How notices reach you
We hold no email address for you, so we do not send notices by email. General notices are posted here, and in the Atom feed, which any feed reader can follow. Subprocessor changes are posted at least 30 days before they take effect. A notice meant for your account alone arrives in the app, in its support inbox, with a push notification on devices where notifications are on.
Follow the feed at mailcycle.email/notices/feed.xml to be told of a new notice. The Terms, the DPA and the Privacy Policy say which notices are given here.
Terms: a free 7-day Scale trial
· Terms and policies
A Free account that has never paid for a plan can now start one free 7-day trial of Scale from Billing on the web. No payment details are taken and nothing is charged. The trial has lower limits than Scale, shown in Billing before it starts. Section 8 of the Terms describes it. This only adds something, so it takes effect today.
When a trial or a paid plan ends and the account moves to Free, AI agents are paused, since the free tier has never included them, and they no longer take the place of a device Free keeps. As before, choosing a plan within 21 days restores everything paused, AI agents included and without pairing them again, and anything still paused after that is deleted. Section 8 now says so.
Terms, Privacy Policy and Cookie Policy: corrections
· Terms and policies
We checked these pages against how Mailcycle works again and corrected them. Nothing about how we use your data has changed; the pages now describe it accurately, so the changes take effect today.
Terms, section 12, and Privacy Policy. Deleting your account cancels a Google Play subscription at the same moment as a card subscription; if that fails, we cancel it ourselves. A subscription billed by the App Store cannot be cancelled for you, so cancel it in the App Store first. This replaces the statement that deleting an account does not cancel a Google Play subscription.
Terms. The sign-up box now reads “I’m 18+ and agree to the Terms of Service”, and the Terms quote it. It no longer asks you to accept the Privacy Policy, which is information for you and not part of the contract. The contents list now matches the section headings.
Privacy Policy. Visit counting, when you allow it, also records your operating system and screen size, as the Cookie Policy already said.
Cookie Policy. It now lists three values the web app keeps: a reminder that the recovery phrase has not been confirmed as saved, and a partner’s referral code and a note that it was seen, both kept only until the browser tab is closed.
Subprocessors described by role, names on request
· Subprocessors
The separate Subprocessors page is removed. Annex A of the Data Processing Agreement and the Privacy Policy now describe each subprocessor by what it does and where it processes data: our hosting and infrastructure provider (database and storage in Western Europe, network global), a fallback mail sending provider (European Union) and a push notification provider (United States). Card, cryptocurrency and in-app payments are still named, since you buy through them.
No subprocessor has changed, and nothing about how your data is processed has changed. A customer who wants the names can ask at hello@mailcycle.email. A new or replacement subprocessor is still announced here at least 30 days ahead, with its role and location, and named in a notice to your account in the app.
Terms, Privacy Policy and Cookie Policy: corrections
· Terms and policies
We checked these pages against how Mailcycle works and corrected them. Nothing about how we use your data has changed; the pages now describe it fully, so the changes take effect today.
Terms, section 12. Deleting your account cancels a card subscription with Polar at the same moment. If that fails, the account is still deleted, and we stop the subscription when its next charge arrives and refund that charge. This replaces the statement that the account would not be deleted, which is also corrected in our notice of 25 September 2026.
Privacy Policy. When a partner preloads Mailcycle on a phone, the partner's code is recorded with the device, and against an account that pairs such a phone before it has ever paid, so that we can pay the partner a share; the code names the company, never a person. A domain you bring is also set up with our fallback sending provider, so mail you send from it can go out when our main sending provider cannot send it. The audit history also records changes made by a team member or by us.
Cookie Policy. It now lists the two values the developer docs keep in your browser, and the partner's code and update record kept on a partner's Android phones, and no longer lists the welcome tour, which has been removed.
New subprocessor: a fallback sending provider
· Subprocessors
A fallback mail sending provider is added to our subprocessors, processing in the European Union. When our main sending provider refuses a message, or its daily allowance is spent, the message goes out through the fallback provider instead, from the same address. It then handles that message as the main provider does: in the clear, with its sender, recipient, subject, content and attachments, and keeps it and a delivery log for its own retention period.
Mail you receive never passes through it, nothing sent through it is tracked, and the copy in your Sent folder is still sealed to your address's key before we store it.
This takes effect today, without the 30 days' notice section 5 of the Data Processing Agreement provides for. You may still object within 30 days of this notice, by writing to hello@mailcycle.email. As section 5 says, we will discuss it with you in good faith, and if we cannot offer a reasonable alternative you may end the Terms for the affected Service without penalty, with a refund of any part of a plan period paid for after the end date and of your unspent paid account balance.
Privacy Policy: audit history, event history by day, device groups and teams
· Terms and policies
The Privacy Policy now describes the records kept by four new features. They add records rather than changing how we use anything we already hold, so the change takes effect now.
Audit history. Each change to your account, such as a sign-in, an API key made or a device removed, is recorded with the change, the id of the session, API key or device that made it, what it was made to, and the time. No IP address and no content. It is kept 90 days, a year on Fleet and two years on Enterprise, and shown on Fleet and above.
Event history by day. On Fleet and above, activity older than 90 days is kept as a count of each kind of event per day, for a year on Fleet and two years on Enterprise.
Device groups and teams. Device groups hold which of your devices are in each group; the group's name is encrypted on your device. If you use teams, we hold who is in each team, the key each member confirmed when they joined, which addresses each member holds and with what access, and those addresses' keys sealed on the owner's device to each member. We cannot open those keys, but we do know the membership.
Legal pages written around UK law
· Terms and policies
The Terms, Refund Policy, Privacy Policy and Data Processing Agreement now refer to UK law and do not name other jurisdictions. None of this takes anything away from you, so it takes effect now.
