Privacy Policy

Rickard is operated by Vantage Software Pty Ltd ("we", "us"). Contact: privacy@rickard.co.

This policy covers:

• family.rickard.co: sign-in, account settings and the app launcher;
• mail.rickard.co: Rickard Mail;
• calendar.rickard.co: Rickard Calendar;
• admin.rickard.co: Rickard Admin, used by administrators;
• mx.rickard.co: mail and calendar access for mail apps;
• legal.rickard.co: these documents. It sets no cookies, runs no scripts and keeps no visitor logs;
• the Rickard Mail and Rickard Calendar apps for iPhone, iPad and Mac.

It also covers people without an account whose information passes through the service. See People without an account.

We handle personal information in line with the Australian Privacy Principles.

Data is stored in Australia. It leaves Australia only in the cases listed under International transfers.

We may keep off-site backups of the service's data. Any off-site backup is encrypted.

Your account

• Profile: first, last and display name; email address and aliases; role; account status; birthday; gender (optional: "Prefer not to say" or your own words); time zone; region format; profile picture (stored only as re-encoded 64, 128 and 512 pixel copies).
• Contact details you add: mobile number and its country, and recovery email address. Not verified.
• Profile prompts: when the apps asked you to complete a missing profile detail, and your answer. You can turn prompts off under Account → Personal info.
• Password: not stored by us. The mail service stores a one-way hash. Each sign-in creates a separate session password, stored encrypted.
• Settings: your preferences in each app.

Every account holder can see your name, email address and picture. Your full name and date of birth appear on the shared Birthdays calendar. Administrators can see and change all profile fields.

Purpose: to provide your account and show who is who.

Sign-up requests

• A request: name, birthday, gender, requested address, recovery email address, mobile number, the password as a one-way hash, and the request's IP address and user agent.
• Who sees it: administrators, who approve or reject it. A reason for a rejection is visible to administrators only.
• Emails: the approval or rejection is sent to the recovery address.

A request is kept up to 30 days while pending and deleted 30 days after it is decided or expires. An approved request's details become the new account's.

Purpose: to decide requests and create accounts.

Sign-in, sessions and devices

• Sessions: IP address, browser or app (user agent), device name and platform (apps), start time and last use. Visible to you under Account → Security, and to administrators.
• Sign-in attempts: successful and failed sign-ins, with IP address, are written to the audit log. Used to block password guessing.
• Mail apps: app passwords (name and creation time) and the latest mail app sign-in (time, IP address, protocol).
• Apple setup profiles: downloadable once, from a link that expires after 10 minutes.

Purpose: to keep you signed in, show you where you are signed in, and protect accounts.

Rickard Mail

Your mail is stored with its attachments, folders, labels, drafts, sending addresses, signatures, filters, blocked senders, forwarding and auto-reply settings.

Automatic processing, performed by us: returning snoozed mail, muting conversations, sorting the inbox into tabs, message previews, and applying your filters. Sorting reads each new message's headers and content. When you move mail between tabs, the move is kept for 30 days, together with a per-person model of your corrections (feature counts, not messages).

Open tracking

Open tracking is off by default. You turn it on per message in the composer ("Track opens"). Replies in a tracked conversation are tracked until you turn it off.

• A 1×1 image (mail.rickard.co/m/<random code>.gif) is added to the delivered copy. Your Sent copy does not contain it. Links are not changed.
• When the recipient's mail app loads the image, we record the time, IP address and user agent, and derive an approximate location (city, region, country) and network provider using the DB-IP Lite database, looked up by us. Known proxies (Gmail's image proxy, Apple Mail Privacy Protection) and security scanners are identified.
• Only the sender sees the results: number of opens, first and last open, approximate places, and whether the message appears forwarded.
• Opens from your own recent IP addresses (kept 90 days for this purpose) and from private networks are ignored.
• Recipients are not told that a message is tracked. Recipients who do not load images are not tracked.
• Tracking records are deleted after 180 days.

Images in received mail

Remote images load through our image proxy. The sender sees our address, not yours. Proxied images are not stored by us. Known tracking pixels are removed. Images in Spam do not load unless you allow them.

Spam and phishing filtering

• Incoming mail is checked: sender, origin, headers, content, linked domains, and attachment names and types.
• Domain names and IP addresses are looked up in the Spamhaus, SURBL, URIBL and SpamEatingMonkey blocklists. A one-way digest of each message's text is checked against Pyzor. Phishing lists from OpenPhish and PhishTank are downloaded and checked locally.
• Each message's spam verdict and reasons are kept with the message.
• Marking mail as spam, not spam or phishing trains a filter used only for your mailbox.

