Privacy Policy

What MailPill accesses and why

When you connect Gmail, MailPill accesses the connected account’s email address, messages, sender and recipient information, subjects, dates, message bodies, thread identifiers, labels, read and starred status, and attachments. It uses this information to show and search your inbox, display conversations and attachments, organize mail into visit boxes and groups, and perform the actions you choose.

MailPill requests the Gmail permission gmail.modify. It can read messages, send messages you compose, change read status and stars, archive messages, and move messages to or from trash. It does not request permission to permanently delete messages outside Gmail’s trash. Its classification and grouping run locally; email content is not sent to an AI service.

Google sign-in and permission approval take place in your browser on Google’s pages. MailPill does not receive your Google password. Google may restrict access to managed Workspace accounts according to the organization’s policies.

Where your data is stored

MailPill connects from your Mac to Google’s Gmail API over HTTPS. Another Good Way does not run a MailPill mailbox server and does not receive your email content or Google access and refresh tokens.

Authorization tokens are saved in your own macOS Keychain. Messages, downloaded message content and embedded attachments, local drafts, groups, visit intervals, saved-for-later choices, positions, pending mail changes and preferences are stored on your Mac. The local mail database is not separately encrypted by MailPill; protection of the disk and backups depends on your macOS settings, including FileVault. Files you choose to save outside MailPill remain in the location you selected.

For an account explicitly connected through Apple Mail, MailPill uses macOS automation to read the account and mail from Mail and apply your changes there. “Find in Mail” discovers account addresses and connection metadata; it does not import messages until an account is selected for connection.

Optional iCloud profile and backups

If you choose Connect iCloud in Settings, MailPill stores your profile, connected Google account identities and Google sign-in credentials, supported preferences, and settings-card positions in your private Apple CloudKit storage. This lets MailPill restore connections on your other Macs using the same Apple Account. Message bodies, attachments, drafts, mail-card positions and Apple Mail passwords are not included in this profile. The connection screen explains the upload before you enable it.

Apple provides CloudKit storage and encryption under your iCloud settings. MailPill does not promise end-to-end encryption independent of those settings. Signing out of the MailPill profile pauses its use on this Mac and retains the saved profile; it does not erase the iCloud copy or revoke Google access. Removing a connected account updates the synced profile when synchronization is available.

You can also explicitly save a password-encrypted profile backup to a location you choose. It contains connection credentials and profile settings, so keep the file and password secure. MailPill does not store the backup password. These separately saved backups remain until you delete them.

Optional sender images

New installations do not automatically enable external sender image services. If you enable service logos in Settings, MailPill sends the sender’s service or company domain to Hunter’s logo service. If you enable Gravatar portraits, it sends a hash derived from the sender’s email address to Gravatar. A hash is not a guarantee of anonymity. These providers also receive ordinary network information, including your IP address. Message subjects, bodies, attachments and your Google authorization tokens are not included in these image requests.

Images are cached on your Mac. You can disable either service independently; MailPill then uses initials instead. An image request already in progress may finish. Providers have their own privacy practices: Hunter and Automattic, which operates Gravatar.

HTML mail and links

You can enable original HTML formatting in Settings. External images, styles and fonts are blocked by default; embedded images can be displayed locally. The separate external-resources option allows HTTPS requests to servers referenced by the email. Those servers receive your IP address and the requested resource URL, which can contain a recipient identifier or tracking information. You can turn this option off again.

Scripts, forms, automatic page navigation and embedded frames in email are blocked. Opening a link you select takes you to the destination through your browser or the appropriate application. That destination has its own privacy practices.

Limited use of Google data

MailPill’s handling of information received from Google APIs follows the Google API Services User Data Policy and its Limited Use requirements. Google data and information derived from it are used only for MailPill’s visible email features. Optional third-party image requests occur only when their respective settings are enabled. Sending an email shares the content with the recipients you choose through your email provider.

We do not sell mailbox data, use it for advertising, credit decisions or surveillance, or train generalized AI models with it. We do not provide developers or other people with access to your mailbox. If you voluntarily send specific information to support, we use only what you choose to share to address that request.

Retention, disconnection and deletion

The local mail cache remains while the account is connected. In Settings → Mail accounts, choose the account menu → Disconnect to remove its connected account entry, cached messages and pending mail changes from MailPill and remove its saved Google credentials from Keychain. This does not delete mail on the provider’s server. Separately saved files, local drafts, shared image caches and backups may remain; removing a connected account is not a secure erasure of the disk.

You can revoke MailPill’s Google access at any time in Google Account → Third-party connections. Revocation stops further authorized server access, but does not erase an already downloaded local copy. To remove all local MailPill data, quit the app and remove its application-support data, preferences and image cache; contact support for help locating them. Remove any separately saved files and backups if you also want to delete those copies.

Support and this website

When you email support, we receive your email address and the information you choose to send. We use it to respond, troubleshoot and follow up for as long as needed for the request. Do not send passwords, authorization tokens or a mailbox export. Please redact private message content from screenshots.

These pages are hosted by Vercel, which processes ordinary request information, such as IP addresses and browser details, to deliver and protect the website. The MailPill app and these pages do not include advertising or third-party analytics SDKs. See Vercel’s privacy policy. Website hosting does not receive your Gmail mailbox through MailPill.

Your choices and contact

We process information to provide the functionality and support you request and maintain security. Optional image-service and external-resource requests are controlled by your choices in Settings. You can disconnect accounts, revoke Google access, and request access to, correction or deletion of information you have sent to support. Where applicable, you may also object to processing, request a restriction or complain to your data protection authority.

Contact Yurii Ugarov at ugaroff@gmail.com. We cannot read or delete your private mailbox or files on your Mac on your behalf. Material changes to these practices will be explained here with an updated date; new uses of Google data require a corresponding disclosure and your consent.