The technologies Indo Mail uses to run its website and apps, keep accounts safe, show ads and make AI features work: what each one does, what data it touches, where it runs and the choices you have.
1. About this page
Indo Mail is run by INDO CHATS PRIVATE LIMITED. This page explains, in plain words, the technologies behind indoemail.in and the Indo apps. It sits alongside our Privacy Policy (indoemail.in/legal/data-protection-policy), Terms of Service (indoemail.in/legal/terms-of-service) and Cookie Policy (indoemail.in/legal/cookie-policy). If anything here and the Privacy Policy ever differ, the Privacy Policy wins.
Indian accounts are stored in our data centre region in Mumbai. We use no third-party trackers, no third-party analytics and no software development kits from advertising companies.
2. Browser storage and cookies
The website keeps a few small items in your browser so that you stay signed in and your settings are remembered. None of them is used for advertising or to follow you to other websites.
| Item | What it does | How long |
|---|---|---|
| Sign-in token (local storage) | Keeps you signed in. It is a signed token, never your password. | Until you sign out or it expires |
| Remember me cookie (im_alive) | Only when you untick Remember me: signs you out once the browser is closed. | Until the browser is closed |
| Settings (local storage) | Theme, density, language and the last app you used. | Until you clear browser data |
| App files (service worker) | Lets the app open quickly and show an offline page. It holds no mail unless you turn on Offline mail. | Replaced at each release |
You can delete all of these at any time in your browser settings. The full list is in the Cookie Policy.
3. Advertising
- Contextual only: every plan shows a few ads labelled "Ad". They are chosen from the page you are on and broad signals such as your language and country.
- Never from your content: ads are never chosen from your mail, attachments, files, contacts, chats or what you ask Lily.
- No advertising profile: we do not build an advertising profile of you. Ads based on interests you choose are not offered today; if they are added, they will stay off until you switch them on.
- Children and teenagers: people under 18 never see ads, on any plan.
- Advertisers get totals only: advertisers see counts such as views and clicks, never who you are.
4. Keeping mail and accounts safe
- Spam, phishing and virus checks: incoming mail is checked automatically with SPF, DKIM and DMARC and by our spam filter. When you mark a message as spam or not spam, the filter learns for your account. No person reads your mail to do this.
- Security records: we record sign-ins and failed sign-ins (time, IP address, country and device), sending volumes and bounces, so we can stop break-ins and spam. Automated checks raise alerts; they never read message content.
- Sending limits: new accounts can send to fewer people in their first days, which stops spammers from using free accounts.
- Human check: on sign-up and some sign-in steps your browser solves a small maths puzzle for about a second (Indo Shield). Nothing is sent to an outside company.
5. Encryption
- In transit: every connection to indoemail.in and the apps uses HTTPS (TLS). Mail to and from other services uses TLS whenever the other side supports it.
- End-to-end between Indo Mail accounts: the text of mail between Indo Mail users is locked on your device before it is sent, with an elliptic-curve key and a quantum-safe key. We cannot read it.
- Password-protected mail: for anyone else, you can lock a message with a password that you share another way. We never receive the password.
- Private contacts and events: details you mark as private are locked with your Indo Passwords master password.
6. Signing in
- Passwords are stored only as a salted hash. Nobody at Indo Mail can see your password.
- Passkeys use your phone's or computer's screen lock. We keep only the public half of the key.
- 2-Step Verification uses a code from an authenticator app, with one-time backup codes stored as hashes.
- Email codes and phone QR sign-in let you sign in without typing your password on a shared computer.
- Continue with Google (only if you choose it): Google tells us your Google account number, your name and that your email address is verified. We never ask Google for access to your Gmail, Drive or contacts, and you can unlink it at any time in Account → Security.
7. Lily and other AI features
- Only when you ask: Lily writes, summarises, answers and makes videos only when you ask her to, and works only on what you ask her to look at, inside your own account.
- Hosted in India: Lily's AI models run in our cloud provider's Mumbai region. What you ask and what Lily answers is not kept after the answer.
- Never used for training: your mail, files, chats and requests are never used to train any AI model.
- Your switch: you can turn each Lily feature off in Settings → Lily (AI). Company administrators can turn features off for everyone in the company.
- Indo Video: Lily writes the script and plans the scenes, a speech service in the Mumbai region reads it aloud, and your own browser animates and records the video. Every video shows an "AI-generated" mark. Indo Video does not make footage of real people.
8. Voice and speech
- Voice typing: when you tap the microphone, the recording is turned into text by a speech service in the Mumbai region. The recording and the job are deleted as soon as the text is ready.
- Read-aloud voices: Indo Video and Indo Player send only the words you want spoken, and get back the audio. Neither is kept on our servers.
- Translating speech in Indo Player: when you ask for a translation, the video or song is uploaded to Indo Mail's private storage in the Mumbai region, a speech service in the same region writes down what is said with timings, and each sentence is translated. The uploaded file, the transcript and the job are deleted as soon as the subtitles are ready; the translated subtitles are kept for 7 days and then removed.
9. Location
- Country from your IP address: used to protect your account (for example, to warn you about a sign-in from a new country) and to choose ads for your country.
- Your device's location: only in Indo Maps, and only when you allow location in your browser or the Android app. It is used to rank nearby results; we do not store it or keep a location history.
10. Files on your phone, and downloads from a link
- Videos, music and photos on your phone: in the Indo Mail app for Android, Indo Player, Indo Video and Indo Files can show what is on your phone after you allow it once. Android asks first, and you can take the permission back in your phone settings at any time. The files are played and shown straight from your phone; nothing is uploaded, changed or deleted unless you choose "Save to Indo Drive" or use a file in a video you make.
- Download from a link: when you paste a link, our server fetches that one file into your Indo Drive (up to 5 GB). We only fetch public internet addresses, refuse web pages and video, music or social media sites whose terms do not allow downloading, and keep the link in your download list for 30 days.
- Large files in mail, Chat and Teams: a file over the attachment limit, up to 5 GB, is uploaded to your Indo Drive and sent as a download link. Anyone with the link can download the file until you turn the link off in Indo Drive.
11. Notifications
New-mail and chat alerts are sent only after you allow notifications. The alert is encrypted between our server and your browser or phone. You can turn notifications off at any time in your browser or phone settings, or in Settings → Notifications.
12. Measuring how the service works
To keep Indo Mail fast and reliable we count things such as page loads, errors, sign-ups and how many people use each app. These counts are produced by our own servers, stored in Mumbai and never sent to another company. They never use the content of your mail, files or chats, and they set no cookies.
13. Your choices
- Turn Lily features on or off: Settings → Lily (AI).
- Untick Remember me on shared computers, and sign out of other devices in Account → Security.
- Link or unlink Continue with Google, add a passkey or turn on 2-Step Verification in Account → Security.
- Turn notifications off in your browser or phone settings.
- Get a copy of your data or delete your account: see the Privacy Policy (indoemail.in/legal/data-protection-policy) and FAQ (indoemail.in/legal/faq).
- Questions: write to privacy@indoemail.in or the Grievance Officer at grievance@indoemail.in.