Unsubscribe

For messages that support one-click unsubscribe, we send the request to the address in the message; the sender learns that your address unsubscribed. Otherwise a pre-filled email or the sender's web page opens.

Previous mail host

If your mailbox at the previous mail host (Namecheap) is linked:

• the server name, your old address and password, and a dedicated password for Rickard are stored, encrypted;
• the two mailboxes are synced both ways, including deletions;
• administrators can see sync status: folder names, message counts and errors;
• the stored passwords are deleted when the link is removed.

Namecheap holds its own copy of your old mailbox under its own privacy policy. Administrators hold a Namecheap cPanel access key to manage mail forwarders.

Rickard Calendar

• Calendars and events: titles, times, places, descriptions, guests and their responses, reminders and colours. Private unless you share them.
• Family calendar: every account holder can see, add, change and delete its events.
• Birthdays calendar: shows every account holder's full name and date of birth to every account holder.
• Invitations: guests are emailed from your address. Guests without an account receive response links (valid 90 days); their response is recorded on your event.
• Reminders: in the apps, scheduled on your device. Email reminders are sent as "Rickard Calendar".
• Published calendar links: a calendar published as a secret link (calendar.rickard.co/ics/<code>.ics), with full details or free/busy only, can be read by anyone who has the link. The link code is stored hashed, and encrypted so it can be shown to you again.

Connected calendar accounts

You can connect Google, Microsoft (Outlook.com, Microsoft 365), Apple iCloud, other CalDAV calendars and calendar links (.ics).

• Stored: provider, label, the account's email address, and the sign-in (Google and Microsoft OAuth tokens; iCloud app-specific password; CalDAV username and password), encrypted and never logged; sync status; calendar names and colours; for each event, its remote ID, a fingerprint of the last synced version, and when it changed.
• Synced: your calendars and their events (titles, times and time zones, recurrence, places, descriptions, guests and responses, reminders), both ways where the provider allows. Microsoft calendars cover one year back and two years ahead. Calendar links are read-only.
• Permissions requested: Google: openid, email, https://www.googleapis.com/auth/calendar. Microsoft: openid, email, profile, offline_access, Calendars.ReadWrite, User.Read. No other data in those accounts is accessed.
• Change alerts: Google and Microsoft notify calendar.rickard.co of changes. Alerts contain no event details.
• Disconnecting deletes the stored sign-in, stops syncing and change alerts, and removes the synced calendars unless you keep their events. For Google, it also revokes Rickard's access at Google. Microsoft does not allow apps to revoke their own access: remove Rickard at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts). For iCloud, revoke the app-specific password at account.apple.com.

Google user data: Limited Use

Rickard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google Calendar data is used only to show and sync the calendars you connected, a feature you can see and control in Rickard Calendar;
• it is not transferred to anyone, except as necessary to provide that feature, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your explicit prior consent;
• it is not used for advertising and is not sold;
• no person reads it unless you give consent, it is necessary for security purposes or to comply with applicable law, or it is aggregated and anonymised for internal operations;
• it is not used to develop, improve or train generalised AI or machine-learning models.

Microsoft user data

Data from Microsoft Graph is used only to show and sync the calendars you connected. It is not transferred except as necessary for that feature, to comply with law or for security. It is not used for advertising, is not sold, and is not used to train AI models. We comply with the Microsoft APIs Terms of Use.

Rickard Admin

admin.rickard.co is available only to administrators. It shows accounts and profiles; sign-up requests; sessions and devices with IP addresses; app password names; aliases and shared inboxes; the audit log; bug reports; the outgoing mail queue (sender, recipients, size, time and sending IP, not content); delivery failures; and previous mail host sync status. It has no function for reading mail or calendars.

Audit log

The audit log records sign-ins and failed sign-ins, password changes and resets, profile and picture changes, app passwords created or revoked, accounts created, suspended, restored or deleted, shared inbox changes, calendar connections and publishing, bug reports, previous mail host actions, mail queue actions and change notices sent. Each entry records who acted, the action, the affected account, details (never passwords or message content), IP address and time.

Administrators can see the audit log. Audit log entries may be kept indefinitely. When an account is deleted, its audit log entries are kept and keep the person's name.

Purpose: security, accountability and preventing password guessing.

Bug reports

A bug report contains:

• your description;
• screenshots taken when you started the report, and up to three taken when an error appeared. You can remove any before sending. In the web apps, email bodies are blanked in screenshots;
• app details: app and version, page and title, device, system version, screen size, your settings, and your last 100 actions in the app (pages, buttons, requests with address, result and timing, errors). Never passwords, sign-in tokens or full messages;
• your account, IP address and user agent.

