Updated September 7, 2026
CubMail privacy policy
CubMail is published by SAS Clyb, 4 rue des Roquettes, 49500 Segré-en-Anjou Bleu, France. This policy explains the optional services used by the app.
Mail and attachments
CubMail connects directly from the app to the IMAP and SMTP servers configured by you. SAS Clyb does not receive or retain received message bodies or their photos and attachments.
Data kept on the device
Account settings, contacts and preferences are stored locally. Passwords are placed in Apple Keychain or Android encrypted storage. Device backups for CubMail secrets are disabled.
Optional notifications
When enabled, the private relay stores the mailbox address, device push token and encrypted IMAP credentials. It reads only the message headers needed to detect new mail and prevent automatic-reply loops. It never downloads received message bodies or attachments. The minimal alert is delivered through Apple APNs or Google FCM.
Optional CubMail sync
When enabled, CubMail contacts, profile photo, sending identity, Reply-To, automatic Bcc and text/HTML signatures are sent over HTTPS and encrypted at rest. This profile never contains emails or attachments.
Optional automatic replies
When scheduled by you, the relay stores encrypted IMAP/SMTP access, start and end dates, subject and reply text so it can send the response through your SMTP server. It never reads the incoming message body. An encrypted recipient address and a hashed identifier are retained for up to 90 days to prevent duplicate replies.
Ads, consent and purchase
CubMail uses Google AdMob after the applicable Google UMP privacy choices. Google may process IP address and approximate location, device or advertising identifiers, ad and product interactions, performance and diagnostics for advertising, measurement and fraud prevention. CubMail never sends email content, contacts, attachments or IMAP/SMTP credentials to AdMob. A restorable one-time store purchase removes all ads.
Retention and deletion
Inactive device authorizations and orphaned synced profiles are deleted after 30 days. Automatic-reply delivery records expire after 90 days. Removing a mailbox can keep its profile for another active device or delete it globally. Relay credentials, delivery records and queued alerts are revoked when the mailbox is removed.
Your choices and rights
Notifications and sync are optional and separate. Where required, the in-app Privacy choices entry lets you revisit advertising consent. You may access, correct or delete local data in the app and exercise GDPR rights through contact@esimdual.com. SAS Clyb does not sell personal data and the CubMail website sets no tracking cookie.