Security

Nowhere on our side for your mail to be.

Minimail has no database. Here's exactly where your mail and your sign-in live, in plain language.

Your provider

Gmail, Outlook, iCloud or your IMAP server. Your mail stays there.

Your browser

Mail loads straight into the page. The search index is built here, encrypted.

Sealed key

Your sign-in is encrypted with our server key and kept only on this device. Copied anywhere else, it's useless.

Our server: no database. IMAP mail passes through its memory only, because browsers can't open IMAP connections. It's never written down.

How each kind of account connects

Gmail and Google Workspace: Your browser talks to Gmail's API directly. Our server only swaps your sealed sign-in for a short-lived access token, which lives in the page's memory.
Outlook.com and Microsoft 365: Your browser talks to Microsoft Graph directly, the same way. When Microsoft rotates your sign-in, the new one is sealed and stored back on your device.
iCloud, Yahoo, Fastmail and any IMAP server: Browsers can't open IMAP or SMTP connections, so our server does it for each request: it connects, does one thing, returns the result and disconnects. Mail passes through memory only and is never written down.

Sealed sign-ins

When you connect an account, our server encrypts your sign-in (a Google or Microsoft refresh token, or your IMAP app password) with AES-256-GCM. The key is derived from a server secret and a random secret tied to your device. The sealed result is stored on your device, and we keep no copy.

To use it, your device sends it back with each request. Our server opens it in memory, does the job and forgets it. Copied to another device, the sealed sign-in can't be opened.

Where things live

Where your data is kept
What	Where
Your mail	At your provider. Loaded into your browser when you read it.
Your sign-in (OAuth token or app password)	On your device, sealed with our server key. Useless anywhere else.
Search index	On your device, encrypted.
Snoozes, settings and accounts list	On your device.
On our server	Nothing about you. No database.

Search stays on your device

The search index, including text from PDFs and Office files and, if you turn it on, what the optional on-device AI model sees in your photos, is built in your browser and stored there, encrypted. Model files are downloaded once from a public model host; your mail is never uploaded to search it.

In the browser

Mail HTML is sanitized and shown in a sandboxed frame. Remote images stay blocked until you allow them.
A strict Content Security Policy limits which servers the page can talk to: your mail provider, and little else.
No ads and no tracking cookies. Analytics, when enabled, is cookieless and never includes mail content.

Leaving is one click

Remove an account, or choose “Sign out of this device”, and its sealed sign-in is deleted from that device.
Revoke access any time at Google or Microsoft, or delete the app password at your provider.
Your mail stays where it always was, with your provider.

Report a vulnerability

Contact details for security reports will be listed here shortly. Details are in our privacy policy.