Undertow — Privacy Policy

Effective 26 September 2026. Version 1.4.

Undertow is operated by Flapp Bilişim Anonim Şirketi ("we"), and this policy covers the Undertow iOS app and the service behind it. Questions: undertow@flapp.ist.

Undertow helps you read newsletters from publications you choose. This page explains what stays on your iPhone, what goes to our service, and how deletion works. Retention limits depend on the service cleanup schedule; historical backups and Anthropic may retain information separately.

The short version

• Sign in with Apple identifies your Undertow account. It does not sign in to Gmail or authorize Google access.
• In the current on-iPhone Gmail connection, your address is stored in app preferences and the app password in the iPhone Keychain. Neither is sent to Undertow by that flow. Older server-connected accounts are described in §11. The phone opens Gmail over TLS and read-only IMAP.
• The phone checks headers first. It requests body text only after you approve a publication, excludes attachments and attached messages, and sends sanitized, bounded newsletter text to Undertow.
• Undertow stores imported text to make decks and sends selected excerpts to Anthropic's API. Gmail credentials are never included.
• There is no advertising, no tracking, no analytics SDK, and nothing is sold or shared with data brokers.
• Sign-out, Gmail disconnect and account deletion are separate actions. A failed deletion request does not sign you out or claim success.

1. Your Undertow account and Gmail connection

You sign in to Undertow with Sign in with Apple. Undertow verifies Apple's signed identity token and uses the stable Apple subject identifier to identify your Undertow account. Sign in with Apple does not authorize Gmail access, and Undertow does not use an email address supplied by the client as your account identity.

To read Gmail newsletters, you separately enter your Gmail address and a Gmail app password. With the current on-iPhone connection, the address stays in this app's preferences and the password in the iPhone Keychain. Neither is sent to Undertow by that flow; older server-connected accounts are described in §11. The phone connects directly to imap.gmail.com over verified TLS and opens the mailbox read-only. The feature is not designed to archive, delete, move, label, reply to, send, or mark messages as read. An app password remains a credential rather than a technical read-only permission scope.

The app requests a best-effort background check when Gmail is connected, but iOS may delay or skip it. Undertow also performs a bounded catch-up check when the app opens or returns to the foreground. It cannot promise an exact or unattended nightly Gmail check.

2. How newsletters are told apart from your personal mail

The iPhone asks Gmail for header fields, including —

SUBJECT, FROM, LIST-ID, LIST-UNSUBSCRIBE, LIST-UNSUBSCRIBE-POST, PRECEDENCE, AUTO-SUBMITTED

— for messages in the search window. Mailing-list headers provide discovery evidence; the subject is checked for editorial intent. Editorial suggestions and uncertain mailing-list messages are shown separately for review. Subjects that indicate security or account notices, transactions, or obvious promotions are excluded from suggested imports. This is a heuristic, not a guarantee of perfect filtering: personal mail can still match and newsletters can be missed. Sender names and related header-derived metadata stay locally for review.

An unsubscribe header or bulk-mail service alone does not establish editorial content. Existing source approvals stay saved, but each queued issue is checked for excluded intent before its body is requested. A dropped sender is excluded from future body imports and deck candidates.

Newly discovered publications are not automatically approved. The app does not request a message body until you explicitly approve its publication. For approved publications, the phone requests only bounded text/plain or text/html leaf parts, excludes attachments, other non-text parts and attached messages, and converts accepted content to sanitized plain text. The relay API rejects raw MIME, attachments and Gmail credentials. Physical-device background behavior and real Gmail interoperability have not been independently verified.

3. What Undertow stores about approved newsletters

For each newsletter issue that passes the test:

• the publication identity and display name, sender address, sanitized subject and an opaque message fingerprint created on the phone,
• the date it was sent and the date we read it,
• the issue's canonical link and a bounded list of validated story links,
• sanitized newsletter text for the approved issue — not raw MIME or an attachment — used to build decks,
• a local embedding of the first 1,500 characters: a 384-number vector used to find related issues. It is computed on our own server by a downloaded model (all-MiniLM-L6-v2, embed.py).

The configured source-text retention default is 30 days. The production cleanup schedule must be verified before treating this as a live expiry guarantee.

4. How decks are written, and what leaves our server

Each night a ranking step picks a shortlist of candidate issues from your own corpus. The shortlist — issue titles, sender names, publication dates, and the extracted text of each, capped at 5,000 characters per issue — is sent to the Anthropic API (claude-sonnet-5, pipeline.py) together with your taste profile, the headlines of your recent decks, and any "deepen" notes you wrote. Anthropic's model writes the cards; we validate them, force every source link back to a URL that actually appeared in the issue, and store the deck.

Newsletter excerpts can contain personal information. Undertow does not promise that every identifier is removed before the prompt is sent. Your mail credential and device token are not part of the generation prompt.

