Unpile Join the beta

Privacy Policy

Last updated: October 2, 2026

This Privacy Policy explains how Coyotiv GmbH (“Coyotiv,” “we,” “us,” or “our”) handles personal data in connection with:

  • the Unpile website at https://unpileapp.com, including its beta and newsletter sign-up forms; and
  • the Unpile app for macOS.

Unpile is a Mac app that helps people clean up their Gmail and Google Workspace inboxes, for example by marking all mail from a sender as read, adding labels and creating Gmail filters.

We designed Unpile so that your email never reaches us. The app talks directly to Google from your Mac. We do not run servers that receive, store or process your mail.

1. Data controller

The controller responsible for processing personal data under this Privacy Policy is:

Coyotiv GmbH
c/o Factory Works GmbH
Rheinsberger Straße 76/77
10115 Berlin
Germany

Managing Director: Armağan Amcalar
Registered with the Amtsgericht Charlottenburg under HRB 217066 B
VAT identification number: DE815873870

Email: support@unpileapp.com

2. Privacy at a glance

Unpile:

  • processes your email only on your Mac, directly between the app and Google;
  • never sends your email, contacts or account data to Coyotiv or to anyone else (when you choose Unsubscribe, it sends the sender the unsubscribe request the sender itself asked for, see section 3.6);
  • does not require an Unpile account;
  • cannot send email, write drafts or permanently delete mail (deleting moves mail to Gmail's Trash, which you can undo);
  • stores your Google sign-in in the macOS Keychain on your Mac;
  • keeps an optional local copy of recent message text on your Mac, never attachments;
  • has no analytics, advertising or third-party tracking SDKs in the app (the website uses Google Analytics only if you accept it, see section 4.4); and
  • does not sell, rent or use personal data for advertising.

The website collects personal data when you choose to sign up for the beta or the newsletter, when you email us, and, only if you accept it, through Google Analytics.

3. Data processed by the Unpile app

3.1 Google account access

To work, Unpile asks you to sign in with Google and grant two permissions:

  • gmail.modify: to read your messages and labels, change read state and labels, and create and rename labels; and
  • gmail.settings.basic: to list, create and delete Gmail filters.

Google describes gmail.modify as allowing the app to “read, compose, and send emails”. That is Google's fixed wording for the narrowest permission that allows marking mail as read. Unpile contains no code to send email, create drafts or permanently delete mail. When you delete mail, Unpile moves it to Gmail's Trash, as Gmail's own Delete button does.

Sign-in happens on Google's own page in your browser. Unpile never sees your Google password. Google returns an access token to the app, which is stored in the macOS Keychain on your Mac. It is not sent to Coyotiv.

Using the app, the following Google user data is processed on your Mac only:

  • message headers (sender, recipients, subject, date), snippets and message bodies, to display your mail and count unread messages per sender;
  • labels and their counts;
  • your Gmail filters; and
  • your Gmail address, to show which account is signed in.

This data is requested from Google's servers (gmail.googleapis.com) and displayed in the app. It is not transmitted to Coyotiv or any third party.

You can revoke Unpile's access at any time by choosing Sign Out in the app, which revokes the token at Google, or at myaccount.google.com/permissions.

3.2 Google API Services User Data Policy

Unpile's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Google user data is used only to provide the user-facing features of Unpile;
  • it is not transferred to others, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice;
  • it is not used for advertising, including retargeting or personalised ads;
  • it is not sold, and not used to determine creditworthiness or for lending purposes; and
  • no human at Coyotiv reads your Google user data. Because the data never leaves your Mac, we have no access to it.

3.3 Local storage on your Mac

Unpile stores the following on your Mac, inside the app's sandboxed container:

  • Offline cache (optional, enabled by default with a limit of 1 GB that you can change or turn off in Settings): message headers, snippets, labels and the text of messages you have viewed or that were loaded in advance. Attachments are never stored. Signing out deletes that account's cache. Clear Cache or turning the cache Off deletes all of it.
  • Sign-in tokens, in the macOS Keychain.
  • Settings and Quick Actions, in the app's preferences.

3.4 iCloud sync

If Sync quick actions and accounts with iCloud is on (Settings → General, on by default), your Quick Actions (label names, colours and options) and the list of Gmail addresses you've added are stored in your own iCloud account using Apple's iCloud key-value storage, so your other Macs signed in to the same Apple Account get them. Sign-in tokens, mail, labels and the cache are never synced. Apple processes this data under its own privacy policy. Coyotiv has no access to it. Turning the setting off stops syncing.

