The short version
We do not collect, transmit, store, sell or share any personal data. We could not if we wanted to: the app ships without network permission, has no account system, and there is no server behind it.
Data we collect
None. Specifically, and matching the answers we filed in Apple's App Privacy questionnaire, where every category is marked Data Not Collected:
- Contact info (name, email, phone, address): not collected.
- Health, fitness and financial info: not collected.
- Location: not collected.
- Contacts: not collected.
- User content, meaning your mail, your attachments and your search terms: not collected.
- Browsing or search history: not collected.
- Identifiers, including user ID, device ID and advertising ID: not collected.
- Usage data, analytics, diagnostics and crash logs: not collected.
- Purchases: not collected. See in-app purchases below for what Apple handles.
Why this is verifiable rather than a promise
A privacy policy is usually a statement of intent. This one describes a property of the software that you can check yourself.
The macOS build is distributed without the com.apple.security.network.client entitlement. Under macOS's App Sandbox, an app without that entitlement is prevented by the operating system from opening outbound network connections, regardless of what its code tries to do. To confirm it, run:
codesign -d --entitlements - /Applications/Upstairs.app
and look for com.apple.security.network.client in the output. It is not there.
On the development side the same rule is enforced mechanically: an automated test scans every source file for networking symbols and fails the build if any appear outside the single file that talks to Apple's StoreKit framework.
Your mail archives
Archives you open stay on your device. Upstairs opens them read-only and cannot modify them. It builds a local search index alongside the archive so that searching is fast; that index lives in the app's own storage on your device, is never transmitted, and is deleted when you remove the app.
When you grant access to a file, the app stores a security-scoped bookmark so that it can reopen the same file later without asking again. The bookmark is an operating-system token stored locally. It is not readable by us and goes nowhere.
Remote images in messages
Mail messages frequently contain images hosted on someone else's server. Loading one tells that server you opened the message. Upstairs blocks all remote content by default and shows a banner instead. If you choose to load images for a specific message, your device fetches them directly from whoever hosts them, and that request goes to them, not to us, and it happens only because you asked for it.
In-app purchases
Premium is a one-time purchase sold through Apple's In-App Purchase system. There is no subscription. Payment and refunds are handled entirely by Apple. We never see your payment details, and we receive no personally identifying information about you from Apple.
The app asks Apple's StoreKit framework whether this Apple Account currently holds a Premium entitlement and stores the yes-or-no answer locally. That exchange is between your device and Apple. Apple's own privacy policy governs it: apple.com/legal/privacy.
What is stored on your device
- The recent archives list, so you can reopen a file without finding it again.
- Security-scoped bookmarks, so reopening does not prompt for permission again.
- The search index, so search is fast on large archives.
- The free-tier read ledger, to apply the five-message free limit and to keep messages you already opened free to reopen.
- The Premium entitlement flag, so Premium works offline.
All of it is local, all of it is removed when you delete the app, and none of it is transmitted anywhere.
Children
Upstairs is rated 4+ and is safe for any age, because it displays only files the user already has. It collects no data from anyone, including children under 13.
Third parties
There are none. No analytics provider, no advertising network, no crash reporter, no third-party SDK of any kind. Nothing is shared, because nothing is collected.
Your rights
Regulations such as the GDPR, the CCPA and Brazil's LGPD give you rights to access, correct, port and erase personal data a company holds about you. We hold none, so there is nothing to access, correct, port or erase. Deleting the app removes everything Upstairs stored, all of which was on your device.
This page itself
This policy covers the Upstairs app. The site you are reading it on is served through Cloudflare, which sets a cookie and keeps connection records of its own; that layer is described in the site privacy policy.
Changes to this policy
If a future version of Upstairs ever needs to collect anything, this page will be updated before that version ships, and the change will be described in the app's release notes rather than made quietly.
Contact
Questions about this policy: [email protected]