If you are a consumer, your right to cancel within 14 days, and the mandatory consumer laws of the country where you live, are unchanged. The Privacy Policy says you can complain to the Information Commissioner's Office or the data protection authority where you live or work.
The Data Processing Agreement now incorporates whatever transfer clauses the data protection law that applies to you requires, instead of naming particular ones. A countersigned copy is available on request.
Breach notice, and three DPA commitments, brought in line with the law
· Takes effect · Terms and policies
These changes narrow promises we made, so they take effect on 26 October 2026, 30 days after this notice. Until then the earlier wording applies. If you do not accept them, you may end the Terms before then, and we refund any part of a plan period you have paid for that falls after that date, and your unspent paid balance.
Personal data breaches (Privacy Policy section 8). We notify the Information Commissioner's Office, and any other authority we must notify, without undue delay and within the time the law requires. We tell you directly, in the app, when a breach is likely to result in a high risk to you, which is the test the law uses, rather than for every breach likely to result in any risk, and without a fixed 72-hour limit for telling you.
Breaches affecting data we process for you (DPA section 7). We notify you without undue delay, as Article 33(2) of the GDPR requires, rather than within a fixed 72 hours.
Confidentiality (DPA section 3) now describes what is true of our one-person operation instead of training and access reviews. Written confirmation of deletion (DPA section 10) is given when you ask before deleting the account and give us an address to send it to.
Privacy Policy changes (section 11) are announced before they take effect, and at least 30 days before if they change how we use personal data we already hold.
Refunds, the account balance, liability and transfers, after a legal review
· Terms and policies
We had our legal pages reviewed and changed them where the law gives you more than they said. These changes only add to your rights or describe what already happens, so they take effect now.
Cancelling within 14 days. If you are a consumer, you can now cancel each new plan purchase and each balance top-up within 14 days, not only your first plan payment, from Plans & Billing, Cancel within 14 days. We refund within 14 days, with no fee, including the network fee on a cryptocurrency refund. At checkout you now tick a box asking for the plan to start straight away, and after paying you can save a receipt.
Your account balance. Money you paid into the balance and have not spent is refunded if you cancel the top-up within 14 days, if we close your account or stop your plan or the Service, if you leave because of a change we made, or if you ask before deleting your account. The delete screen now shows the balance and opens the request for you. Credit we give you free is kept apart and is not refunded.
Liability. The Terms now separate consumers and businesses. For consumers, we are responsible for foreseeable loss our breach causes, and your Consumer Rights Act rights are unaffected. The customer indemnity applies to business customers only. If you are a consumer, you can bring a claim in your local courts.
Support. Requests are answered in order of the support level on the pricing page: Priority first, then Standard, then Basic. Reply times are stated as targets.
International transfers. The DPA now relies on the EU's adequacy decision for the UK, with the Standard Contractual Clauses as a fallback, governed by the law and courts of the Netherlands. The Privacy Policy now says that mail is processed in the clear, for the length of the request, at whichever of our hosting provider's data centres handles it, which may be outside the UK and the EEA.
Our SDKs for TypeScript, Python, Go and Rust are now licensed under the Apache License 2.0, so you can build them into your own software and ship it. The mailcycle-mcp licence keeps its terms, with your consumer rights stated.
Our registered company details are now shown on every page of this website, the documentation and the app.
Corrections to the Terms, Privacy Policy, Refund Policy, DPA and subprocessor list
· Terms and policies
We compared our legal pages with what the service actually does and corrected them where they differed. None of these changes takes anything away from you; they describe what already happens, or what the app now does.
Deleting your account now cancels a card subscription with Polar at the same moment. If it cannot be cancelled, the account is not deleted. A subscription bought through the App Store or Google Play is not cancelled by deleting the account and has to be cancelled in the store. Any account balance is deleted with the account. A new page, mailcycle.email/delete-account, explains how to delete an account and what is kept.
You can now cancel a subscription in the app, under Plans & Billing. The plan stays until the end of the period you paid for, nothing more is charged, and the account then moves to Free.
Periods paid in cryptocurrency or from the account balance are 30 days. Card and in-app subscriptions renew on the payment provider's monthly billing date.
A first plan bought from the account balance can now be cancelled or refunded like any other first plan payment, and the refund goes back to the balance.
The Terms and the Refund Policy described chargebacks as recorded automatically. Our card provider does not tell us about disputes: a reversed card payment reaches us as a refund. The pages now say so: a refund is recorded, the plan is not taken away automatically but runs to the end of the period paid for and is not renewed, and we may mark an account past due or suspend it by hand. A full refund of a card plan payment also cancels the card subscription.
The Refund Policy now says that when Apple or Google refund a purchase, the subscription stops renewing and the plan runs to the end of the period that purchase paid for.
General notices are now posted on this page and its feed. A notice for one account arrives in the app's support inbox, with a push notification where the device has them on. Subprocessor changes are posted here at least 30 days ahead; there is no email list, because we hold no email address for you.
A personal data breach is now described the same way in the Privacy Policy and the DPA: we notify affected customers without undue delay, and within 72 hours of becoming aware of it, in the app, and here when it affects everyone.
The Privacy Policy's minimum age is now 18, the same as the Terms. Sign-up asks you to confirm that you are 18 or over and agree to the Terms and the Privacy Policy.
The Terms now define Customer Data as the mail and content we process for you, matching the Privacy Policy and the DPA; account and billing data is ours as controller. References to an Enterprise order form now refer to the written agreement we sign with Enterprise customers. The DPA's refund on objecting to a new subprocessor now matches the Refund Policy. The security page now says that a paired device can send from Personal up.