Skip to content

Privacy Policy

Last updated: 2026-10-17

This Privacy Policy explains what data Reeva collects when you use our services, why we collect it, and the choices you have. We aim to handle as little personal information as we need to run the service, and never to monetize it.

1. Who we are

Reeva ("we", "us") provides email, calendar, contacts and file cloud services available at reeva.me and app.reeva.me. Reeva is run by a company registered in Israel, which is the controller of the personal data described here. You can reach us at [email protected] or via our contact form. For security and privacy disclosures, write to [email protected].

2. What we collect

  • Account information. The email address you sign up with, any custom domain you add, the plan you choose, and a hash of your password, made with argon2id. We never see your password in plain text.
  • Content you store. Email messages, calendar events, contacts, files you upload and the items in your password vault. We treat this content as private. Every connection to it is encrypted with TLS, and your password vault is encrypted on your device before it reaches us.
  • Service logs. Operational logs (timestamps, IP addresses, basic request metadata) needed to deliver mail, debug issues, and stop abuse. We keep mail server logs for 180 days and web server logs for 14 days. The sign-in and activity records in your account panel are kept for 12 months; after that we delete them and keep only when you last signed in. Logs are not used to build advertising profiles.
  • Pages you open in your account. When you are signed in to app.reeva.me or a Reeva app, we record which pages you open: the page's address (without search terms or other parameters), the time, the kind of device (phone, tablet or computer), whether you used the installed app or a browser, and your IP address. We keep these records only to improve the quality of the service and to support you. Only Reeva staff can see them, we do not share them with anyone else, and we delete them after 90 days.
  • Billing. If you subscribe to a paid plan, our payment processor stores the data required to process the transaction. We do not store full card numbers.
  • Backups. We back up the service every day. Backups stay on our servers for up to 14 days, and a copy is kept on a separate Reeva server for up to 12 weeks. Data you delete, and the data of an account you close, leaves the backups within 12 weeks.

3. What we do not do

  • We do not sell, rent or share your personal data for advertising.
  • We do not scan your mail or files to target ads.
  • We do not run advertising trackers, fingerprinting, or third-party ad networks anywhere on Reeva.
  • The Reeva product (app.reeva.me and the apps) ship without third-party analytics.

4. How we use data

We use your data only to provide the service: to deliver and receive mail on your behalf, sync your calendar and files across your devices, process payments, and respond to your requests. We may also use aggregated, non-identifying signals to improve reliability and security.

Where the GDPR or the UK GDPR applies, our legal bases are: contract, to provide the service you signed up for, including billing; legitimate interests, to keep the service secure, stop abuse and improve its quality (this includes the page records in section 2); legal obligation, to keep accounting records and answer lawful requests; and consent, for analytics on reeva.me, which you can withdraw at any time with Manage cookies.

5. Analytics on this website (reeva.me)

The Reeva marketing site at reeva.me can use Google Analytics 4 to understand aggregate traffic — pages visited, country, browser, referrer — so we can improve the site. It is off unless you allow it. We do not use it for advertising, remarketing or audience-building.

  • Default state. Until you choose Allow on the cookie banner, no Google Analytics script is loaded and no analytics cookies are set. All ad-related signals stay denied under Google Consent Mode v2 (no ad_storage, no ad_user_data, no ad_personalization) and ads data redaction is enabled, also after you allow analytics.
  • Cookies set after you allow analytics. _ga (client identifier, ~2 year retention) and _ga_YRF87S3FB3 (session state, ~2 year retention). No advertising cookies.
  • Changing your mind. Click Manage cookies at the bottom of any reeva.me page to see the banner again. Your choice is stored in localStorage as reeva-consent=granted or reeva-consent=denied. After Decline, Google Analytics is not loaded on later visits; cookies set by an earlier Allow stay in your browser until they expire or you clear them.
  • Block entirely. Standard browser tracker-blockers (uBlock Origin, Brave Shields, Firefox ETP strict) prevent the analytics script from loading at all.

