Khinoa Mail is an email app for Windows. It runs on your computer and talks directly to your email provider. Your emails, email passwords and settings are never sent to us (PAIXAI ONE). The one thing we keep on our own servers is your Khinoa account, if you choose to create one (section 4). This policy explains what the app keeps on your computer, what a Khinoa account keeps, which other services the app connects to, and the choices you have.
1. Who we are
Khinoa Mail is made by PAIXAI ONE, a sole proprietorship based in IN. For privacy questions, write to founder@paixaione.space. Users in India can also contact the Grievance Officer, PAIXAI ONE (founder@paixaione.space).
The app processes your email only on your own computer, on your instructions, so you are in control of it. For a Khinoa account (section 4), we are responsible for the account details we keep. Where data protection law treats us as responsible for something described here, this policy sets out what we do.
2. What Khinoa Mail keeps on your computer
Everything below is stored in Khinoa Mail's data folder on your PC (%APPDATA%\Khinoa Mail, or %APPDATA%\Koda Mail or %APPDATA%\A Mail on installs from before it was renamed). Settings → About → Data folder opens it. None of it is sent to us.
| What | Examples | Why | How long |
|---|---|---|---|
| Your accounts | Email address, the name you chose, provider, mail server settings | To connect to your mailboxes | Until you remove the account or uninstall |
| Passwords and sign-in tokens | Your email password, or the sign-in token Google or Microsoft gives the app | To stay signed in | Until you remove the account or uninstall. Encrypted with Windows' data protection, which ties them to your Windows user account |
| Saved email lists | Subjects, senders, dates, a short preview and read or starred status of your most recent emails; your folder list; which emails were sorted into Important or Other | So the app opens quickly, before your provider answers | The 12 most recently opened lists per account, replaced as you use the app; deleted when you remove the account |
| Scheduled emails | The full email you scheduled, and where its attachments are on your PC | To send it at the time you chose | Until it is sent or you cancel it |
| Snoozed emails | Which email comes back to the Inbox, and when | To bring it back on time | Until it comes back |
| Account pictures | Your Google account's profile picture | To show it next to the account | Refreshed daily; deleted when you remove the account |
| Settings | Theme, wallpaper (including a picture or video you choose), signatures, notification choices, Khinoa SI's level and folder, the version of these terms you agreed to | To remember your choices | Until you uninstall |
| Khinoa AI models | The AI model files you chose to download (1 to 6 GB each), in the data folder or in a "Khinoa AI models" folder you picked | To run Khinoa SI on your PC | Until you delete them in Settings → Khinoa SI, or uninstall with Clean uninstall |
| Your Khinoa account, if you sign in | The account's name, email address and plan, and its sign-in token | To show your profile and keep you signed in | Until you sign out or delete the account. The token is encrypted with Windows' data protection |
| Tools and blocked senders | Notes you write on emails, your to-dos (and which email each one is about: its subject, sender and where it is), the emails you marked as needing no reply, the senders you blocked (with Block, or in the Screener) or allowed in the Screener, the tools you pinned, Focus times, and this week's safety numbers | To run the Tools tab, and to keep blocked senders' email in Spam | Until you delete them, or uninstall |
| Khinoa SI chats | What you ask Khinoa SI and its answers | To carry on the conversation | Only while the app is open: never saved to disk, and gone when you start a new chat or close Khinoa Mail. Off device (Pro), each message also goes to DeepSeek to be answered (section 6) |
Your emails themselves stay with your email provider. Khinoa Mail downloads them to show them to you, and keeps only what the table above lists.
The Tools tab reads your recent email from your provider (the last 30 days: senders, subjects, sizes, attachment names and the first words of some emails) to show who is waiting for a reply, newsletters, bills, parcels, sign-in codes and numbers about your inbox. It works on your PC, and none of it is sent anywhere else. A file you drop into the Safety check, or a picture of a QR code, is read on your PC only (just a file's name and first bytes). Translate, Catch me up and Write a follow-up hand your request to Khinoa SI (section 6).
3. Services Khinoa Mail connects to
The app connects only to these services, directly from your computer. Each one handles your information under its own privacy policy.
- Your email provider (for example Gmail, Outlook or iCloud), over encrypted connections, to read, organise and send your email. Snoozed emails wait in a "Khinoa Snoozed" folder (a label in Gmail; "Koda Snoozed" if you snoozed with an older version) in your own mailbox. When you ask, the Tools tab archives or deletes a sender's emails, moves your biggest emails to Trash, empties Spam or Trash for good, or blocks a sender. Blocking (Block at the top of an email, or the Screener) moves that sender's emails to Spam, now and as they arrive, and checks your Inbox for more every 10 minutes while Khinoa Mail runs.
- Google or Microsoft sign-in, when you choose "Sign in with Google" or "Sign in with Microsoft". You sign in in your own web browser; the app never sees your Google or Microsoft password. It receives a sign-in token, your email address and name, and (for Google) your profile picture.
