Last updated: October 8, 2026
This privacy policy is applicable to the Tchiki Mail app (hereinafter referred to as "Application") for mobile devices, which was developed by Jan Svoboda (hereinafter referred to as "Service Provider") as a Freemium service. This service is provided "AS IS".
Jan Svoboda (j7software) is the data controller responsible for this Application. Contact: j7software@post.cz.
The Application processes the information you supply to connect your e-mail account(s) (e-mail address, credentials or OAuth tokens) solely to provide e-mail client functionality. This data is stored locally on your device and is not transmitted to the Service Provider's own servers, except for the limited trial-protection record described under "Trial Protection" below.
The Application may collect certain technical information automatically — app version, device/OS type, country, and anonymized usage/session data — for analytics and app-stability purposes, subject to your consent as described below.
All data transmitted by the Application is encrypted in transit (TLS) between your device and your e-mail provider's servers. Locally stored account passwords are encrypted using AES-256 with a key protected by the Android Keystore. OAuth access tokens for Microsoft accounts are stored in the Application's private storage, protected by the Android app sandbox. If you choose to include account passwords when exporting a configuration backup, they are encrypted with AES-256 using a key derived from a backup password that you choose; the backup file is saved only to the location you select and is never sent to us. OAuth tokens are never included in backups.
When you add an e-mail account, the Application may look up the mail-server (MX) records of your e-mail domain via Cloudflare DNS-over-HTTPS and may query Microsoft's Autodiscover service with your e-mail address in order to detect the correct server settings automatically. Only the domain (Cloudflare) or the e-mail address (Microsoft) is sent; no credentials are sent to these services.
To prevent repeated use of the free trial on the same device, the Application stores a record in Google Firebase Realtime Database operated for the Service Provider. The record contains a device identifier, the trial start time, the device manufacturer and model, and a partially masked e-mail address of the first account added (for example "..svoboda@example.com"). This record is used solely to verify trial eligibility and to prevent abuse, based on the Service Provider's legitimate interest (Art. 6(1)(f) GDPR) in preventing fraud. It is not used for marketing and is not shared with third parties.
The Application integrates with the following third-party services, each governed by its own privacy policy:
On first launch, the Application asks for your consent before collecting any anonymous usage data (such as app sessions, device type, OS version and country) via Google Firebase Analytics. This data does not include e-mail content, credentials, or any personally identifiable information. You can review or change your choice at any time in the app: Settings → About → "Share anonymous usage data".
The Application uses Google Firebase Crashlytics to automatically report crash data in order to improve app stability. Crash reports contain technical diagnostic information about the device and app state at the time of the crash, but no personal data. Crash reporting is independent of the analytics consent above, based on the Service Provider's legitimate interest (Art. 6(1)(f) GDPR) in maintaining a stable and secure app.
To protect against tampered or repackaged copies of the Application (anti-fraud / license verification), the Application uses the Google Play Integrity API. A device integrity signal is generated on your device and verified server-side by the Service Provider's Cloud Function. This process does not involve any personal data; verification results are logged for a limited period for fraud-monitoring purposes only.
If you are located in the European Economic Area, you have the right to access, correct, or delete your personal data, to restrict or object to its processing, and to data portability where applicable. You can exercise these rights by contacting j7software@post.cz. You also have the right to lodge a complaint with your local data-protection supervisory authority (in the Czech Republic: Úřad pro ochranu osobních údajů, www.uoou.cz).
Tchiki Mail does not operate its own user-account server — it connects to your existing e-mail provider. You can delete all data associated with the App at any time by removing your e-mail account in Settings, or by uninstalling the App. This immediately and permanently deletes all locally stored tokens (including the Microsoft sign-in stored on the device), credentials, and messages from your device. The trial-protection record described above is not stored on your device; you can request its deletion by e-mail.
The Application is not directed at children and is not intended for use by anyone below the applicable age of digital consent in their country of residence. If the Service Provider becomes aware that a child's personal data has been collected without appropriate consent, it will be deleted.
Some third-party providers listed above (Microsoft, Google, Cloudflare) may process data on servers located outside the European Economic Area. Where this occurs, those providers rely on their own legally recognized data-transfer safeguards, as described in their respective privacy policies.
The Service Provider may update this Privacy Policy from time to time. Continued use of the App after changes constitutes acceptance of the revised policy.
If you have any questions about this Privacy Policy, please contact: j7software@post.cz.