Administrators can read and delete reports. Reports are kept until deleted. When an account is deleted, its reports are kept without a link to the account.

API usage meter

Requests to outside services (listed under Recipients) are counted. The meter stores counts only, per service and per account, person or device (by internal ID; a device by a one-way hash of its notification token). Per-person counters are deleted after 2 days, alerts after 90 days, and daily totals per service (no personal data) after 400 days.

Notifications

If you allow notifications in the apps, we store your device's notification token, the app, which mailboxes to notify about, your notification setting and the registration time.

Notifications are sent through the Apple Push Notification service (APNs) and contain no message content: "New message" or "New invitation", internal IDs and the unread count, or a silent sync signal. Apple receives the device token, app, time and that payload.

A registration is deleted when you sign out of the app or Apple reports the token invalid.

iPhone, iPad and Mac apps

• On your device: mail and calendar data, sign-in tokens (in the Keychain), and settings. Signing out deletes the on-device mail databases.
• Sent to us: device name, platform and app version.
• App updates: the apps download screens, text and icons from us. These contain no personal data.

Change notices

When these documents change materially, every active account receives an email from noreply@rickard.co. We record which accounts were sent which notice.

Only essential cookies are used. Each is limited to the host that set it, sent only over HTTPS, and not readable by scripts.

The web apps also keep your theme, layout choices, open drafts and active account in your browser's storage. This data is not sent to us.

No advertising, analytics or third-party cookies are used.

We do not sell, rent or trade personal information, and do not use it for advertising or analytics. Personal information is disclosed only as follows:

We disclose personal information when required by law. We tell you about such a request unless the law prevents it.

• All connections use TLS 1.2 or later. Web traffic uses HSTS.
• Sign-in tokens are random, stored only as hashes, and bound to one host.
• Passwords for other services and OAuth tokens are stored encrypted.
• Sign-in attempts are rate-limited (5 failures per account, or 20 per IP address, in 15 minutes).
• The web apps use a strict Content Security Policy and display email without scripts.
• Requests made for you (images, unsubscribe links, calendars) go only to public internet addresses.
• Notifications and logs contain no message content.

Email privacy@rickard.co. We respond within 30 days.

• Access: your profile and sessions are under Account; your mail and calendars are in the apps. Ask us for anything else, including audit log entries, bug reports and tracking records about you.
• Correction: edit your profile under Account → Personal info. Ask us to correct anything else.
• Copy: download your mail with any IMAP client (settings under Account → Mail) and export calendars as .ics files. Ask us for anything else.
• Deletion: delete mail, events, connected accounts and your picture yourself. Ask us to delete your account. See Deleting your account.
• Complaints: contact us first. You can also complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).

When an account is deleted:

• its mailbox, calendars, contacts and settings are deleted;
• its profile, picture, sessions, app passwords, notification registrations, connected accounts and tracking records are deleted, and Rickard's access at Google is revoked;
• its addresses are retired and never reassigned;
• it is removed from the Family and Birthdays calendars;
• audit log entries are kept, with the person's name; bug reports are kept without a link to the account.

Mail already sent stays with its recipients. Events added to the Family calendar remain.

A person under 18 can have an account with the consent of a parent or guardian, who can access, correct or delete the child's information on their behalf.

Personal information leaves Australia only:

• to Google, Microsoft or Apple, for calendars you connect. They may store it outside Australia, mostly in the United States, under their own privacy policies;
• to Apple, for notifications in the apps;
• when you send mail to, or load images from, servers outside Australia.

• If you email an account holder, your message, name, address and message headers are stored in their mailbox, checked for spam as described above, and kept as long as they keep the message.
• If you are invited to an event, your name, email address and response are stored on the event.
• If you open tracked mail with images on, the time, IP address, mail app and approximate location are recorded for the sender, for up to 180 days. See Open tracking.
• If you appear in a connected calendar, your details on those events are synced.
• If you request an account, see Sign-up requests.

Contact privacy@rickard.co to access or delete information about you.

Each version shows its version number, the date it was published and the date it takes effect, and lists what changed. Every earlier version remains available at its own address, for example legal.rickard.co/privacy/2026-11-01. For a material change, we email every active account at least 14 days before the change takes effect. Other changes take effect when published. This policy is updated before any new app or outside service goes live.

Vantage Software Pty Ltd, privacy@rickard.co. Questions about the Terms: legal@rickard.co.