Privacy Policy

Effective date: 6 September 2026 · Last updated: 5 October 2026 (Drive now has an optional encrypted folder that we cannot open; sent mail, drafts, attachments and Drive files are now encrypted at rest; the introduction states where our servers are; section 6 explains how to use end-to-end encryption yourself; Tobava Video can make AI clips, pictures, voices and presenters through a generating service you choose, with your own key — section 7)

1. Who we are

Tobava Pty Ltd, ABN 83 696 573 010, PO Box 60, Mansfield QLD 4122, Australia. We are the entity responsible for the personal information described in this policy. Contact details are at the end.

2. What we collect

Information you give us when you create an account: your chosen email address, your name, a password (which we store only as a bcrypt hash — we never store or can recover the password itself), and optionally a recovery email address, phone number and postal address.

Information we derive from your connection: the IP address you sign up and sign in from, and from it an approximate country and city, and the name of your internet provider. This is used to select your billing currency, to detect automated and fraudulent sign-ups, and to show you your own recent sign-in activity.

The contents of your mailbox: the messages you send and receive, their attachments, folder structure, contacts, filters, signatures and settings. We hold this because it is the service — an email provider cannot deliver or display mail it does not store.

Service and security logs: connection records for the web, IMAP and SMTP services, including timestamps, IP addresses and the result of the request. These are used to operate the service, investigate faults, and detect abuse.

If you use the Tobava Mail app for iPhone or Android: if you allow notifications, a device push-notification token, stored with your account so we can send notifications to that phone; and a random identifier the app sends to its update service when it checks for app updates. Neither is used for advertising or to track you across other apps or websites.

Billing information: your plan, subscription status, and a record of payments. We never see or store your card details — those go directly to Stripe (see section 7).

3. What we do not do

We do not scan the contents of your mail to build an advertising profile, and we do not sell, rent or trade your personal information to anyone.

We do not use third-party advertising or analytics networks on our website. Our usage analytics run on our own servers, first-party, and record page URL, referrer, and coarse device and country information — not individuals.

Your IP address is never sent to a geolocation service. The country lookup described above runs against a database held on our own servers, so the lookup never leaves our infrastructure.

4. Automated processing of your mail

Anti-virus and anti-spam. Inbound mail is scanned for malware and spam on our own servers before it reaches your mailbox. Nothing is sent to an external scanning service.

AI features. Tobava Mail includes optional writing-assistance features — suggested replies, drafting help and message summaries. These are never automatic: nothing happens until you press the button for that feature on a particular message.

When you do, the content of that message (and, for a reply, the message you are replying to) is sent to our AI provider, Groq, Inc. in the United States, which generates the suggestion and returns it. If Groq is unavailable, the same request may instead go to Google (the Gemini API, United States), or to an AI model running on our own servers in Australia. We send only what is needed to produce the result, and we do not send your mailbox, your contacts, or messages you have not asked us to process.

If you never use these features, no message content is sent to any third party for processing. (Separately, if you install the mobile app and allow notifications, the sender and subject of new messages pass through the notification services named in section 7 — never the message body, and you can limit this to the sender only, or nothing.) We do not run them in the background, and we do not use your mail to train any model of our own.

Tobava Video has separate, optional features — AI clips, AI pictures, AI voices and presenters — which use a generating service that you choose and hold your own account with. They are described in section 7. Tobava Video’s built-in voices are different: they are produced by a voice model that runs on our own servers, so the words to be spoken are not sent to anyone else, and they are not kept once they have been spoken.

5. Cookies and local storage

We use cookies and browser storage only to keep you signed in, to remember interface preferences, and — if you choose it — to remember a device you have already completed two-factor authentication on, for up to 30 days. We do not use tracking or advertising cookies.

6. How your mail is protected — and the limit of that protection

Connections to our services are encrypted in transit (TLS). What we store is encrypted at rest with AES-256-GCM: the bodies of messages you receive, send, schedule or save as drafts, their attachments, and your files in Drive. Backups are encrypted. Subject lines, addresses and dates are not encrypted at the application level, because we need them to sort, search and deliver your mail.

