Trust & Security

Last updated: June 20, 2026

Maili is an AI assistant that touches some of the most sensitive parts of your life: your email, your calendar, your contacts, where you are, and what you say. We built it knowing that, and we built it so that you stay in control. This page explains, in plain language, how we protect your information and how the product is designed to keep you safe.

Maili is operated by Mylo Prime LLC, a Utah limited liability company ("Maili", "we", "us", "our"). For the legal details of how we handle your data, see our Privacy Policy, Terms of Service, and Subscription Terms. This page describes our security and trust posture; the Privacy Policy is the controlling legal document on data handling.

The short version

Your data stays yours. We do not sell it, and we do not share it for advertising or anyone else's benefit.
Maili proposes; you approve. Maili drafts and proposes outward actions and never sends, transmits, schedules, or pays without your explicit, per-action confirmation.
A lot stays on your iPhone. Meeting transcription and learning your writing style happen on your device by default.
We ask for the least access we can. We request the narrowest Google permissions that let the features work.
Your AI content is not used to train models. We use xAI's business API tier, where, by default, customer content is not used to train xAI's models.
Everything is encrypted while it travels and while it is stored.

Encryption

In transit

All communication between the Maili app, our servers, and the services we work with travels over encrypted connections using current industry-standard transport encryption (TLS 1.2 or higher). That means data moving between your iPhone and the outside world is scrambled so it cannot be read if intercepted.

At rest

Data stored on our servers and in our cloud infrastructure is encrypted at rest using strong, industry-standard encryption. Data that lives on your iPhone is protected by Apple's device-level encryption, which is tied to your device passcode, Face ID, or Touch ID. In short: your information is encrypted both while it moves and while it sits still.

On-device by default

The most private way to handle your data is to never move it off your device. Where we can do that without breaking a feature, we do.

Meeting transcription stays on your iPhone. When Maili captures and transcribes a meeting, that audio and the resulting transcript are processed on the device. Your raw meeting audio is not uploaded to our servers as a matter of course.
Learning your writing style stays on your iPhone. Maili adapts to how you write so its drafts sound like you. The model of your personal writing style is built and held on your device, not assembled on our servers.

Some features do require cloud processing. Generating an AI reply, reasoning over a long email thread, or answering a complex request involves sending the relevant content to our AI provider (see AI processing below). When that happens, we send only what is needed for the task, and the propose-and-approve model below still governs anything Maili wants to do with the result. Our Privacy Policy spells out, feature by feature, what is processed on your device versus in the cloud.

Maili proposes; you approve

This is the single most important safety property of the product, and it is built into how Maili works, not just a setting you can toggle.

Maili proposes; you approve. Maili drafts and proposes outward actions (emails, texts, calls, calendar invites, payments) and never sends, transmits, schedules, or pays without your explicit, per-action confirmation.

Why this matters for your security and peace of mind:

Nothing leaves on its own. No email is sent, no message is texted, no call is placed, no invite goes out, and no payment is made until you have seen exactly what Maili intends to do and confirmed that specific action.
AI mistakes can't act on their own. AI can be wrong. Because Maili only proposes, a bad draft or a misread instruction stays a proposal you can edit or reject. It never becomes a sent message or a charge on your account without your say-so.
You stay in command. Every outward action is a deliberate decision you make. Maili does the drafting and the legwork; the decision to act is always yours.

The matching legal commitment lives in our Terms of Service.

We ask for the least access we can (OAuth scope minimization)

When you connect Gmail, Maili uses Google's official, consent-based sign-in (OAuth). You see exactly what you are granting, and you can disconnect at any time from your Google Account permissions page or from within Maili.

We deliberately request the narrowest set of permissions ("scopes") that still let a feature work. We do not ask for blanket access "just in case." If a feature does not need a particular type of data, Maili does not ask for it. If we ever add a feature that needs a new type of Google data, we will update our Privacy Policy and ask for your consent again before accessing it.

Google Limited Use

Maili's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice this means we use the data Google gives us only to provide and improve the features you see in Maili; we do not sell it, we do not use it for advertising, we do not transfer it to others except as needed to run the service, keep it secure, or comply with the law, and we do not use your Gmail data to train AI models.

