हरकारा · Harkara

A private email client for any IMAP account

Privacy Policy

Last updated 4 October 2026

Your mail is not sent to us. Harkara syncs directly between your device and your mail provider. We operate no service that receives, stores, relays or reads your mail, and the app has no setting that would send it to one.

Harkara is an email client published by Bighelpers Softwares and Solution Pvt. Ltd, a company registered in India. This policy describes the app as published, and says plainly where it is precise and where it is not. Questions: admin@bighelpers.in.

The short version

We receive no personal information from the app, because it sends none to us. The app does read things on your phone — your mail, and your contacts if you allow it — and all of that stays on the device.
Your mail, contacts, attachments and settings stay on your device and with the mail provider you already use.
There is no advertising and no tracking in the app, and no analytics or crash reporting of our own. The one exception to “nothing is reported” is on Android, and only if you turn on reading and writing help: Google's ML Kit, which runs the model on your phone, sends Google usage statistics about it — never the text of your mail.
Reading and writing help — summaries, suggested replies, help with your wording, and what needs a reply — is optional, runs only when you ask, and is done by the model built into your device. Your mail is not sent anywhere for it, and nothing it writes is kept.
We do not sell, rent or share your information, because we do not hold it.
You can hand a single attachment to another app on your device — including our own VeriPatra and Pixifold — and the app tells you what crosses over before it does.
Some things you can choose to do — loading images in a message, unsubscribing from a mailing list — make your device contact the sender's servers. Those are listed below.

What the app connects to

Harkara contacts your mail provider. It also contacts a small number of other hosts, and only in the circumstances given here.

Destination	When
Your IMAP and SMTP mail servers	Whenever the app syncs or sends mail. This is the main thing it does.
Google sign-in and Gmail `accounts.google.com`, `oauth2.googleapis.com`, `mail.google.com`	Only if you add a Gmail account using Google sign-in.
Microsoft sign-in and Outlook `login.microsoftonline.com`, `outlook.office.com`	Only if you add a Microsoft account using Microsoft sign-in.
Google Drive `www.googleapis.com`	Only when you choose to attach a file from Drive. Drive may redirect the download to its own content hosts.
Google, for ML Kit's usage statistics Android only	Only on Android, and only after you have turned on reading and writing help. Google's ML Kit, the code that runs the on-device model, sends Google the usage statistics listed under Reading and writing help — never the text of your mail — and may fetch fixes and updated models from Google.
The on-device model's download Android only	Not a connection Harkara makes. Android's own AICore service downloads the Gemini Nano model and keeps it up to date, through Google's Private Compute Services. Harkara asks for the download only after you have turned reading and writing help on. On iPhone, iPad and Mac, Apple's model comes with the operating system.
Hosts chosen by the sender of a message	Only if you turn on remote images. Loading images in a message fetches them from wherever the sender put them, which can tell the sender you opened the message. Harkara keeps this off by default, and otherwise asks per message.
A mailing list's unsubscribe address	Only if you tap Unsubscribe. The app sends one request to the address the message itself supplied, over HTTPS, and does not follow redirects.
Big Helpers' list of its other apps `bighelpers.in`	Only when you open Settings › Partner Apps. The app asks for the list of Big Helpers apps for your phone's store and in your interface language, and loads their icons. The request carries nothing else: not your mail, not your accounts, and not even which app is asking. Tapping an app opens its page in the App Store or Google Play.

None of the connections that carry your mail pass through a server of ours. There is no Harkara service in the path. The Partner Apps list above is different: it comes from bighelpers.in, which is ours, and it is fetched only when you open it.

Google user data

If you sign in with Google, Harkara asks for these permissions and no others. Signing in to mail and connecting Google Drive are two separate consents; Drive is only asked for if you use it.

Permission	What it is for
`https://mail.google.com/`	Read, write, send and organise your mail over IMAP and SMTP — the ordinary work of a mail client. Gmail offers no narrower permission that allows IMAP access, which is why this one is requested.
`email`	So Google's own sign-in screen can show you which account you are about to connect. It is not a restricted permission and the app does not read your address from it — you type the address yourself when adding the account.
`drive.file`	Requested only if you attach a file from Google Drive. It grants access to the individual files you pick in Google's own file picker, and to nothing else in your Drive.

How Google user data is handled

Accessed: mail is fetched from Gmail's IMAP servers by your device.
Used: to show, search, compose, send and organise your mail in the app; if you turn the Wallet on, to find receipts, bookings and parcel tracking inside messages already on the device; and, only when you ask for it, to summarise a message, suggest replies, help rewrite what you are writing, or sort your newest unread mail by what needs a reply — using the model built into your device.
Stored: in a database on the device itself. Sign-in tokens are kept in the Android Keystore or the iOS Keychain. Summaries, suggested replies and the other results of reading and writing help are not stored at all.
Shared: your mail is shared with nobody. It is not transmitted to us or to any third party, and reading and writing help does not change that: the model runs on the device. On Android, the usage statistics Google's ML Kit sends contain no mail text, though they do include how much text the model was given and how much it wrote.
Retained: on the device until you remove the account or uninstall the app. We retain none of it, for any period, because we never receive it.