This data is protected by your Mac's own security, such as your user account and FileVault. Coyotiv has no access to it. Uninstalling the app and deleting its container removes it.

3.5 Displaying messages

Messages are shown with JavaScript disabled. Links open in your default browser. Like most mail apps, Unpile loads remote images contained in a message, which means the sender's server may learn that the message was opened and receive your IP address. This happens between your Mac and the sender's server, without Coyotiv's involvement.

3.6 Unsubscribing

Mailing lists put an unsubscribe address in their messages (the List-Unsubscribe header). When you choose Unsubscribe and confirm, Unpile uses it the way the sender asks:

  • One click: Unpile sends a single request to the web address the sender put in the message, which tells the sender to stop. The address usually identifies you to the sender, which is its purpose. The request carries no cookies and no other data, and goes directly from your Mac to the sender's server, without Coyotiv's involvement.
  • Web page: the sender's unsubscribe page opens in your default browser.
  • Email: a pre-addressed unsubscribe message opens in your default mail app. Unpile does not send it; you decide whether to.

Nothing is sent to a sender unless you choose Unsubscribe for it.

3.7 Legal basis

Processing Google user data on your device is necessary to provide the features you request when you use Unpile, so the legal basis is Article 6(1)(b) of the General Data Protection Regulation (“GDPR”). Coyotiv does not receive this data.

3.8 Apple diagnostics

Unpile does not contain a third-party analytics or crash-reporting SDK. Apple may collect diagnostic or crash information at the operating-system level and, depending on your settings (such as “Share with App Developers”), share it with developers. This is controlled by Apple and your Mac's privacy settings. We do not use such information for advertising, profiling or tracking.

4. Data processed through the website

4.1 Beta sign-up

If you sign up for the beta, we process:

  • your email address (required);
  • your name, if you provide it;
  • which email providers you use;
  • your answers to the questions in the form (such as roughly how many unread emails you have and what makes cleaning up hard);
  • whether you also asked to receive the newsletter;
  • the country your request came from, as determined by Cloudflare from your IP address (we do not store the IP address itself);
  • where you came from, if your browser provides it: the campaign tags in the link you followed (such as utm_source=newsletter), the web page that linked you to us (its address without any query string), and the page on our website where you signed up; and
  • the date and time of the sign-up.

We use this information to send you a beta invitation, to decide which features and email providers to work on, and to contact you about the beta. We use where you came from only to learn which places and posts bring people to Unpile. It is read from the page you sign up on when you submit the form; nothing is stored in your browser for it.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time by emailing support@unpileapp.com, and we will delete your sign-up. For where you came from, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in knowing which channels reach people, which you can object to by emailing us.

4.2 Newsletter

If you subscribe to the newsletter, either directly or by ticking the box in the beta form, we process your email address, which form you used, your country (as above), where you came from (as described in section 4.1) and the date of subscription, to send you occasional news about Unpile.

The legal basis is your consent under Article 6(1)(a) GDPR. You can unsubscribe at any time using the link in any newsletter or by emailing support@unpileapp.com.

4.3 Storage of sign-ups

Beta and newsletter sign-ups are received by small programs (Cloudflare Workers) and stored in a database operated for us by Cloudflare (Cloudflare D1). Only Coyotiv staff who need to send invitations or newsletters have access.

4.4 Cookies and analytics (Google Analytics)

The website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), only if you consent. Until you click Accept in the cookie banner, the Google Analytics code is not loaded, no request is sent to Google and no analytics cookie is set.

If you accept, Google Analytics helps us understand how the website is used, for example which pages are visited, how visitors arrive, and whether the sign-up forms work, so that we can improve it. For this, Google Analytics stores cookies in your browser and processes:

  • a randomly generated identifier for your browser (in the cookies _ga and _ga_3RQW0W5JLR, which expire after 2 years);
  • the pages you view, when you view them, and how you arrived (for example the referring website or a search engine);
  • whether you completed a beta or newsletter sign-up (only that it happened and which form, never your email address, name or answers);
  • technical information such as browser, operating system, screen size and language; and
  • your approximate location (country and city), derived from your IP address. Google Analytics 4 does not log or store IP addresses for visitors in the European Union.

We have turned off Google Signals and ad personalisation, so this data is not linked to your Google account and is not used for advertising. We do not combine it with your beta or newsletter sign-up details. We keep analytics data for 2 months.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw consent at any time, with effect for the future, by choosing Cookie settings at the bottom of any page and clicking Reject. The analytics cookies are then deleted and no further data is sent.

