This Privacy Policy explains what information the Email for Hotmail Outlook app for Android (package com.mail.hotmail.outlook.email, the "App") accesses, collects, uses and shares, and the choices you have. The App is published by TOHsoft Co., Ltd ("TOHsoft", "we", "us").
The App is an independent email client. It is not made, sponsored, endorsed or affiliated with Microsoft Corporation. Microsoft, Outlook and Hotmail are trademarks of Microsoft Corporation. We use these names only to describe the email services the App can connect to.
In short
- Your emails, attachments, drafts and account sign-in data stay on your device. We do not run a server that stores or reads your mail.
- You sign in to Microsoft accounts on Microsoft's own sign-in page. We never see your Microsoft password.
- Data the App gets from your email account is used only to provide the App's email features. It is never used for advertising and never sold.
- The App does not create accounts. You use accounts you already have with Microsoft or other email providers.
- The App is free and shows ads. Advertising, analytics and crash-reporting partners collect device information, as described in sections 2.6 and 6.
01 Who We Are and How to Contact Us
TOHsoft Co., Ltd, VIWASEEN Building, 48 To Huu, Dai Mo Ward, Hanoi, Vietnam.
For any question or request about privacy, email app.pm@tohsoft.com. We aim to reply within 30 days.
02 Information the App Accesses
2.1 Microsoft accounts (Outlook.com, Hotmail, Live, Microsoft 365)
When you add a Microsoft account, you sign in through the Microsoft identity platform on a Microsoft sign-in page. Microsoft asks you to allow the App these permissions:
| Permission | Why the App needs it |
|---|---|
IMAP.AccessAsUser.All | Read, organise, move, flag and delete your email so the App can show your mailbox. |
SMTP.Send | Send the email you write in the App. |
User.Read | Read your name and email address to show which account is signed in. |
| Keep access (offline access) | Refresh your sign-in in the background so the App can check for new mail without asking you to sign in again. |
After you sign in, Microsoft gives the App access tokens. The tokens are stored on your device, in the App's private storage, by Microsoft's authentication library. The App connects directly from your device to Microsoft's servers. Your tokens and your mail are not sent to TOHsoft.
2.2 Other email accounts (IMAP/SMTP)
If you add an account with "Other mail", the App stores your email address, password and server settings (IMAP and SMTP host, port and connection security) on your device, in the App's private storage. They are used only to connect to your email provider and are not sent to TOHsoft. We recommend using an app password if your provider offers one.
2.3 Your email content
To show your mailbox, the App downloads messages, message metadata (sender, recipients, subject, date, flags), attachments, drafts and folder names, and stores them on your device. Email addresses from your messages are used on your device to suggest recipients while you write. Files you choose to attach are read from your device only to be sent with your email. Email you send goes directly from your device to your email provider. None of this content is sent to TOHsoft's servers.
New-mail notifications can show the sender and subject of a message, including on your lock screen, depending on your Android notification settings.
2.4 App lock recovery
The App can lock itself with a passcode. If you forget your passcode and ask for a recovery code, the recovery email address you entered and a one-time code are sent over an encrypted connection (HTTPS) to our server, which emails the code to you. Our server uses them only to send that email. It does not store or log them.
2.5 Information TOHsoft receives directly
- App lock recovery, as described in section 2.4.
- "More apps": when you open this option in Settings, the App asks our server for the link to our other apps. The request contains only the App's package name.
- Feedback and support: if you contact us by email (for example with the App's Feedback option, which opens your email app addressed to app@tohsoft.com), we receive your email address and whatever you choose to write or attach. We use it only to answer you.
As with any internet connection, our server sees the IP address of the device that sends these requests. We do not use it to identify you.
2.6 Device and usage information collected by our partners
The advertising, analytics and crash-reporting services listed in section 6 automatically collect information such as:
- device identifiers: the Android advertising ID, app set ID, and Firebase installation and app instance IDs;
- IP address, from which an approximate location (such as country or city) can be derived;
- device model, operating system version, language, app version and how the App was installed (install referrer);
- how you interact with the App and with ads;
- crash logs and diagnostic information.
On Android devices that support the Android Privacy Sandbox, Google's ads SDK may also use the Topics and Attribution Reporting APIs. You can manage these in your Android settings.
We do not intentionally send your email content or your sign-in credentials to these services, and we do not include them in analytics events or crash reports.
03 How We Use Information
- To provide the App's email features: show, search, organise, filter and send your email, and notify you of new mail.
- To send you a passcode recovery code when you ask for one.
- To answer your feedback and support requests.
- To find and fix crashes and errors, and to understand which features are used, using aggregated statistics.
- To show ads that keep the App free. Ads are personalised only where you have given consent where the law requires it.
- To change App settings remotely (for example how often ads appear) without an update.
We do not sell your personal information.
04 How We Treat Data from Your Microsoft Account
Data the App obtains through the Microsoft permissions in section 2.1:
- is used only to provide the email features you see in the App;
- is processed on your device and is not transferred to TOHsoft or to any other party, except to Microsoft itself when the App talks to Microsoft's servers;
- is never used for advertising, ad personalisation, profiling or marketing, and is never sold;
- is not read by TOHsoft staff.
