to them.

No analytics, no advertising. TVmail contains no analytics SDK (Google Analytics for Firebase was removed in version 1.6.0), no advertising SDK, and it does not access the Android advertising ID. We do not sell or share your data with anyone for advertising or any other purpose.

5. Crash reports

When the app crashes or hits an error, Firebase Crashlytics sends a report containing: the error and stack trace, the time, the app version, the device model and manufacturer, the Android version, technical device state (such as free memory and disk space, orientation, whether the device is rooted) and a random Crashlytics installation identifier. TVmail does not attach your email address, the content of your emails or your tokens to these reports. Firebase keeps crash reports for 90 days. Crashlytics also sends a small session event each time the app starts, even without a crash. It holds a random session ID, the Firebase installation ID, the app version, the device model and the Android version, and is used to compute crash-free rates. It contains no email data.

6. Signing out and deleting your account

Sign out (Settings → Log Out):

• On our servers (if the TV is online): if this TV is the one registered for new-mail alerts, your address and its push token are deleted and Gmail stops sending new-mail signals for your address unless another registration of the same address remains. If another TV, or the other TVmail app, registered after it (or an older app version registered the address with capital letters), that registration is left in place so its alerts keep working. Your Google permission for TVmail is kept.
• On the TV: your tokens, mail cache, attachments you opened, image cache (including the email viewer's web cache), TVmail home-screen rows, label choices and cached Premium status are erased. Display preferences such as list layout are kept.
• The account status on our servers (section 2 e) is kept, so signing in to the free app again, on this TV or another one, gives you the same free features or the same trial dates.

Delete account & data (Settings → Delete account & data):

• On our servers: Gmail stops sending new-mail signals, your address and push token are deleted, any legacy Firebase Authentication record with your address is deleted, your account status (section 2 e) is deleted, and TVmail's access to your Google account is revoked. Nothing is kept: if you sign in to the free app again later, your Gmail address is treated as a new account (a TV that already had TVmail before version 1.7 keeps the original free features). Deleting your account does not cancel or remove a Premium purchase: it belongs to your Google Play account and can be restored with "Restore purchase". TVmail and TVmail Pro share the same Google sign-in, so both apps lose access on every TV where you use that Google account.
• On the TV: everything listed above for sign-out is erased.
• If the TV can no longer act for your Google account (for example because you already removed TVmail's access at Google), TVmail erases the data on the TV, signs you out, and tells you to finish the deletion on our web page or by email.
• If the server cannot be reached (for example with no network), or Google does not confirm that TVmail's access was revoked, the TV keeps you signed in, shows an error and you can try again. Only a successful revocation is reported as a completed deletion.

You can also:

• follow the instructions at https://tvmail-97ca9.web.app/delete-account.html, including deletion by email if you no longer have the TV (we complete it within 30 days);
• remove TVmail's access to your Google account at any time at https://myaccount.google.com/permissions. This stops TVmail reading your mail but does not delete the notification registration on our servers. Use one of the options above for that.

Deleting your account does not cancel a TVmail Premium subscription (free app). To stop billing, cancel it in Google Play under Payments & subscriptions → Subscriptions. TVmail Pro has no subscription.

7. Retention

• Notification registration (address, push token): kept until you sign out on the TV it belongs to, delete your account or ask us to delete it, or until the push service reports that the TV's push token is no longer valid. If that TV is offline when you sign out, it is kept until one of the others happens.
• Legacy Firebase Authentication record: kept until you delete your account or ask us.
• Account status (both apps, used by the free app; section 2 e): kept until you delete your account or ask us. Signing out does not delete it.
• Sign-in hand-off document: deleted by the TV as soon as it is read, unreadable after 10 minutes, and removed by the clean-up job shortly after.
• Server logs (Google Cloud Logging): since backend version 1.6.0, TVmail's server logs do not contain email addresses. When a log line must refer to a mailbox, it uses a short one-way code derived from the address. Logs are kept for Google Cloud's standard 30 days, so older log lines that contained addresses expire within 30 days of that update.
• Crash reports: 90 days (Firebase Crashlytics).
• Purchase records (free app): kept by Google Play and RevenueCat as needed for billing, refunds and tax obligations. They are linked to the anonymous RevenueCat ID and your Google Play account, not to your Gmail address.
• Data on the TV: until you sign out, delete your account, clear the app's data or uninstall the app.

8. Security

All connections use HTTPS. Firestore security rules stop any app or browser from reading the notification registrations and account status records, and a sign-in hand-off document can only be read by someone who knows its random code, and (for app version 1.6.0 and later) only for 10 minutes. Since version 1.6.0 the app no longer contains TVmail's Google client secret; it is kept on the server. An older secret embedded in versions 1.5.3 and earlier remains active only until those versions are retired, and will then be disabled. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children

TVmail is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy. Changes are posted on this page with a new effective date. Significant changes will also be mentioned in the app's release notes.

11. Contact

For questions about this policy or your data, or to request access to or deletion of your data, email ralf@clapps.be.

Delete your account and data