Google acts as our processor under the Google Ads Data Processing Terms. Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and the transfer is additionally covered by Standard Contractual Clauses. More information: Google's privacy policy and how Google uses information from sites that use its services.

Your cookie choice itself is stored in your browser's local storage (unpile-consent) so that we don't ask again on every page. This is strictly necessary to respect your choice and is not shared with anyone.

4.5 Hosting and technical request data

The website is hosted and delivered using Cloudflare, including Cloudflare Pages, Workers and content-delivery and security services. When you visit the website, Cloudflare may automatically process standard technical request information needed to deliver and protect the website, such as IP address, date and time, requested page, browser and operating-system information and security-related information.

We do not use this information to profile or track you. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are delivering the website securely, keeping it available, preventing abuse and diagnosing technical problems.

5. Support communications

When you email us, we process your email address, the contents of your message and any attachments or technical details you include, to respond and provide support. The legal basis is Article 6(1)(b) GDPR where the message concerns your use of Unpile, and Article 6(1)(f) GDPR otherwise, based on our legitimate interest in answering inquiries.

Please do not send us copies of emails or other sensitive information unless it is needed to resolve your request.

6. Service providers and recipients

  • Google provides the Gmail API your Mac connects to directly. Your use of Gmail is governed by Google's own terms and privacy policy.
  • Cloudflare provides website hosting, content delivery, security, and the storage of beta and newsletter sign-ups.
  • Google provides Google Analytics for the website, only if you consent (see section 4.4).
  • Apple provides app notarization, optional operating-system diagnostics and, if you use it, iCloud sync of Quick Actions and your account list.
  • Our business email provider processes emails you send us.

We may also disclose information where legally required, such as in response to a valid court order.

We do not sell personal data or provide it to data brokers, advertising networks or marketing platforms.

7. International data transfers

Coyotiv is established in Germany, within the European Economic Area. Cloudflare, Google, Apple and other providers may process information on systems outside the European Economic Area, including in the United States. Where required, they rely on safeguards such as the EU–US Data Privacy Framework, Standard Contractual Clauses approved by the European Commission, or other legally recognised measures.

8. Data retention

  • Email and other Google user data stays on your Mac and with Google. We never hold a copy. The local cache is deleted when you sign out, clear it or turn it off.
  • Beta sign-ups are kept until the beta ends and the app is generally available, or until you ask us to delete them, whichever comes first.
  • Newsletter subscriptions are kept until you unsubscribe. After unsubscribing we may keep your address in a suppression list only to make sure you are not emailed again.
  • Support emails are kept only as long as needed to handle your request and meet legal record-keeping obligations.
  • Website technical data is retained according to Cloudflare's service configuration and practices.
  • Google Analytics data (only if you consented) is kept for 2 months, then deleted automatically by Google.

9. Data security

  • Your email is processed on your Mac and transferred only over encrypted connections between your Mac and Google.
  • Sign-in tokens are stored in the macOS Keychain.
  • The app runs in the macOS App Sandbox and is signed and notarized by Apple.
  • We operate no database of user email or Google accounts.
  • Sign-up data is stored with access limited to the people who need it.

No system can be guaranteed to be completely secure. Please protect your Mac and your Google account with appropriate measures, such as a strong password, FileVault and two-step verification.

10. Your rights under the GDPR

Where the GDPR applies, you have the right to:

  • access the personal data we hold about you;
  • rectification of inaccurate data;
  • erasure of your data;
  • restriction of processing;
  • data portability;
  • object to processing based on our legitimate interests;
  • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal; and
  • lodge a complaint with a data-protection supervisory authority. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

To exercise these rights, email support@unpileapp.com. Because your email data never reaches us, requests about it must be handled on your Mac (by signing out or clearing the cache) and with Google.

11. Children's privacy

Unpile is not directed at children under 16, and we do not knowingly collect personal data from children through the website. If you believe a child has signed up, contact us and we will delete the information.

12. Automated decision-making

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

13. Changes to this Privacy Policy

We may update this Privacy Policy when Unpile, our service providers or the law change. The current version is published at https://unpileapp.com/privacy/, and the “Last updated” date shows the latest revision. Where a change materially affects how we process personal data, we will give additional notice on the website or in the app.

14. Contact

Coyotiv GmbH
c/o Factory Works GmbH
Rheinsberger Straße 76/77
10115 Berlin
Germany

Email: support@unpileapp.com