Attachments, Drive files, and the copies of messages you sent or saved as drafts were not encrypted this way before 5 October 2026. Those stored before that date remain as they were saved, and are protected by access controls on our servers.

Tobava Mail is not end-to-end encrypted, and we do not claim to be a zero-knowledge provider. The encryption keys are held by our servers, which means our systems can decrypt your mail in order to display, search, index and deliver it — and it means we could be compelled to produce it under a valid Australian legal order. Any provider that offers webmail search, server-side filtering and IMAP access is in the same position, whatever the marketing says.

End-to-end encryption is available to you at any time, and using it is your responsibility. Encrypt the message with OpenPGP on your own device, with a key that stays on your device, before it reaches us — in your own mail app (on plans that include mail-app access), or with an OpenPGP tool whose output you paste or attach in webmail. Mail encrypted that way cannot be read by us.

Because it happens on your side, the rest is yours to look after: you choose and set up the software, you create and keep the key, and the people you write to must use OpenPGP as well. We never hold that key, so if you lose it we cannot recover it or any mail encrypted with it. OpenPGP protects the body and attachments of a message; the subject line, the addresses and the date are not encrypted and remain visible to us. The PGP key feature in Settings is a different thing: that key is kept on our servers, so it is not end-to-end encryption.

Drive has an optional encrypted folder, on Plus and higher plans. Files you put in it are encrypted on your device, under a password we are never sent, before they reach us. We store them, but we cannot open them or see their names, and we cannot preview, search or share them for you.

If you forget that password and lose the recovery key you were given when you set the folder up, everything in the folder is lost for good. We do not have your password and cannot reset it, recover it, or open your files. Keeping the password and the recovery key safe is your responsibility.

Access to production systems is limited to personnel who require it, over key-based authentication with multi-factor authentication enforced on administrative accounts.

7. Who else receives your information

We disclose personal information only to the following, and only as needed to run the service:

• Stripe (payment processing). Receives your email address, billing address and card details, which are entered directly with Stripe and never pass through our servers. Stripe is based in the United States.
• Cloudflare (network protection). Our Australian site is served through Cloudflare, and we use Cloudflare Turnstile to distinguish real sign-ups from bots. Cloudflare processes the IP address and connection metadata of requests to those services.
• Groq, Inc. (AI writing assistance), and Google LLC (Gemini API) as a fallback when Groq is unavailable. Either receives the content of a specific message only at the moment you invoke an AI feature on it, as described in section 4. Both are based in the United States. If you do not use these features, nothing is sent.
• A generating service you choose (AI clips, AI pictures, AI voices and presenters in Tobava Video) — only if you add your own key for one and ask for something to be made. At present the service is fal.ai (Features & Labels Inc., United States). You hold the account with that service and it bills you directly. Our servers send it only what the thing you asked for is made from, when you press the button that makes it:
  • a clip — the description you typed and the frames you chose (a scene of your video as a picture, or a picture you picked);
  • a picture — the description you typed;
  • a voice — the words to be spoken (what is said over the scene or scenes you chose);
  • a presenter — the picture of the person who is to speak, and what they say: the words (which are first spoken as a voice, as above), or the sound recording you chose — the scene’s recorded voice-over or a sound file. A photograph of a real person and a recording of a real voice are personal information about that person; you must only use them with that person’s agreement, and Tobava Video asks you to confirm this for a photograph you add.
  Our servers then fetch what was made, which is saved in your Drive or in the video. Nothing else from your video, your Drive or your mailbox is sent. What the service does with what it receives, including whether it passes it on to the company that makes the model you selected, is governed by its own terms and privacy policy, not by this one. Your key is stored encrypted on our servers, is used only to make these requests, is never shown again, and is deleted when you remove it. We keep a record that something was requested — what kind of thing, the model, the time, its status and where the service put the result — but not the description, the words, the pictures or the sound. If you do not use these features, nothing is sent.
• Google (Firebase Cloud Messaging, for the Android app) and Apple (Apple Push Notification service, for the iPhone app) — only if you install the Tobava Mail mobile app and allow notifications. Our servers send each notification directly to the service that runs your phone’s notifications, with no other company in between. To show it, that service receives the device push token and, by default, the sender’s name and the subject of each new message, or a calendar reminder’s title. Message bodies are never sent. In the app, More › Lock-screen previews limits this to the sender only, or to a generic “New message”. Both are based in the United States.
• Mail recipients and their providers. Email is, by its nature, disclosed to whoever you send it to and to their mail provider. We cannot control what a recipient's provider does with a message you send them.
• Australian law enforcement and regulators, where we are legally required to disclose information under a valid order. We will not disclose customer data on an informal request.

