The one-line version: we hold your mail so you can send and receive it, we hold your chat and call signalling so messages reach the right person, and we use your email address to contact you about the service. That's it. No ads, no mining, no AI training, no US cloud replication.
Who is the controller?
The data controller (the legal entity responsible for your data under the GDPR) is:
Docs Printing SRL
CUI/CIF RO22749955 (VAT-registered) · Nr. Reg. Com. J12/4917/2007
Registered office: Str. Lacul Roșu nr. 5, ap. 5, Cluj-Napoca, jud. Cluj, 400614, România
Phone: +40 749 058 881 · Email: [email protected]
Any mail sent to [email protected] reaches the actual operators, not a support robot.
There is no designated DPO — not required under Art. 37 GDPR at our size and type of processing; the operator acts as the primary data protection contact. For formal GDPR requests, use [email protected].
The competent supervisory authority is Romania's Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. If you live elsewhere in the EU/EEA, you can also lodge a complaint with your own country's data protection authority (Art. 77 GDPR).
What we collect, why, and how long we keep it
| Category | Lawful basis | Retention |
|---|---|---|
| Account identity Email address, chosen username, Argon2id password verifier, optional display name. |
Contract (Art. 6(1)(b)) — we need it to run your mailbox. | While the account is active, then 30 days after deletion for reversal, then purged. |
| Mail content Subject, headers, bodies, attachments for your @tacitusmail.com account. |
Contract — this is literally the mailbox service. | Until you delete it, or until the account itself is purged. |
| External mailbox credentials IMAP/SMTP hostnames, usernames, passwords for Gmail/Outlook/etc. you added. |
Contract — you asked us to fetch those mailboxes. | Until you remove the account. Encrypted at rest with AES-256-GCM. |
| Chat messages Ciphertext between you and another Tacitus user. |
Contract. | Until you or the recipient delete the conversation. We cannot read them — we only relay. |
| Call signalling Who called whom, at what time, outcome (accepted/rejected/missed). Media is peer-to-peer and never stored. |
Contract. | 90 days for the call log, then anonymised counters only. |
| Calendar, notes, contacts Events, notes bodies, address book entries. |
Contract. | Until you delete them. |
| Google account data (only if you connect one) Copies of your Gmail messages, Drive files, photos you pick, contacts and calendar events, plus the OAuth tokens that let us fetch them. See Google account data. |
Contract — you asked us to import or sync it. | Tokens: until you disconnect. Copies: like any other content of yours (until you delete them). Removing the Google account also deletes the mail synced from it. |
| Photo keywords Keywords and visible text that a vision model extracts from your photos so they can be searched. |
Contract — it powers Photos search. | As long as the photo exists. See Photos: keywords, text and faces. |
| Face groups (optional, off by default) Face boxes and numeric face signatures used to group the same person across photos, and the names you give them. |
Your explicit consent (Art. 9(2)(a)) — the Settings switch. | Until you switch it off and press Delete face data, or delete the photo. |
| Billing metadata Stripe customer ID, subscription status, period end, last-four card digits (via Stripe). |
Contract & legal obligation (VAT retention). | As long as legally required by EU accounting law (typically 10 years), then purged. |
| Server & access logs Timestamp, request method, path, response code, originating IP, user-agent. |
Legitimate interest (Art. 6(1)(f)) — abuse and debugging. | 30 days rolling, then auto-purged. |
| Push tokens APNs token, Web Push endpoint, user-agent. |
Contract — needed to deliver notifications you opted in to. | Until you sign out or revoke the device. |
Google account data
You can connect a Google account to Tacitus Mail to import your data (a copy, made once) and to keep it in sync (continuously, until you disconnect). It is always your choice: you start it from Settings → Accounts or from the Drive, Photos and Contacts pages, and Google shows you each permission on its own consent screen first. What we ask for, and why:
| Google access | What we use it for | What we do and do not do |
|---|---|---|
| Gmail (IMAP / SMTP access) | Sync: your Gmail appears as a mailbox in your unified inbox, where you can read, search and send from it. | We store copies of your messages and attachments in your Tacitus mailbox. Things you do to Gmail mail inside Tacitus (send, mark as read, move, delete) are applied on your Gmail account. |
| Google Drive (read-only) | Import: files and folders are copied into your Tacitus Drive. | We never change or delete anything in your Google Drive. |
| Google Photos (Picker API) | Import: only the photos and videos you pick in Google's own picker window. | We cannot browse the rest of your Google Photos library. |
| Google Calendar (read-only) | Sync: your events are shown in your Tacitus calendar. | We never write to your Google Calendar. |
| Google Contacts (read-only) | Import: contacts are copied into your Tacitus address book. | We never change your Google contacts. |
| Basic profile (email address, name) | To show which Google account is connected. | Nothing else. |
- Where it lives. Everything we receive from Google is stored on our servers in the European Union. The access and refresh tokens are stored encrypted and are used only to perform the import or sync you asked for.
- Disconnecting. Remove the Google account in Settings → Accounts. This deletes the tokens and every message that was synced from that Gmail account out of Tacitus. Files, photos and contacts that were already imported are your content and stay until you delete them. You can also revoke access at myaccount.google.com/permissions; sync then stops and Tacitus asks you to reconnect.
- Mail deleted on Google's side. Tacitus is your archive: a message that disappears from Gmail (deleted in another app, or expired by Google) stays in your Tacitus mailbox until you delete it here.
