Privacy Policy
Effective date: October 11, 2026
OpenMail is a mail client that runs on your Mac. This policy explains what data the app handles, where it is stored, and which servers it contacts. It also covers this website.
Summary
- Your mail, attachments and search index are stored only on your device.
- Refresh tokens and passwords are stored only in the macOS Keychain.
- There is no OpenMail server. The developer never receives your mail, contacts, calendar data or credentials.
- OpenMail has no analytics, telemetry, crash reporting or advertising.
- The app talks to your mail provider, and to other services only for features you turn on. Every one is listed below.
Who we are
OpenMail is developed by an independent developer, referred to here as “we”. You can reach us at klausfanzd@gmail.com.
Data stored on your device
| Data | Where it is stored |
|---|---|
| Messages, attachments, labels and folders, drafts, cached contacts, the search index, on-device OCR and semantic index, AI summaries and suggestions, settings | A database and files in ~/Library/Application Support/openmail on your Mac |
| OAuth refresh tokens, IMAP and SMTP passwords and your Anthropic API key | The macOS Keychain |
| The OAuth client ID and secret, if you register your own client | config.json in the same folder, readable only by your user account |
| A diagnostics log | The same folder. It holds fixed fields only: time, event type, provider, HTTP method, endpoint template, status code, failure category, the name of a failed internal request and whether it failed, was a defect or was interrupted, the phase and counts of a sync reset, crash and abnormal-exit entries with an exit code, the SQLite result code of a skipped database statistics refresh, and hashes of the account and folder. The hashes are keyed with a random secret that stays on your Mac. The log never records message content, addresses, full URLs, tokens or stack traces. The secret is in diagnostics.key in the same folder. An export replaces every hash with a number that is valid for that export only. It starts with a summary line: the OpenMail version and build, whether the app is packaged, the macOS, Electron and Node versions, the CPU architecture, the database version, and whether search statistics exist. For each numbered account it lists the provider, sync state, time since the last successful sync, how many changes and outbox messages are waiting, the reason sign-in is needed again and the stored failure category. It is never uploaded. The Feedback window lets you attach it to an email that you send yourself. |
| Copies of attachments you open in other apps | ~/Library/Application Support/OpenMail/Opened Attachments, also when you set OPENMAIL_HOME. Copies you have not changed are deleted 7 days after you last opened them, unless another app still has the copy open (its lock file is in the folder); Settings → Local cache clears it anyway. Copies you edited stay until you clear them in Settings → Local cache. Time Machine skips this folder. If you set Open attachments from to Downloads, copies go to your attachment folder instead and OpenMail does not delete them. |
Refresh tokens are never written to the database or to logs. OpenMail does not turn on Electron's crash reporter.
Servers the app contacts
OpenMail connects only to the following, and only for the purposes listed.
- Google, for Gmail accounts:
accounts.google.comandoauth2.googleapis.comfor sign-in,gmail.googleapis.comfor mail, and, if you connect them,www.googleapis.comfor Calendar andpeople.googleapis.comfor Contacts. Contact photos load fromgoogleusercontent.comwhen you have connected Contacts and photo display is on. - Microsoft, for Outlook accounts:
login.microsoftonline.comfor sign-in andgraph.microsoft.comfor mail, and, if you connect them, contacts and calendar. - Your IMAP and SMTP servers, for IMAP accounts, always over TLS.
- Anthropic (
api.anthropic.com), only if you save an API key and allow an account to use AI. See AI features. - Senders' servers. Remote images in a message load from the sender's servers, which can see when you open the message and your IP address. By default images load and known tracking pixels are blocked. You can choose to load images only from people you know, or to ask each time. If you confirm a one-click unsubscribe, OpenMail sends one HTTPS request to the address the sender published for that purpose.
- Hugging Face (
huggingface.co), only if you turn on on-device models in indexing settings. OpenMail downloads model files from there. No mail data is sent. Indexing then runs on your Mac. - GitHub (
api.github.com,github.comand GitHub's release file hosts), only in Developer ID signed builds. OpenMail checks for and downloads new versions there from the public repository, without a GitHub account or token. No mail data is sent.
These requests, like any network request, reveal your IP address to the server receiving them. Links you click in a message open in your web browser.
If you connect an MCP client, such as Claude Desktop, to the OpenMail MCP server, that client can read mail from the accounts you allowed for AI. What the client does with it is governed by that client and its provider. The MCP server is read-only by default and cannot send mail.