- Khinoa's account server, only if you create a Khinoa account or sign in to one (section 4). When you choose Continue with Google for a Khinoa account, Khinoa Mail asks Google only for your name and email address, and passes Google's confirmation of them to the account server.
- Senders' own domains, while Sender pictures is on (Settings → General → Appearance; on unless you turn it off), to show a company's logo next to its emails: Khinoa Mail looks up the sender's domain (for example
hm.com) for its published brand logo (BIMI), else asks that website for its icon. Only the domain name is used, never anything from the email itself; logos are kept on your PC for 30 days. Personal addresses (Gmail, Outlook and the like) are never looked up. - Mozilla's mail settings directory (autoconfig.thunderbird.net), when you add an address from a provider Khinoa Mail doesn't already know. Only the part after the @ (for example
example.org) is sent, to look up that provider's server settings. - The senders of your emails. Pictures inside an email load from the sender's servers when you open it, as in most email apps. Those servers can see your IP address and that the email was opened.
- Khinoa's account server and DeepSeek, only when you choose Khinoa SI off device (Khinoa Pro; section 6). What you type, the chat so far and the emails Khinoa SI reads to answer you go through our server, which keeps none of it, to DeepSeek, which writes the answer.
- Hugging Face (huggingface.co and its download servers), only when you download a Khinoa SI model, to get the model file. Like any download, it can see your IP address; nothing about you or your email is sent with it.
- Khinoa Mail's website (khinoamail.space), only when you click Check for updates in Settings → About, to see whether a newer version exists. Nothing about you is sent with it beyond what any web request carries, such as your IP address.
- Links you click open where you choose in Settings → General → Browser: your normal web browser (the default), one of the browsers installed on your PC, or (with Pro) the Khinoa browser. To list the installed browsers and their icons, Khinoa Mail reads what Windows records about them on your PC; nothing about them is sent anywhere. Before a link opens, Khinoa Mail checks its address on your PC for signs of a trick (an address made to look like a well-known company's, for example); a link that looks like one asks before it opens (with Pro, it opens in the Khinoa browser behind a warning) unless you turn that off. The link itself isn't sent to anyone for checking.
- The Khinoa browser connects only to the websites you open in it, like any browser, and to DuckDuckGo (duckduckgo.com) when you type words in its address bar to search. What those websites receive is covered by their own privacy policies. It is kept apart from your other browsers and from your email; by default it forgets its cookies, sign-ins, history and cache when you close its window (Settings → General → Browser → Forget everything when closed). It doesn't download files. Its Shields block ads, trackers and cookie notices using lists built into Khinoa Mail (EasyList, EasyPrivacy, EasyList Cookie and uBlock Origin's lists), so blocking contacts no one, and it switches a page to a secure connection (https) when the site has one.
Khinoa Mail contains no analytics, advertising, tracking or crash-reporting software, and doesn't use cookies to track you. On device (the default), Khinoa SI runs entirely on your PC and nothing is sent to an AI provider; off device, which you can choose with Khinoa Pro, is described in section 6. Because it doesn't track you, it has nothing to change in response to "Do Not Track" or Global Privacy Control signals.
4. Your Khinoa account (optional)
You can use Khinoa Mail without an account. A Khinoa account is one profile for Khinoa Pro on every PC you use. If you create one, our account server keeps:
- Your name and email address, and whether you have the free plan or Khinoa Pro.
- Your profile photo, only if you add one in Settings → Pro → Account (a small 256-pixel copy). You can remove it there at any time.
- Your password, only as a scrambled hash (scrypt) that can't be turned back into the password. If you use Continue with Google, also your Google account's ID, so Google can sign you in.
- Your signed-in PCs: when each was signed in and last used, and the app version (for example "Khinoa Mail 0.9.12 · Windows"). A sign-in ends when you sign out, or after 6 months without use.
- Short-lived safety records: the 6-digit codes we email you (deleted when used, or after 15 minutes), and counts of recent sign-in tries per email address and IP address, to stop password guessing (deleted when the waiting time is over).
It never keeps your emails, your email passwords, your contacts, your Khinoa SI chats or anything else from your mailboxes. If you use Khinoa SI off device, your chat passes through it on its way to DeepSeek and isn't kept; only a count of your requests per day is, for the daily limit. We use the account details only to run your account: to sign you in, to email you the codes you ask for, to keep Khinoa Pro on your PCs, and to keep accounts safe. We don't sell them, advertise with them or use them to train AI.
The account server runs on providers that process these details for us: Vercel (hosting), Neon (the database) and Resend (sends the code emails). They may store and process them in the United States.
You can delete your Khinoa account at any time in Settings → Pro → Account → Delete account. It is removed from our server, with its sign-ins, straight away.
5. Google user data
When you sign in with Google, Khinoa Mail asks for access to your Gmail (to read, organise and send your email on your instructions) and to your basic profile (email address, name and picture). This data is used only inside the app on your computer to provide those features. It isn't sent to us, sold, used for advertising, or used to train AI models, and no person reads it.