Tacitus Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, for data we receive from Google:
- We use it only to provide the import and sync features you asked for.
- We do not use it for advertising of any kind, and we do not sell it.
- We do not use it to develop, improve or train generalised AI or machine-learning models.
- We do not transfer it to anyone else, except as needed to provide those features (see Sub-processors below), to comply with the law, or with your consent.
- No person at Tacitus reads it, unless you ask us to for support, it is needed to investigate abuse or a security incident, or the law requires it.
Photos: keywords, text and faces
Keywords and text. To make your library searchable, a reduced-size copy of each photo is analysed by a vision model that returns keywords and any text visible in the picture. The analysis runs entirely on our own servers — no third party receives your photos for it — and the resulting keywords are stored with your photo in the EU. This applies to every photo in your library, including ones you imported from Google.
Faces (optional). People in Photos is off by default and available on paid plans. When you switch it on in Settings → Accounts, a face detector on our own server finds faces in your photos taken from 1 October 2026 on and computes a numeric signature for each, so look-alike faces can be grouped. Nothing is named unless you press People on a photo and type a name; once you do, we mark similar faces in your other photos with that name for you to review. Face data is never sent to a third party and never used for anything else. Switch the feature off, and press Delete face data in Settings, to remove every face and name.
What we do NOT do
- We do not load any third-party analytics, pixel, session replay, or fingerprinting SDK in the web client. No Google Analytics, no Facebook pixel, no Segment, no Hotjar.
- We do not sell, rent or trade your data to advertisers, brokers, or anyone else. There is no arrangement to.
- We do not train AI / language models on your mail, chat, calendar, notes or contacts. Not our own models, not anyone else's.
- We do not inject tracking links into your outbound mail.
- We do not replicate your mail, chat or calendar events to storage outside the European Union.
- We do not read your mail to tailor ads. Automatic labels (Finance, Newsletters, Work…) are worked out by rules and AI models that run on our own servers; your mail is not sent to a third party for that.
Sub-processors
We use a small number of service providers whose role is strictly infrastructure. Each is listed below with its purpose and region. If we add a new sub-processor, this list is updated and the "Last updated" date at the top changes.
- Hetzner — EU (Germany / Finland) dedicated server hosting. All application data sits on disks rented from Hetzner under a Data Processing Agreement.
- Let's Encrypt — free TLS certificates for
tacitusmail.comandmail.tacitusmail.com. They see the domain name, not the content. - Stripe — billing and VAT. Stripe sees your card details and billing address for paid plans; we only receive a customer ID and subscription status back. Stripe is processed under their Data Processing Addendum.
- Apple Push Notification Service (APNs) — delivery of notifications to the iOS app. APNs receives the opaque device token and the encrypted notification payload (sender name, subject preview truncated to 80 characters).
- Cloudflare, Inc. — CDN, DDoS protection and TLS termination for
the website and API: traffic to
tacitusmail.compasses through Cloudflare's network, which can see requests in transit. Cloudflare is a US company and processes under its Data Processing Addendum (EU Standard Contractual Clauses). It does not store your mail. - Google — not a sub-processor but the provider you ask us to connect to. Data flows from Google to us; back to Google only for actions you take, such as sending mail from your Gmail account.
- Mailgun / Postmark (only if configured as an outbound relay for reputation — disabled by default). Would see the envelope of outbound mail destined for third-party recipients. Body is delivered unchanged.
International transfers. Apple Push Notification Service is operated by Apple in the United States. It only ever receives an opaque device token and a truncated notification payload (sender name, subject preview capped at 80 characters) — never your full mail, chat or calendar content. This limited transfer relies on Apple's self-certification under the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. Cloudflare (US) sees web traffic in transit under its Standard Contractual Clauses. Your stored data — mail, files, photos, chat, calendar, contacts — is kept only on servers in the European Union.
Your GDPR rights
If you are in the EU / EEA, the GDPR gives you a specific set of rights over your personal data. We honour all of them, whether or not you are a paying customer:
- Right of access (Art. 15). You can request a copy of every piece of personal data we hold about you. Response target: 7 days.
- Right to rectification (Art. 16). You can ask us to correct inaccurate data — or just edit it yourself in the web UI.
- Right to erasure / to be forgotten (Art. 17). You can delete
your account from
/settings/accounts, or email us, and everything listed in the table above is purged within 30 days. Backups containing your data age out of rotation within another 30 days. - Right to data portability (Art. 20). You can export every
mail as an
.mboxfile and every contact as.vcard. Calendars export as.ics. Notes export as markdown. - Right to restrict processing (Art. 18). Pause sync or outbound delivery without deleting your account — email us and we will.
- Right to object (Art. 21). Object to processing based on legitimate interest (e.g. ask us to stop keeping server logs for you). Note that for some flows — particularly abuse handling — we may still need to retain minimum metadata.
- Right to lodge a complaint. You can complain to your local data protection authority. We'd rather you tell us first so we can fix whatever the issue is.
Cookies
The web client uses exactly one cookie:
access_token — the HTTP-only, Secure, SameSite=Strict session JWT
that proves you're logged in. It's set on /auth/login, cleared on
/auth/logout, and never read by client-side JavaScript. We do not
use advertising, analytics, or tracking cookies.
Your UI preferences (theme, sidebar accent, background pattern, mail view mode,
density) are stored in localStorage in your browser only. We never
read them from the server.
Contact
- General privacy questions & GDPR requests: [email protected]
- Security incidents: [email protected]
- Abuse reports: [email protected]