05 Device Permissions
| Permission | Purpose |
|---|---|
| Internet, network and Wi-Fi state | Connect to your email provider, check whether you are online, and load ads. |
| Notifications and vibration | Tell you about new email. You can turn this off in the App or in Android settings. |
| Run in the background, keep the device awake and start at boot | Check for new email when the App is closed or after the device restarts. |
| App icon badgeOn some launchers | Show the number of unread emails on the App icon. |
| StorageRead: Android 12 and earlier. Write: Android 10 and earlier. | Attach files from your device and save attachments to a folder you choose. On newer Android versions, you pick files and locations in the system file picker and no storage permission is used. |
| Advertising ID | Used by Google AdMob to show and measure ads, as described in section 7. |
The App does not request access to your contacts, camera, microphone or location.
06 Third-Party Services
The App includes the following services. Each one processes data under its own privacy policy.
| Service | Purpose | Policy |
|---|---|---|
| Microsoft identity platform, Microsoft Graph, Outlook mail serversMicrosoft | Sign in, read your profile, read and send your email | privacy.microsoft.com/privacystatement |
| Google AdMobGoogle LLC | Ads and ad measurement | policies.google.com/technologies/ads |
| Google User Messaging PlatformGoogle LLC | Ask for and store your advertising consent | policies.google.com/privacy |
| Firebase AnalyticsGoogle LLC | Usage statistics | firebase.google.com/support/privacy |
| Firebase CrashlyticsGoogle LLC | Crash reports | firebase.google.com/support/privacy |
| Firebase Remote ConfigGoogle LLC | Remote App settings | firebase.google.com/support/privacy |
See also how Google uses information from apps that use its services.
07 Advertising and Your Choices
If you are in the European Economic Area, the United Kingdom or Switzerland, the App shows Google's consent message before showing personalised ads, and saves your choice on your device. To change your choice, you can contact us at app.pm@tohsoft.com, or clear the App's storage in Android settings so that the consent message is shown again the next time you open the App. Clearing the App's storage also removes your accounts and downloaded email from the App; your email at your provider is not affected.
Wherever you live, you can delete or reset your advertising ID, or turn off ad personalisation, in your Android settings (Settings › Google › Ads, or Settings › Privacy › Ads, depending on your device). After that, the ads you see are no longer personalised based on your advertising ID.
Some US state privacy laws treat the use of advertising identifiers for personalised ads as "sharing" personal information or "targeted advertising". You can opt out of this at any time using the Android settings above.
09 Retention and Deletion
No accounts with us. The App does not create accounts. You sign in with accounts you already have with Microsoft or other email providers. To delete one of those accounts, use your provider's own tools.
| Data | Retention and deletion |
|---|---|
| Accounts, tokens, passwords and downloaded email on your device | Kept on your device until you sign out of that account or uninstall the App. Signing out removes the account, its downloaded email and its sign-in tokens from the App. Not held by us. |
| Rules, signatures and recipient suggestions on your device | Kept on your device until you uninstall the App or clear its storage. |
| Microsoft access granted to the App | Until you sign out, or until you remove it at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts). |
| Email stored by your provider | Not affected by removing the App. Managed by Microsoft or your other providers. |
| Passcode recovery data on our server | Not stored or logged. Discarded once the recovery email is sent. |
| Support emails | Kept only as long as needed to answer and follow up on your request. You can ask us to delete them at any time. |
| Data collected by the services in section 6 | Kept according to each provider's own policy. |
Uninstalling the App removes all of its data from your device. To ask us to delete any information we hold about you, email app.pm@tohsoft.com.
10 Security
The App connects to Microsoft, to our server and to Google's services over encrypted connections (TLS). For other email accounts, the App uses the connection security you choose in the account settings; we strongly recommend SSL/TLS, which most providers require.
Data stored by the App is kept in its private storage, which other apps cannot read on a normally configured Android device, and it is not included in Android cloud backups. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Protect your device with a screen lock, and use the App's passcode lock if other people use your device.
11 Your Rights
Depending on where you live (for example under the EU or UK GDPR, or US state privacy laws such as the California Consumer Privacy Act), you may have the right to access, correct or delete your personal information, to restrict or object to its processing, to data portability, to opt out of targeted advertising, to withdraw consent at any time, and to complain to your data protection authority.
Most of the data in this App is stored only on your device, where you control it directly. For any request about your data, email app.pm@tohsoft.com. We will not treat you differently for using these rights.
12 Children
The App is not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from them. If you believe a child has provided personal information through the App, contact us and we will delete it.
13 International Transfers
We are based in Vietnam. Our partners and your email providers may process information in countries other than your own, including the United States and the European Union. They are responsible for protecting it under their own policies and applicable law.
14 Changes to This Policy
We may update this Privacy Policy. We will post the new version at this address and change the dates at the top of this page. If a change materially affects how we use your information, we will also tell you in the App.
15 Contact
If you have questions, concerns or requests about this Privacy Policy or how we handle your information:
TOHsoft Co., Ltd
- Address
- VIWASEEN Building, 48 To Huu, Dai Mo Ward, Hanoi, Vietnam
- app.pm@tohsoft.com
- Response
- Within 30 days of receipt