We never see your mail. There is nowhere for it to go.

Your Mac connects to your provider directly. There is no relay, no sync host, no account to create with us. The one exception is yours to turn on: read receipts, below.

Passwords and OAuth tokens live in the macOS Keychain, read only at connection time.

Search, smart categories, mail rules, To Reply and phishing checks run on-device. Summaries and Rewrite use Apple's on-device model. Nothing is sent to a cloud to be read.

Tracking pixels are removed before a message is shown, even when you load images, and tracking codes are cleaned from the links you open.

Connecting Claude, Cursor or another AI app is off until you turn it on, and then only for the accounts you pick. What it reads goes to that app, not to us.

Turning them on asks you to accept that, in the EU, tracking whether mail was read can need the recipient's consent. Standard receipts travel as ordinary mail; for the rest, our server keeps only a hash of a random code, the time and whether the image was loaded automatically — never an address, a subject, the message or an IP. To tell you at once, it also keeps your Mac's or iPhone's push token beside that hash, and deletes both after 60 days.

No telemetry, no crash pings unless you press Send on a report you can read first.