Privacy Policy

1. Summary

Flluet is a Windows email client provided by NexaCloudHub. It allows users to manage email accounts locally on Windows, including IMAP mailboxes and Google Gmail accounts connected through Google OAuth.

This Privacy Policy applies to Flluet and explains what information may be processed, why it is used, how it is stored, and what control users have over their accounts and data.

2. Scope of This Policy

This policy applies only to Flluet. It does not apply to Google, Gmail, Microsoft, email hosting providers, internet service providers, operating system providers, or other third-party services outside our control.

When users sign in to Google, Google's own privacy notices and account controls also apply.

3. Gmail Data Flluet May Access

If a user connects a Gmail account, Flluet requests Gmail access so it can provide the email functions available in the app. Depending on the user's actions, Flluet may access or process:

• message list information such as message IDs, senders, subjects, labels and read or unread state;
• message content needed to display selected emails;
• recipient, sender, subject, body and thread information needed to compose, reply to, reply all to, or forward email;
• mailbox labels such as Inbox and Trash;
• message state changes requested by the user, including marking read or unread;
• message movement requested by the user, including moving messages to Trash or restoring messages from Trash;
• permanent deletion requests selected and confirmed by the user.

Google requires the restricted Gmail scope https://mail.google.com/ for the full Flluet feature set, including permanent deletion. Flluet uses that permission only to provide user-facing email features inside the app.

4. Google OAuth and Passwords

Flluet does not ask for, receive, or store a user's Google password. Google sign-in happens in the user's default browser through Google's OAuth authorization flow.

Flluet uses a temporary localhost callback, PKCE S256 and a state value to complete Gmail authorization. After authorization, Google returns OAuth tokens that allow Flluet to provide Gmail features without collecting a Google password.

5. Local Storage

Flluet stores account information and credentials locally on the user's Windows device. Gmail OAuth tokens are stored locally using Windows secure storage and are scoped to the Flluet profile where the Gmail account was connected.

Connecting the same Gmail address in a second Flluet profile requires a separate Google authorization. Removing a Gmail account from a Flluet profile removes the locally stored token for that profile.

Flluet encrypted .flluet import or export files are for IMAP accounts and do not include Google OAuth credentials.

6. How Information Is Used

Flluet uses email account information and Gmail data to:

• connect the selected email account to the selected local Flluet profile;
• display Inbox and Trash message lists;
• open and display messages selected by the user;
• send new messages, replies, reply-all messages and forwarded messages;
• update read or unread state when requested;
• move messages to Trash, restore messages, or permanently delete messages when selected by the user;
• maintain the user's local account configuration and profile separation;
• troubleshoot errors, preserve app security and comply with applicable legal obligations.

7. Data Sharing and Sale

Flluet does not sell Gmail data or email account data. Flluet does not share Gmail data with advertisers, data brokers, analytics brokers, or unrelated third parties.

Email data may be transmitted to Google or the relevant email provider as necessary for the user-requested email features to work. For example, sending an email through Gmail requires communicating with Google's Gmail API.

We may disclose information only if required by law, legal process, security needs, abuse prevention, or a valid governmental request.

8. Retention

Flluet stores local account configuration and locally protected credentials for as long as the account remains configured in the relevant Flluet profile.

Flluet does not operate a central mailbox database for Gmail messages. Gmail messages remain with Google unless the user takes an action in Flluet that changes the mailbox, such as sending a message, moving a message to Trash, restoring a message, or permanently deleting a message.

9. User Control and Deletion

Users may remove a Gmail account from a Flluet profile. This deletes the locally stored OAuth token for that profile.

Users may revoke Flluet's access from their Google Account security settings. After revocation, Flluet will no longer be able to use Gmail for that account unless the user authorizes it again.

Users may also uninstall Flluet or delete local Flluet app data from their Windows device, subject to normal Windows account and storage permissions.

10. Security

Flluet uses Windows secure storage for locally stored secrets where supported. Users should protect their Windows account, keep their device secure, and avoid sharing local app data or account credentials.

No software or storage method can be guaranteed to be perfectly secure, but Flluet is designed to avoid collecting Google passwords and to keep Gmail authorization local to the user's device.

11. Google API Services User Data Policy

Flluet's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Flluet uses Google user data only to provide or improve user-facing email features selected by the user. Flluet does not use Gmail data for advertising, does not sell Gmail data, and does not allow humans to read Gmail data except where required for security, legal compliance, user-requested support, or abuse investigation and only with appropriate limits.

12. Children

Flluet is not directed to children. Users should use Flluet only if they are legally allowed to use the connected email accounts and applicable services.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. Continued use of Flluet after changes become effective means the user acknowledges the updated policy.