The product itself (app.reeva.me, mail, calendar, files, password vault, desktop and mobile apps) does not include Google Analytics or any third-party analytics.

Affiliate referral cookie

If you open reeva.me or app.reeva.me through an affiliate's link (one ending in ?ref= and a code), we set one first-party cookie, without asking, so that the affiliate can be credited if you create a Reeva account. It is not an analytics cookie and is set whatever you choose on the cookie banner.

  • Name and value. reeva_ref, holding only the affiliate's 8-character code. It contains nothing about you.
  • Who sets it. reeva.me and app.reeva.me, for the reeva.me domain. No third party sets or reads it.
  • How long it lasts. 60 days. Opening a newer affiliate link replaces it.
  • What it is used for. Only to credit the affiliate if you sign up. It is not used for analytics, advertising or profiles.
  • When you sign up. We record which affiliate referred your account. The affiliate sees the amounts and dates of the payments your account brings, so they can earn their commission, and never your name, email address or anything else about you. Commission records are kept for accounting.
  • Removing it. You can delete it at any time in your browser's settings.

6. Sharing with third parties

We share data with a small number of providers that help us operate the service. They are bound by contract to use your data only to perform their service to us and to keep it confidential:

  • Our hosting company, which rents us the servers Reeva runs on, in a data centre. Reeva runs all the software on them.
  • PayPal, for payments for paid plans.
  • Cloudflare, for DNS and protection against attacks on reeva.me; some request metadata passes through it.
  • Google, for Google Analytics on reeva.me, only if you allow it (section 5), and for Firebase Cloud Messaging, which carries new-mail notifications to the Android app. Google receives the sender and the subject of each message it notifies you about.
  • Browser push services (run by Google, Mozilla and Apple), which carry the notifications you turn on in a browser. The content of a notification is encrypted.
  • Gravatar and Libravatar, for profile pictures. They receive a hash of an email address, not the address itself.

When you connect another service yourself, for example Gmail or Outlook to import your mail, or Telegram, WhatsApp, Discord, Slack, Google Drive, Outlook, GitHub, Linear or Notion to the Reeva Agent, data goes to that service as you allow. Business customers can ask for our Data Processing Agreement at [email protected].

We may disclose data when legally required (for example, in response to a valid court order), and we challenge requests that we believe are unlawful or overbroad.

7. Where data is stored

All of Reeva's servers are in Israel. Some are rented from a hosting company, the others are machines Reeva owns, and Reeva runs the software on all of them. Your mail, files, calendars, contacts, password vault and AI requests are stored and processed there, with no third-party cloud AI. Backups are kept on a separate Reeva server, also in Israel. Some request metadata passes through Cloudflare for protection against attacks.

If you live in the European Union, the European Economic Area or the United Kingdom, your data is processed outside them, in Israel. The European Commission has decided that Israel protects personal data adequately (Decision 2011/61/EU), and the United Kingdom recognises that decision, so no further safeguards are needed for this transfer. The providers in section 6 may process data in other countries under their own safeguards; ask [email protected] for the details of any of them.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to processing, or to lodge a complaint with a data-protection authority. You can export your mail and files at any time via standard protocols (IMAP, JMAP, WebDAV) and request account deletion from the dashboard or by emailing [email protected].

To use any of these rights, write to [email protected]. We answer within one month. If your account belongs to an organisation's Reeva workspace, the organisation decides about the data in it; we pass your request on and help it answer. You can also complain to the data-protection authority of the country where you live or work.

9. Security

We protect data with TLS on every connection, account passwords hashed with argon2id, a password vault encrypted on your device, optional two-factor authentication, and ongoing monitoring. No system is perfectly secure; if you discover a vulnerability, please email [email protected].

10. Children

Reeva is not directed at children under 13 (or the equivalent local minimum age) and we do not knowingly collect personal data from them.

11. Changes to this policy

If we make material changes, we will let you know via email or an in-product notice. The "last updated" date at the top reflects the most recent revision.

Last updated: 2026-10-17. This policy is provided for transparency; consult a lawyer for legal advice specific to your situation.