Minimail Privacy Policy
Draft — pending legal review. This policy describes how Minimail works today. It has not yet been reviewed by a lawyer. Every
[PLACEHOLDER]must be filled in before it is final.
Effective date: [EFFECTIVE DATE] · Last updated: [LAST UPDATED]
1. Who we are
Minimail ("Minimail", "we", "us") is a keyboard-first email client that runs in your web browser at https://[DOMAIN]. It connects to the mailbox you already have: Gmail and Google Workspace, Outlook.com and Microsoft 365, iCloud, Yahoo, Fastmail, Zoho, GMX, AOL, and other IMAP/SMTP servers.
Minimail is operated by [LEGAL ENTITY NAME], [ADDRESS], [COUNTRY], [COMPANY / VAT NUMBER]. We are the data controller for the limited personal data described in this policy.
Privacy contact: [PRIVACY EMAIL]. Support: [SUPPORT EMAIL].
2. The short version
- Minimail has no database. We do not store your email, contacts, attachments, search history or account list on our servers.
- Gmail and Outlook mail goes straight from your provider to your browser.
- IMAP mail passes through our server's memory, because browsers can't open IMAP or SMTP connections. It is never written to disk or logged.
- Your sign-in is sealed (encrypted with a key only our server holds) and stored only on your device. It can't be opened on any other device.
- Search runs on your device. The index is encrypted and stays there.
- No ads, no selling data, no AI training on your mail, no tracking cookies.
3. What Minimail accesses
3.1 Google accounts (Gmail and Google Workspace)
When you choose "Continue with Google", you grant these permissions:
| Permission (scope) | What it lets Minimail do | Why |
|---|---|---|
openid, email, profile |
Read your Google account email address and name | To label the account in Minimail |
https://www.googleapis.com/auth/gmail.modify |
Read messages, threads, labels and attachments; create drafts and send mail; change labels (archive, read/unread, star, move to trash, snooze). It cannot permanently delete mail. | To show, search, write, archive, trash and snooze your mail |
3.2 Microsoft accounts (Outlook.com and Microsoft 365)
When you choose "Continue with Microsoft", you grant openid, email, profile, offline_access, Mail.ReadWrite, Mail.Send and User.Read, for the same purposes as above.
3.3 IMAP accounts (iCloud, Yahoo, Fastmail, Zoho, GMX, AOL and others)
You give Minimail your email address and a password, usually an app password you create at your provider, plus the server settings. Minimail can find those settings automatically: it looks up your domain's mail (MX) records and the public Mozilla Thunderbird autoconfig database (autoconfig.thunderbird.net). That lookup sends your domain name, never your full address or password.
We request only what is needed for features you can see in the app.
4. How your data moves
4.1 Gmail and Microsoft: provider to browser
Your browser calls Gmail's API or Microsoft Graph directly. To do that it needs a short-lived access token (valid for about an hour). Your browser gets one by sending your sealed sign-in (§4.3) to our server, which opens it in memory, asks Google or Microsoft for a fresh access token, and returns it. The access token is kept in the page's memory only. Message content does not pass through our server.
4.2 IMAP: through our server's memory, never stored
Browsers can't speak IMAP or SMTP. So for IMAP accounts, each action (list a folder, open a message, move, send) is a single request to our server. The server opens your sealed sign-in in memory, connects to your mail server, performs that one action, returns the result to your browser and disconnects. Message content, attachments and credentials pass through memory only. They are never written to disk, cached on the server or logged.
4.3 Sealed sign-ins, stored on your device
Your sign-in (a Google or Microsoft refresh token, or your IMAP password) is encrypted by our server with AES-256-GCM, using a key derived from a server master key and a random secret tied to your device. The sealed result is stored only on your device (in your browser's storage). We keep no copy. Without both the server key and your device's secret, it can't be opened, so a copy taken to another device is useless.
4.4 What is kept on your device
| Data | Where | Protection |
|---|---|---|
| Your accounts list and sealed sign-ins | Browser storage | Sign-ins are sealed (§4.3) |
| Device secret | mm_device cookie, HttpOnly |
Not readable by page scripts |
| Cached mail for speed | IndexedDB | Encrypted |
| Search index (text, attachment text, optional image features) | IndexedDB | Encrypted with a non-extractable key kept on the device |
| Snoozes, settings, theme | Browser storage | — |
You control all of it: remove an account, or choose Sign out of this device, and Minimail deletes that account's data from the device. Clearing your browser's site data does the same.
4.5 What our server keeps
Nothing about you or your mail. There is no database. Like any web service, our hosting provider records basic request logs (route, status code, timing, and an IP address shortened before we log it: IPv4 to /24, IPv6 to /48). When you choose "Continue with Google" or "Continue with Microsoft", the address you typed is passed on in the sign-in link so the provider can preselect your account, so it can appear in those hosting logs. Our own logs are restricted to an allowlist of technical fields and never include mail content, email addresses, passwords or tokens.
5. Google API Services: Limited Use disclosure
Minimail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide the user-facing email features that are visible in Minimail's interface.
- We do not transfer Google user data to others, except as needed to provide those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your prior consent.
- No advertising. We do not use, sell or transfer Google user data for advertising, retargeting or interest-based ads, to data brokers, or to determine creditworthiness.