Anthropic processes requests under the terms and retention practices that apply to the API account. Undertow has not changed or independently verified provider-side retention or deletion practices. Requests are transmitted over HTTPS.

Apple's push service receives an APNs device token and a generic notification that a deck is ready. Newsletter excerpts and the editor's note are not put in the push payload.

5. Account and usage data

On your phone, the Undertow session token and Gmail app password are stored in the iOS Keychain using a ThisDeviceOnly class. The Gmail address, account and delivery preferences are stored in UserDefaults. Recent decks and queued feedback are local files protected by iOS file protection and excluded from device backups by the client. The app clears the appropriate credentials, preferences and files on disconnect, sign-out, account switch and completed account deletion; cleanup errors are shown in the app.

6. What we do not do

• No advertising, and no advertising identifiers. The app never requests App Tracking Transparency permission because it has nothing to track you with.
• No third-party analytics or attribution SDKs. The client's API requests go to the Undertow server. StoreKit, APNs and external account links also involve Apple or Google as described in this policy.
• No tracking across other companies' apps or websites, and no data brokers.
• No sale or sharing of personal information as those terms are defined by the California Consumer Privacy Act.
• No profile-building for anyone but you. Your taste profile exists to pick your cards and is never pooled with anyone else's.

7. Who else touches your data

These are the currently identified service recipients. Hosting, network infrastructure and other operational providers may process data under their applicable terms.

8. How long we keep things

The service code defines configurable defaults of 30 days for imported source text, embeddings and body-derived links, and 90 days for generated decks, feedback and exact deck files. Retention depends on the cleanup routine running. Its production schedule and configuration, and backup retention, must be verified before these windows can be treated as operating guarantees. During rollout the service may keep retention in preview mode, which does not apply automatic expiry until the schedule is approved. Account identifiers, preferences, publication decisions, subscription records and cost attempts may remain while the account is active. Account-owned subscription and cost records are removed from the active service on completed account deletion; historical backups and Apple's own purchase records are separate. Anthropic's applicable API retention practices are separate and are not changed by Undertow.

9. Deleting your account

Settings → Delete account sends an authenticated, idempotency-keyed DELETE /v1/account request. The app clears its local session, local Gmail credential and cache only after a confirmed completed response; on error or pending status it keeps the session and offers retry or status checking. The service deletes account-owned source records, decks, feedback, device registrations, publication approvals, profile data, subscription records, account-binding tokens and generation cost attempts, and removes exact deck files owned by those records.

A tombstoned user record, revoked session hashes, deletion receipts and signed deletion-ledger events are retained for replay prevention and backup-restore reconciliation. Deletion does not guarantee removal from historical backups, operational logs or Anthropic systems that already processed excerpts. Neither disconnect nor account deletion revokes the app password in Google's account; revoke it there separately to invalidate the Google-issued credential.

10. Your rights

Wherever you live, you can request account deletion from inside the app. On request to undertow@flapp.ist we will also give you a copy of what we hold, correct it, or confirm what has been deleted.

If you are in the EEA or the UK: our legal basis for processing your mailbox content is performance of the contract you entered into when you subscribed — it is the service. Usage data is processed on the basis of our legitimate interest in making the product work, and you may object at any time by writing to us. We do not make automated decisions with legal effects. Our processors are listed in §7.

If you are in California: we do not sell or share personal information and have not done so in the past twelve months.

If you are in Türkiye: the data controller (veri sorumlusu) is Flapp Bilişim Anonim Şirketi. Under KVKK art. 11 you may ask whether your data is processed, ask what is held and why, ask for it to be corrected or erased, and object to a result produced solely by automated analysis. Write to undertow@flapp.ist; we answer within thirty days. Our lawful basis is KVKK art. 5/2(c) — processing necessary for a contract you are party to. Mailbox content is not special-category data, and none is sought.

11. Google user data and migration

Undertow connects to Gmail using IMAP and an app password. It does not use Google OAuth or Gmail API tokens. In the current local connection, the Gmail address and app password remain on the iPhone. Disconnect stops future transfers, removes the address from app preferences and deletes the app password from Keychain, but it cannot revoke the Google-issued app password; you must do that separately in your Google Account.

An older server-connected account may still have its Gmail address and an encrypted app password on the service. That connection can continue to read mail until the user enables local relay or disconnects it. Enabling local relay or disconnecting removes the server-held password and its verification state; the account email can remain until account deletion. The old password is not copied back to the phone or used by relay mode. Production migration and deployment must be verified separately before treating this design as live behavior.

12. Children

Undertow is not directed to children and is rated 13+. We do not knowingly collect information from anyone under 13.

13. Changes

If we change how any of this works, the version and effective date at the top change, and a material change is announced in the app before it takes effect.

Contact: undertow@flapp.ist · Evliya Çelebi Mah., Sadi Konuralp Cad., İKSV Vakfı No: 5, İç Kapı No: 2, Beyoğlu / İstanbul, Türkiye