Privacy Policy
Last updated 28 September 2026.
Envoy is the mail app The House of Kemmy (“we”) provides to the people and organisations whose email we host. This policy covers the Envoy apps for iPhone, iPad, Android, Mac and Windows, and the Envoy service they talk to. In short: your mail stays between you, your devices and our mail servers, and nothing is sold, shared for advertising, or used to track you.
What we collect, and why
- Your email address and password, to sign you in to the mailbox your organisation gave you. On a phone the password is checked by our mail server and then kept there sealed with a key that only your phone holds, so the service cannot read it by itself; the phone never stores it. On a computer it is kept encrypted in the computer’s own keychain.
- Your mail: messages, attachments, folders and contacts you have written to. They live on our mail servers because that is where your mailbox is. The Envoy service also keeps a working copy of mail for the phones signed in to that mailbox, so they open quickly; it is deleted on request or when the mailbox is closed.
- A device token for each phone or computer you sign in on, and the push token Apple or Google gives the app, so we can tell that device when new mail arrives. A notification can show who a message is from and its subject.
We use this only to provide the mail service to you. We do not use it for advertising, profiling or tracking, and we do not sell or rent it.
What stays on your device
The apps keep a copy of your recent mail on the device so they open instantly and work with a weak connection, plus your settings. Signing out of a mailbox removes its copy, its token and its push registration.
Who else sees it
- Your organisation’s administrators can manage your mailbox (for example reset a password or suspend it), as your organisation’s agreement with us allows.
- Apple and Google deliver notifications to your phone. The notification passes through their push services, encrypted in transit.
- The people you write to, and their mail providers, receive what you send them.
- The law: we disclose information only where the law requires it.
We do not read your mail except where you ask us to for support, or where the law requires it.
No tracking
The apps contain no advertising, no third-party analytics and no tracking, and send no usage statistics.
Pictures in messages
A picture in an email can tell its sender that you opened it. You can stop pictures loading in Settings, Reading, and load them one message at a time.
Security
Everything between the apps, the Envoy service and our mail servers travels encrypted. Passwords are never stored in plain text.
How long we keep it
Your mail is kept for as long as your mailbox exists. Device and push tokens are removed when you sign out on that device or it stops using the app. When your organisation closes your mailbox, its mail is deleted from our servers.
Your choices and rights
You can sign out of any mailbox on any device at any time, which removes that device’s copy and tokens. You can ask us for a copy of your data, to correct it, or to delete it, by writing to hi@kemmy.org. Your mailbox itself belongs to your organisation’s account with us, so closing it may also go through your administrator.
Children
Envoy is made for work and organisation mailboxes and is not directed at children.
Changes
If we change this policy in a way that matters, we will say so in the app or by email before it takes effect, and update the date above.
Contact
The House of Kemmy, hi@kemmy.org.