- No AI training. We do not use Google user data to develop, train or improve AI or machine-learning models, ours or anyone else's. The optional on-device search model runs in your browser and is not trained on your mail.
- No human reads your mail. We have no copy of it, and no tool to see it. See §7.
6. Microsoft and other providers
We handle data from Microsoft accounts and IMAP providers under the same principles as §5: only to provide the features you use, never for ads, never sold, never used to train AI, and never read by people.
Your provider (Google, Microsoft, Apple, Yahoo and so on) remains responsible for the mail it stores under its own privacy policy.
7. Human access
No one at Minimail can read your mail. We don't store it, and we have no admin tool that can fetch it. If you need help, we can look at a problem together only through a screen share you start and control, and we record nothing.
8. Analytics and error reporting (optional)
These run only if the operator has configured them:
- Product analytics (PostHog, EU cloud). Cookieless and in-memory: nothing is stored on your device. We record a small set of events (for example "archived" or "shortcut used") with no mail content, addresses or search terms, and IP addresses are discarded. Session recording and autocapture are off.
- Error reporting (Sentry, EU region). Error reports are scrubbed before they leave your browser or our server: email addresses and token-like strings are removed. Session Replay is off.
9. Service providers (sub-processors)
| Provider | Purpose | Data | Location |
|---|---|---|---|
| [HOSTING PROVIDER] | Hosts the app and runs the server code | Request metadata; for IMAP, mail in memory only (§4.2); sealed sign-ins in memory only | [HOSTING REGION] |
| PostHog (optional) | Cookieless product analytics | Pseudonymous usage events, no mail content | EU |
| Sentry (optional) | Error reporting | Scrubbed error reports, no mail content | EU (Germany) |
| Mozilla Thunderbird autoconfig | Finds IMAP/SMTP settings | Your email domain only | [MOZILLA REGION] |
| Hugging Face / jsDelivr | Download the optional on-device search model | Your IP address and the file requested; no mail data | [CDN REGION] |
Google, Microsoft and your IMAP provider are not our processors: you connect to them directly, under their own terms. We have, or will sign, data processing agreements with each processor. [Lawyer: confirm list and DPAs.]
10. Payments
Minimail is free during the public beta and billing is not switched on. Before we charge anyone, we will update this policy to name our payment provider and explain what it processes.
11. Legal bases (GDPR, Art. 6)
- Contract (Art. 6(1)(b)): connecting to your mailbox and providing the features you use.
- Legitimate interests (Art. 6(1)(f)): security, abuse prevention (including rate limiting by shortened IP address), and error reporting. [Lawyer: confirm the basis for cookieless analytics, or switch it to consent.]
- Legal obligation (Art. 6(1)(c)): responding to lawful requests.
12. Retention
| Data | Retention |
|---|---|
| Your mail and attachments | Never stored on our servers. IMAP content exists in server memory only for the duration of one request. |
| Sealed sign-ins, cache, search index, settings | On your device until you remove the account, sign out of the device or clear site data |
| Hosting request logs | [HOSTING LOG RETENTION, e.g. about 1 day] |
| Error reports (if enabled) | 30 days |
| Analytics events (if enabled) | 12 months |
13. Stopping and revoking access
- Remove an account or Sign out of this device in Minimail at any time.
- Revoke access at your provider: Google at https://myaccount.google.com/permissions, Microsoft at https://account.live.com/consent/Manage (or your organization's admin), or delete the app password you created for Minimail. Minimail then can't connect again, even with a sealed sign-in.
- Removing Minimail never deletes mail in your mailbox.
14. Your rights (GDPR and similar laws)
You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interests. Because we hold almost no data about you, most requests are answered by the controls in §13. For anything else, write to [PRIVACY EMAIL]; we reply within one month. You can also complain to your local data protection authority [or the lead authority: SUPERVISORY AUTHORITY].
15. International transfers
Some providers in §9 may process data outside the EU/EEA. Where they do, we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
16. Security
- All connections use TLS. IMAP and SMTP connections from our server use TLS, and we only connect to public mail servers on standard mail ports.
- Sign-ins are sealed with AES-256-GCM and bound to your device (§4.3). Server keys are kept in our hosting provider's secret store and can be rotated.
- Mail HTML is sanitized and shown in a sandboxed frame where scripts cannot run. Like Gmail, Minimail shows remote images by default, which lets a sender's image server see your IP address and when you opened the message; turn off "Show images" in Settings to block them until you choose to load them.
- A strict Content Security Policy limits which servers the app can talk to.
- If a breach affects personal data, we notify the authority within 72 hours where required, affected users without undue delay, and Google when Google user data is affected.
17. Cookies and local storage
We use only strictly necessary cookies: mm_device (your device secret, HttpOnly, up to 400 days) and short-lived cookies that protect the Google or Microsoft sign-in flow. Browser storage holds the data in §4.4. Analytics and error reporting set no cookies, so there is no cookie banner. [Lawyer: confirm.]
18. Children
Minimail is not directed to children and may not be used by anyone under 16.
19. Changes
If we change how we use Google user data, we will tell you in the app and ask for your consent first. For other material changes, we will give notice in the app or on this page at least [15] days in advance.
20. Contact
[LEGAL ENTITY NAME], [ADDRESS], [COUNTRY] · [PRIVACY EMAIL] · [SUPPORT EMAIL]