If you use Khinoa SI on device (the default), it may read your Gmail on your computer to answer your questions. That happens only on your PC: nothing is sent anywhere. If you choose Khinoa SI off device (Khinoa Pro), the Gmail messages it reads to answer you are sent, through our server, to DeepSeek only to write that answer, and only after you agreed to it in the app. Either way, your Gmail data is never used by us to develop, improve or train AI models.
Khinoa Mail's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Khinoa SI
Khinoa SI is an optional assistant in the side panel. On device (the default) it runs on your PC with an open AI model you choose to download (Qwen3.5, made by the Qwen team at Alibaba Cloud). When you use it, the model processes what you type and, when you ask, emails from the account you have open: the email you're reading, or emails it lists, searches or reads for you. It does this in a separate process on your computer.
- On device, what you ask, and the emails it reads, are never sent to us or to an AI provider, and are never used by us to train AI models. They leave your PC only in emails you ask Khinoa SI to send, or in web searches you ask it to open.
- Off device (Khinoa Pro, only if you choose it in the Khinoa SI panel, which explains it first): Khinoa SI answers with DeepSeek, an AI service run by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., whose servers are in the People's Republic of China. Each message you send, the chat so far, the email you shared and the emails Khinoa SI reads to answer you go through Khinoa's account server to DeepSeek, which writes the answer. Our server keeps none of it (only a count of your requests per day, for the daily limit); DeepSeek's own privacy policy and terms cover what it does with what it receives. You can switch back to on device at any time.
- It answers general questions from the model's own knowledge, without going online. When you ask, it opens a web search (on Bing) or a website: in the browser you picked in Settings → General → Browser, or in Microsoft Edge if you left that on your Windows default; what the browser then sends to Microsoft or that website is covered by their privacy policies. A website you didn't name waits for you to press Open.
- Chats are kept in memory only while Khinoa Mail is open (see section 2).
- When you ask, it writes, sends, replies to and forwards email, and archives, stars, marks, deletes (to Trash) or moves email to spam. It sends from your own account through your own email provider, like email you send yourself. Settings → Khinoa SI → Sending decides whether each email and change waits for you to press Send or Approve (the default), or goes on its own after 10 seconds you can undo. Even then it asks before emailing more than 10 people, or anyone you haven't emailed before (to tell, it looks in your Sent folder on your provider and keeps nothing).
- Its answers are generated by AI and can be wrong. Check important information.
- You can delete the model files at any time in Settings → Khinoa SI.
7. Why we can process it (legal bases)
To the extent data protection law applies to us: we process your information to provide the app you asked for and, if you create one, your Khinoa account (performance of a contract); on your instructions when you send, move or delete email; and to protect Khinoa accounts from password guessing (our legitimate interest in keeping them safe). We don't use it for any other purpose.
8. Sharing
We don't sell or share your information. The app sends information only to the services in section 3, and only to do what you ask. Khinoa account details are processed for us only by the providers in section 4.
9. Where your information is
On your computer, and with your email provider wherever it stores your mail. Khinoa Mail itself doesn't move your email to other countries, except that Khinoa SI off device, if you choose it, sends what it needs to answer you to DeepSeek in the People's Republic of China (section 6). Khinoa account details are kept with the providers in section 4, which may be in another country than yours.
10. Your choices and rights
- Remove an account: Settings → Accounts → Manage → Remove from Khinoa Mail. This deletes its password or sign-in token, saved lists, picture and scheduled emails from your PC. For Google accounts, Khinoa Mail also asks Google to cancel its sign-in token. Your emails stay with your provider.
- Delete your Khinoa account: Settings → Pro → Account → Delete account. Signing out removes it from your PC only.
- Delete everything: uninstall Khinoa Mail and choose Clean uninstall, which removes the app and everything it saved on your PC, including Khinoa AI models.
- Revoke access yourself: in your Google Account (Security → Third-party apps and services) or your Microsoft account's app permissions.
- See your data: everything Khinoa Mail keeps is in its data folder (section 2).
Depending on where you live, you may have rights to access, correct, delete or move your personal data, to object to or restrict its use, to withdraw consent, to nominate someone to act for you (India), and to complain to a data protection authority. Your mail data is on your PC and your Khinoa account can be deleted in Settings → Pro, so most of these you can exercise directly in the app. For anything else, write to founder@paixaione.space; we will reply within 30 days.
11. Children
Khinoa Mail is for people aged 18 and over. We don't knowingly collect information from anyone younger. If we learn that a Khinoa account belongs to someone younger, we will delete it.
12. Security
Passwords and sign-in tokens are encrypted with Windows' data protection. Connections to email providers use encryption (TLS), and the app refuses to send a password over an unencrypted connection to another computer. Emails are shown with scripts switched off. Khinoa account passwords are kept only as scrypt hashes, and the account server is reached only over encrypted connections (HTTPS). No system is perfectly secure: keep Windows up to date, and protect your Windows account with a password.
13. Changes
If we change this policy in a way that matters, we will update its version and date, and Khinoa Mail will ask you to read and agree to it again the next time you open it.
14. Contact
PAIXAI ONE, IN · founder@paixaione.space