If you turn on remote access, OpenMail on your Mac serves your mail to browsers on your own devices. The data goes from your Mac to those devices over your Tailscale network, encrypted end to end by WireGuard. It does not pass through OpenMail servers. Tailscale's coordination server sees which of your devices connect, but not your mail. Remote access is off by default and never uses Tailscale Funnel, so it is not reachable from the public internet.
AI features
AI features are off by default. To use them you provide your own Anthropic API key and turn on “Allow AI to read this account” for each account. When you then use a feature, or turn on automatic summaries or triage suggestions for that account, OpenMail sends your question and the relevant message text, subjects, and sender and recipient addresses from your Mac directly to Anthropic using your key. It does not send message HTML, images, attachment files, or text extracted from images and PDFs. Anthropic processes that data under its own terms and privacy policy. We never receive it.
Turning off an account's AI permission deletes the AI results stored for it on your Mac.
Google user data
When you add a Gmail account, Google asks you to grant OpenMail access. OpenMail requests the following scopes. Optional scopes are requested only when you turn on the feature that needs them.
| Scope | When requested | Why |
|---|---|---|
https://www.googleapis.com/auth/gmail.modify | Every Gmail account | Read and sync your messages, labels and drafts. Apply the changes you make in the app: mark read, star, label, archive, move to Trash, save drafts. Read your send-as addresses and signatures. |
https://www.googleapis.com/auth/gmail.send | Every Gmail account | Send the messages you write and confirm in the app. |
https://www.googleapis.com/auth/contacts.readonly | Only if you connect Contacts | Suggest addresses from your saved Google contacts while you write. |
https://www.googleapis.com/auth/contacts.other.readonly | Only if you connect Contacts | Suggest addresses from Google's “Other contacts” list while you write. |
https://www.googleapis.com/auth/calendar.events | Only if you connect Calendar | Find the calendar event for an invitation you received, record your accept, tentative or decline answer, and show conflicting events. |
https://www.googleapis.com/auth/gmail.settings.basic | Only if you connect Gmail settings | Create, edit and delete Gmail filters and change your vacation auto-reply when you ask the app to. |
https://mail.google.com/ | Only when you first permanently delete mail or empty Trash | Permanently delete messages. The gmail.modify scope cannot do this. |
OpenMail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- OpenMail uses Google user data only to provide the mail, contacts and calendar features you see in the app.
- Google user data stays on your device. It is transferred to a third party only when you ask for it: to Anthropic when you use an AI feature on an account you allowed, or to an MCP client you connected yourself.
- OpenMail does not use Google user data for advertising, does not sell it, and does not use it to build user profiles.
- OpenMail does not use Google user data to develop, improve or train generalized AI or machine learning models.
- No person working on OpenMail reads your Google user data. We do not receive it.
Microsoft account data
For Outlook accounts OpenMail requests Mail.ReadWrite, Mail.Send, User.Read, offline_access and MailboxSettings.ReadWrite, and optionally Contacts.Read, People.Read and Calendars.ReadWrite. The same rules apply: the data stays on your device and is used only for the features you use.
Sharing and sale
We do not sell, rent or share your data. We do not receive it in the first place, so we have nothing to share.
Retention and deletion
- Data stays on your Mac until you delete it.
- Removing an account in Settings deletes its local mail, attachments and Keychain entry, and the copies of its attachments you opened and did not change. Copies you edited stay until you clear them in Settings → Local cache. Mail on your provider's server is not affected.
- To revoke OpenMail's access at the provider, use Google account permissions or Microsoft account consent.
- To remove everything, delete the app, the folder
~/Library/Application Support/openmail(and~/Library/Application Support/OpenMailif you setOPENMAIL_HOME), and the OpenMail entries in Keychain Access.
Security
Connections to mail providers and AI services use TLS. Credentials are kept in the macOS Keychain. Message HTML is displayed in a sandbox without scripts. Details are in the security model.
Children
OpenMail is not directed to children under 13.
This website
This website is a static site. It sets no cookies and runs no analytics. Your browser's local storage remembers your light or dark theme choice. The hosting provider, Vercel, processes requests to serve the site and may keep server logs, including IP addresses, for operation and security.
Changes
If this policy changes, we will update this page and its effective date. If OpenMail starts handling data in a new way, the policy will say so before the app does it.
Contact
Questions about this policy: klausfanzd@gmail.com.