Privacy Policy

Last updated: September 29, 2026 · Operator: Soft Romanesc · Contact: contact@superfly-mail.ro

1. Who we are

SuperFly Mail (“we”, “us”) is a service operated by Soft Romanesc. It lets you compose messages and share them via short links so recipients can open them in a browser without needing an email account. This Privacy Policy explains what we collect, why, how we share it, and your choices.

Contact: contact@superfly-mail.ro
Operator: Soft Romanesc
Website: https://superfly-mail.ro/

2. Information we collect

Account and identity. If you create an account or sign in, we process your email address, display name, profile photo URL (if provided), authentication provider (email/password, Google, or Apple), and a unique user ID. You may browse public pages without signing in. If the app creates an anonymous technical session, that session still has a technical user ID.

Google Sign-In data. If you tap “Sign in with Google”, Google shares with us the Google account information you authorize. That typically includes:

your Google account email address
your Google account name
your Google account profile photo
a Google user identifier needed to sign you in

We use this Google data only to create or authenticate your SuperFly Mail account, show your name and photo in the app, and contact you about the service (for example security or account messages). We do not use Google Sign-In data for advertising, and we do not sell it. We do not request Google data we do not need to run the account. You can revoke SuperFly Mail’s access to your Google account at any time at https://myaccount.google.com/permissions, and you can delete your SuperFly Mail account in the app.

Messages and sharing. Subject, message body (including rich text), attachment files and metadata, optional share-password data (stored as a salted hash, never the plain password), expiry settings, delete-on-read settings, short-link identifiers, view/open events, and comments on shared messages.

Usage and product data. Subscription tier, trial status, message and storage usage counters, AI feature usage counts, redeem-code redemptions, invitation relationships, and in-app feedback you submit.

Device and notifications. Push notification tokens (FCM) when you enable notifications, basic platform information (web, iOS, Android), and language/locale preferences.

Diagnostics. Application error reports (error message, stack context, platform, and user ID if available) so we can keep the service reliable.

Payments. Purchase and subscription status may be processed by Apple, Google, or Stripe. We do not store full payment card numbers.

3. How we use information

We use data to: provide and secure SuperFly Mail; create and resolve short links; enforce plan limits; enable optional features (password protection, expiry, delete-on-read, comments, read receipts); run AI assist features you request; send notifications you enable; improve reliability via error tracking; process feedback; prevent abuse; and comply with law. Google Sign-In data is used only for account authentication and identity as described above.

4. AI features

If you use AI tools (for example compose assistance), the text you submit for that request may be sent to our backend and/or third-party AI providers solely to generate the response. We track AI usage against your plan. Do not submit data you are not allowed to process. AI output may be inaccurate; you remain responsible for what you send.

5. SuperCopy

SuperCopy is designed for peer-to-peer file transfer between your devices or sessions. File bytes are transferred over the peer connection and are not stored as ordinary SuperFly message attachments in Firebase Storage. Session and device metadata needed to connect may still be processed to establish the transfer.

6. Recipients and shared links

Anyone with the link (and password, if you set one) may access the message until it expires, is deleted, or delete-on-read removes it. Do not put secrets in a link you would not want the recipient (or someone they forward it to) to see. View events and comments may be visible to the author depending on settings and plan.

7. Cookies and similar technologies

On the web, we and our providers (including Firebase / Google) may use cookies, local storage, or similar technologies for authentication, security, language preference, and basic service operation. Essential storage is required to keep you signed in. Analytics cookies are used only if you accept them in the cookie bar.

8. Legal bases and sharing

Where GDPR / UK GDPR applies, we process data to perform the contract (provide the service), with consent where required (for example certain notifications or analytics cookies), for legitimate interests (security, abuse prevention, product improvement), and to meet legal obligations.

We share data with processors that help run the app, including:

Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Cloud Messaging, and Google Sign-In when you choose that method)
Apple (Sign in with Apple, and In-App Purchases on Apple platforms)
Stripe or the relevant app store for paid subscriptions
AI providers when you use AI compose tools

We may disclose information if required by law or to protect rights and safety. We do not sell your personal information. We do not share Google user data with third parties for advertising.

9. Retention

Messages and attachments are retained until their expiry, manual deletion, delete-on-read, or account/admin cleanup. Account data is kept while your account exists. Error logs and feedback are retained as needed for support and security, then deleted or anonymized. Backup copies may persist for a limited period.

10. Security

We use industry-standard providers and practices (encrypted transport, hashed message passwords, access rules). No method of transmission or storage is 100% secure. You are responsible for safeguarding passwords, devices, and how widely you share links.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export your data, and to object to certain processing or withdraw consent. To exercise rights, email contact@superfly-mail.ro. You may delete messages from your account tools where available, or close your account in the app. You may lodge a complaint with your local data protection authority (in Romania, ANSPDCP).

If you signed in with Google, you can also remove SuperFly Mail from your Google account permissions at https://myaccount.google.com/permissions.

12. Children

SuperFly Mail is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided data, contact us and we will take appropriate steps.

13. International transfers

Data may be processed in countries where our providers operate (including the United States). Where required, we rely on appropriate safeguards offered by those providers.

14. Changes

We may update this Policy. We will revise the “Last updated” date and, when changes are material, provide additional notice in the app or by other reasonable means. Continued use after the effective date means you accept the updated Policy.

15. Contact

Privacy questions: contact@superfly-mail.ro
Operator: Soft Romanesc
Site: https://superfly-mail.ro/