We do not use third-party advertising networks, data brokers, or external analytics providers.

8. Where your information is stored, including overseas

Your mailbox and account data are stored in Australia, on servers we operate in an Australian data centre.

Encrypted disaster-recovery backups are replicated to a server located in the United States. We disclose this because Australian Privacy Principle 8 requires it. The purpose is solely to ensure your data survives the loss of the Australian facility; the copies are encrypted, are not used to serve the product, and are not accessed in the ordinary course of operating it. By using the service you acknowledge this overseas replication. Note that once information is held overseas, Australian law may not be enforceable against the overseas host in the same way.

An encrypted backup of the mail database is also copied nightly to pCloud, in the European Union (Luxembourg). It is encrypted on our servers before it is sent, pCloud cannot read it, and it exists only so your data can be restored if both of our other copies are lost.

In addition, Stripe, Cloudflare, Groq and Google, and — for mobile app notifications — Apple and Google (section 7) process the limited information described above outside Australia. For Groq and Google that information can include the text of a message you have chosen to run an AI feature on, so if a message is sensitive, do not use the AI features on it. If you use AI clips, AI pictures, AI voices or presenters in Tobava Video, the generating service you chose (at present fal.ai, in the United States) receives what is listed for each in section 7 outside Australia; where it, and the maker of the model you selected, process them is set out in that service’s own policy.

9. How long we keep it

We keep your mailbox for as long as your account is open. If you delete a message it is moved to Trash, and removed from our systems when Trash is emptied or expires; deleted data may persist in encrypted backups for a limited period until those backups rotate.

Dormant accounts without an active paid subscription are deleted after six months of inactivity (from 14 October 2026; 12 months until then, as our Terms previously stated). We send a warning email about a month beforehand, and a final warning about a week beforehand, to the address on the account. Signing in at any point resets the clock. Paid accounts are not deleted for inactivity.

If you close your account (Settings → Privacy → Delete account, on the website), it is closed and signed out everywhere straight away, and any paid subscription is cancelled. We then hold it for 30 days before erasing it, so that a closure made by mistake, or by someone who got hold of your password, can be reversed: signing in again within the 30 days cancels the deletion and nothing is lost. Mail addressed to you during that time is still received and is erased with everything else. After 30 days we delete your mailbox and personal information, retaining only what we are legally required to keep — principally billing records, which Australian tax law requires us to hold for five years. If you need your data erased sooner, email support@tobava.com from the account's recovery address.

10. Your rights

Under the Privacy Act you may:

• Access the personal information we hold about you. Most of it is visible in the product; for anything else, ask us.
• Correct anything inaccurate, from your account settings or by contacting us.
• Export your mail. You can download it yourself over IMAP on a paid plan, or ask us for an export.
• Delete your account and its contents (erased 30 days after you close it; see section 9).
• Complain if you think we have mishandled your information — see below.

We do not charge for these requests and will respond within 30 days.

11. Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what you should do — without waiting until we have every detail.

12. Children

Our Terms of Service limit accounts to people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account or given us personal information, contact us and we will delete it.

13. Third-party data sources

IP geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International Licence. This database is held on our own servers; no IP address is sent to DB-IP.

14. Changes to this policy

We may update this policy. If a change materially affects how we handle your personal information — for example, introducing an external AI provider, or changing where data is stored — we will notify you by email or in-app notice at least 14 days before it takes effect.