Google security assessment posture

Because Maili reads your email, we use what Google calls "restricted" permissions. Apps in this category go through Google's verification process, which can include an independent third-party security assessment of how the app protects user data. Maintaining a published, compliant privacy policy, encrypting data in transit and at rest, minimizing the permissions we request, and honoring the Limited Use commitments above are all part of meeting that standard. We treat Google's restricted-scope requirements as an ongoing obligation, not a one-time checkbox.

AI processing and your content

To generate AI responses, Maili sends the relevant content of your request to xAI, the company behind the Grok models, which processes it on our behalf to produce a result. xAI is one of our sub-processors (a vendor that handles data so we can run the service).

Your content is not used to train AI models. We use xAI's business API tier. On that tier, by default, customer content is not used to train xAI's models. This is different from the consumer Grok app, where data may be used for training. We are on the business tier specifically so your information is not fed into model training.

To be straight with you about the limits of that claim: xAI processes and retains data under its own terms in order to deliver and operate the service, and it may use de-identified operational information to keep its service running and reliable. We do not, and Google's Limited Use rules above mean we cannot, use your Gmail data to train generalized AI models. You can review xAI's Data Processing Addendum and legal terms for the details of how it handles data on our behalf.

Your data stays yours

We do not sell your personal information.
We do not share it for advertising or for any third party's independent benefit.
Your content belongs to you. We use it to provide Maili to you, and for nothing else, except as described in our Privacy Policy.
You can disconnect and delete. You can disconnect any connected account at any time, and you can request deletion of your data as described in our Privacy Policy.

Who we rely on (sub-processors)

We use a small number of trusted, established companies to run Maili. Each one receives only the data it needs to do its job, and each is bound to handle that data appropriately. Here is the full list of our sub-processors and what each one does.

Sub-processor	What it does for Maili	More information
xAI	AI processing. Generates Maili's responses from the content you send. Business API tier; your content is not used to train its models by default.	xAI DPA
Google	The source of your Gmail, calendar, and contacts data (via your consent through OAuth), used only to power the features you see.	Google API Services User Data Policy
Apple	App platform and consumer billing. Handles your subscription purchases, renewals, cancellations, and refunds through your Apple Account.	Apple Privacy Policy
Stripe	Payment processing for Enterprise and web invoicing only. Not used for consumer App Store subscriptions.	Stripe Privacy Policy
Google Cloud	Hosting and cloud infrastructure that runs Maili's backend services.	Google Cloud Privacy Notice

If we add or change a sub-processor in a way that affects how your data is handled, we will update this page and our Privacy Policy.

Billing and security

Consumer subscriptions (Plus, Pro, and the annual plans, with a 7-day free trial) are purchased through Apple's In-App Purchase system. Maili never sees or stores your full payment card details for these purchases. Apple handles the billing, the cancellation, and any refunds through your Apple Account. For Enterprise and web invoicing, payments are processed by Stripe, a certified payment provider, and again Maili does not store your full card number. See our Subscription Terms for the full details.

Apple platform protections

Maili is built for iPhone and benefits from Apple's platform security as a foundation:

App Store review. Maili is distributed through the App Store and is subject to Apple's review and privacy requirements.
Permission prompts you control. Access to your location, microphone, camera, contacts, and calendar is gated behind Apple's system permission prompts. Maili cannot reach any of these without you granting permission, and you can change or revoke that access at any time in your iPhone's Settings.
Device-level encryption. Data stored on your iPhone is protected by Apple's hardware-backed encryption, tied to your passcode, Face ID, or Touch ID.
App privacy labels. Our data practices are disclosed on the App Store privacy label so you can review them before you download.

Reporting a security issue

We welcome reports from security researchers and anyone who believes they have found a vulnerability in Maili. If you discover a potential security issue, please tell us before disclosing it publicly so we can investigate and fix it.

Email us at support@maili.ai with the details: what you found, how to reproduce it, and the potential impact. We will acknowledge your report, work to resolve confirmed issues promptly, and keep you informed. We ask that you act in good faith, avoid accessing or modifying other people's data, and give us a reasonable opportunity to address the issue before any public disclosure.

Eligibility

Maili is intended for people aged 16 and over. We do not direct the service to anyone under that age. If you believe a minor has used Maili, please contact us so we can address it.

Contact

For security questions, vulnerability reports, or anything else covered on this page, reach us at support@maili.ai. You can also reach the operating entity at support@myloprime.com.