Privacy Policy

Effective October 8, 2026

This policy explains what the WayStation app and this website ("WayStation", "we", "us") do with information. WayStation is operated by WayStation Security.

1. Information that stays on your phone

• Linked accounts. Your email address, provider type and, for IMAP, the server name.
• Sign-in secrets. Your Microsoft sign-in token. (IMAP and app-specific passwords will be stored the same way when IMAP support arrives.) These are stored in Android's encrypted storage (Android Keystore) and are used only to connect to your provider.
• Emails you open. Messages are loaded into the app's memory while you use it. In Pro, anything you don't save is erased when you close WayStation.
• Your vault (Pro). Emails you choose to save are stored encrypted on your phone until you remove them or uninstall WayStation.
• Settings. Your plan and preferences.

We can't see any of this. Uninstalling WayStation deletes it.

2. Your email provider

WayStation connects directly from your phone to your provider:

• Microsoft (Outlook, Hotmail, Live, MSN, Microsoft 365). You sign in on Microsoft's own page. WayStation requests Mail.ReadWrite (to show your mail and move emails you choose to Deleted Items), User.Read (to learn your email address) and offline_access (to stay signed in). WayStation never sees your Microsoft password. Microsoft's handling of your data is covered by the Microsoft Privacy Statement.
• iCloud and other IMAP providers (coming soon). When they arrive, WayStation will connect to your provider's IMAP server over an encrypted connection (TLS, port 993) using the credentials you enter.

WayStation only changes your mailbox when you ask it to: deleting moves mail to your provider's Trash, and the optional "delete opened emails on close" setting is off unless you turn it on. Opening an email in WayStation does not mark it as read in Outlook. (IMAP accounts, when they arrive, will fetch messages without marking them read.)

3. Threat checks (Pro)

Most checks run entirely on your phone: sender authentication results, look-alike domains, link tricks and risky file types.

If online scanning is turned on in a future version, WayStation sends the web addresses found in an email to our scan service, which checks them with Google Web Risk, and sends attachments for an antivirus scan. The scan service processes these in memory, returns a result, and does not store the links, files, or email content. Only a short fingerprint of the result is logged for reliability. We will update this policy and the app before turning this on.

4. Purchases

Pro subscriptions are sold through a payment provider: Stripe (Stripe Managed Payments) for the website version, or Google Play or Samsung Galaxy Store for those versions. The provider handles your payment details. We receive limited purchase information (such as an order or license ID, plan and status) to unlock Pro. We never see your full card number. Your provider's privacy policy applies to the payment.

5. This website

This site is hosted on GitHub Pages. It uses no cookies, analytics, or trackers. GitHub may log basic technical data (such as IP address) for security, as described in the GitHub Privacy Statement. If you email us, we use your message only to reply.

6. What we don't do

• We don't sell or share personal information.
• We don't show ads or use your email for advertising or for training AI models.
• We don't use analytics or tracking SDKs in the app.

7. Your choices and rights

• Remove an account any time in Settings. For Microsoft, you can also revoke access at account.live.com/consent/Manage.
• Clear your vault by removing emails or uninstalling WayStation.
• Because we don't hold your email or account data, most requests to access or delete data are handled on your phone. For anything else, including purchase records, contact us.

Depending on where you live (for example California or the EU), you may have rights to access, correct, delete or port your information. Contact us and we'll help.

8. Security

Sign-in secrets are stored in Android's encrypted storage. (Your Pro license key moves to the same encrypted storage in an upcoming update.) Mail connections use TLS. Emails are shown in a sandbox with scripts, remote content and links disabled. No system is perfectly secure, so keep your phone locked and up to date.

9. Children

WayStation is not meant for children under 13, and we don't knowingly collect information from them.

10. Changes

If we change this policy, we'll update the date above and, for important changes, tell you in the app.

11. Contact

WayStation · waystationapp@outlook.com