Limited Use

Harkara's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Its use of information received from Gmail and Google Drive also adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

In particular:

Google user data is used only to provide and improve user-facing features that are prominent in the app.
Google user data is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with the user's consent.
Google user data is not used for serving advertising, and is not sold.
Google user data is not used to create, train or improve any machine-learning or artificial-intelligence model, and your mail is not sent anywhere for that purpose. Reading and writing help only asks the model already on your device to answer the request you made.
Google user data is not read by humans, except with the user's explicit consent for specific messages, where necessary for security purposes such as investigating abuse, or to comply with applicable law.

What the app asks your phone for

Harkara asks the operating system for these permissions. Each is requested only when you use the feature that needs it, and the app works without any of them.

Permission	Why
Contacts	To offer names and addresses from your phone's address book when you are writing a message. Your contacts are read on the device and are never sent anywhere.
Photos and videos	To attach a picture or video you pick.
Notifications	To tell you when mail arrives.
Fingerprint or face	To unlock the app, if you turn the lock on.
Alarms and start-at-boot	To check for mail on the schedule you set, and to keep doing so after the phone restarts.

Where your information is kept

On your device. Mail, contacts, drafts, attachments you have opened, settings, and the Wallet's receipts and bookings are stored in a database on the phone itself.
Sign-in credentials — passwords, app passwords and OAuth tokens — are held in the operating system's protected store: the Android Keystore or the iOS Keychain.
Reading and writing help keeps nothing. Summaries, suggested replies, rewrites and “what needs a reply” labels exist only in the app's memory while it is running. They are not written to the database, not backed up and not synced. A suggestion or rewrite you choose to use becomes part of your message, like anything else you type.
Your mail is not uploaded. There is no cloud backup of your mail in Harkara, and no account to create with us. On Android, if you turn reading and writing help on, Google's ML Kit sends Google the usage statistics described under Reading and writing help; they contain no mail.

How it is protected

Connections to mail servers use TLS.
Credentials are sealed by the operating system's own key store rather than written into the app's database.
JavaScript is disabled wherever a message is displayed, and remote images are off unless you allow them.
The app can be locked with a six-digit passkey held in the device's secure store, together with your fingerprint or face.
No system is perfect, and a device that is lost, rooted or jailbroken is outside what an app can defend.

The Wallet

Harkara's Wallet picks out receipts, bookings and parcel tracking from mail already on your phone. That reading happens entirely on the device. No message is sent anywhere to be parsed, and the results are stored only on the device.

Reading and writing help

Harkara can summarise a long letter, suggest a few short replies, help rewrite what you have written — more formal, friendlier, shorter, with spelling and grammar fixed, or written out from your notes — and sort your newest unread mail from people by what needs a reply. All of it is optional, and each runs only when you tap for it. Nothing is summarised or sorted in the background.

It is done by the model built into your device. The text of your mail is not sent anywhere for it — not to us, and not to anyone else.
Nothing it produces is kept. Results are held in the app's memory while it is running and are never saved, backed up or synced. A suggestion or rewrite you choose to use becomes part of your message, like anything you type.
English only, for now. For a letter in Hindi or another Indian script, the app says so instead of trying.

On iPhone, iPad and Mac

Harkara uses Apple's on-device model — the language model built into Apple Intelligence, through Apple's Foundation Models framework — and no other model. It does not use Apple's Private Cloud Compute or any server model. The model comes with the operating system, so Harkara downloads nothing for it, and Harkara adds no code that reports on its use. It is on wherever the device supports it, and you can turn it off in Harkara's settings. Whether your device shares its own analytics with Apple is a setting of the device, not of Harkara.

On Android

Harkara uses Google's ML Kit GenAI, which runs Gemini Nano — Google's on-device model — inside Android's own AICore system service. The text of your mail, and what the model writes, stay on the device: Google's ML Kit terms say the input is processed fully on the device and is not sent, nor are the results, to Google's servers.

ML Kit does send Google usage statistics about the feature, and while the help is on there is no setting — in Harkara or in ML Kit — that stops them. Google's data disclosure for ML Kit lists what they contain:

Device information — the manufacturer, model, operating-system version and build, and the machine-learning hardware available.
Application information — Harkara's package name and version.
Device or other identifiers — for these features Google lists user, device or other identifiers, and per-installation identifiers that it says are not intended to identify a user or a physical device.
Performance metrics, such as how long a request took.
API configuration — the settings the feature was used with.
Feature input and output size — how much text went in and came out, not the text.
Feature version.
Event type — such as starting the feature, downloading the model, running it, or releasing it.
Error codes for those events.
Configured languages — the language the feature was set to use.

Google says these are used for diagnostics and usage analytics, are encrypted in transit, and are not passed on by ML Kit to third parties; its ML Kit terms add that Google uses them to measure performance, to debug, maintain and improve ML Kit, and to detect misuse. They go to Google, not to us, and Google's handling of them is governed by Google's privacy policy. ML Kit may also contact Google from time to time for fixes, updated models and information about the hardware it can use.

Because of those statistics, the help is off on Android until you agree to it. The first time you tap one of its buttons, Harkara explains this and asks; the other way to turn it on is its switch in Settings, and the same explanation is written under that switch. Both name what Google receives, as items from the list above — the device's make, model and system version; Harkara's version; an install ID (a per-installation identifier); the languages the feature is set to use; and how long each request took and how large it was — say that Google uses them to run and improve the service, and say that the text of your mail never leaves the device. The list above is the whole of what Google says it receives. Nothing is set up, and nothing is sent, until you choose Turn on — ML Kit is not even started before then: the piece of it that Android would otherwise start every time the app opens is removed from Harkara's Android app, and ML Kit is started only after you have turned the help on. Choosing Not now, or closing the question, does not turn it on. You can turn it on or off at any time in Settings. Leaving it off is the only way to avoid the statistics — they cannot be switched off while the help is in use. Turning it off stops Harkara asking anything new of ML Kit, but details of earlier use may still reach Google afterwards: ML Kit keeps them on the device and sends them later rather than at once.

The model itself is not part of Harkara. Android's AICore service downloads it and keeps it up to date, and AICore has no internet access of its own: its downloads go through Google's Private Compute Services. Google says AICore handles each request separately and keeps no record of what it was given or what it wrote.

Handing a file to another app

Harkara can pass an attachment to another app on your device. That happens only when you ask for it, one file at a time, and the app shows you what is being passed before it goes. What crosses over is a copy of that one file — not the message it arrived in, not who sent it, not your other mail, and not your mailbox password.

“Open with another app” and “Save to this phone or share” use your device's own sharing list, so the app that receives the file is the one you pick there. Harkara also offers two apps by name — VeriPatra, which checks whether a PDF's digital signature is valid, and Pixifold, which splits, shrinks and password-protects PDFs. Both are made by us and both are optional. To decide whether to offer them, Harkara asks your device about those two apps by name and gets back yes or no; it does not ask your device for a list of what you have installed.

Once a file reaches another app, this policy stops applying to that copy and the receiving app's own policy takes over. The two named apps are not the same as each other, and the difference matters before you choose:

VeriPatra uploads the file. It checks a PDF's signature on its own server, so a copy of the document you hand it leaves your device and reaches api.veripatra.com — a service operated by us, the same publisher. What happens to it there is governed by VeriPatra's own privacy policy, not this one. Harkara itself still sends us nothing.
Pixifold does not upload the file. It splits, shrinks and protects PDFs on the device. Pixifold is permanently free. Any online service you choose there follows Pixifold's own consent and privacy controls.

Deleting your information

Removing an account from Harkara deletes that account's stored mail, folders, drafts and credentials from the device. Uninstalling the app removes everything it kept.

Some things deliberately outlive the account they arrived with, so that removing a mailbox does not destroy work you did in the app: files you saved to the Shelf, Wallet entries, contacts and groups you created, and your settings. You can delete each of these in the app — the Wallet has a "Clear the Wallet" action, and saved files and contacts can be removed individually — and uninstalling removes them all.

Mail held by your provider is unaffected by any of this. To remove Harkara's access to a Google account, revoke it at myaccount.google.com/permissions.

Your rights

We do not hold your mail, contacts or settings, so in most cases there will be nothing for us to delete. You may still ask. Write to admin@bighelpers.in and we will tell you what, if anything, we hold about you, correct it or delete it on request, and reply within 30 days. If our answer does not satisfy you, you may complain to the Data Protection Board of India.

The usage statistics Google's ML Kit sends on Android, if you turn reading and writing help on, go to Google rather than to us, and are governed by Google's privacy policy.

Children

Harkara is meant for adults — people aged 18 and over — and is not directed at children. We do not knowingly collect information from anyone under 18. As above, we collect nothing ourselves; on Android, if reading and writing help is turned on, Google's ML Kit sends Google the usage statistics described under Reading and writing help, and Google's terms for that kit are for apps meant for adults.

If something goes wrong

Because no mail or personal data reaches our systems, a breach of our systems could not expose it. If we ever become aware of a security problem in the app that puts your information at risk, we will publish it on this site and notify the relevant authority where the law requires it.

Changes to this policy

If the app's behaviour changes in a way that affects this policy, this page is updated and the date at the top changes with it. The rule that mail is never sent to a server of ours is enforced in the app's code, not merely stated here, and is not something we intend to revisit.

Who we are, and how to reach us

Bighelpers Softwares and Solution Pvt. Ltd
HIG MP Housing Board Colony, Nadhav nagar gate,
Katni, Madhya Pradesh 483501, India
admin@bighelpers.in

Write to that address for anything in this policy, including a request under the Digital Personal Data Protection Act, 2023. It is also the grievance address for the purposes of that Act.