Privacy Policy

Last updated: November 8, 2026

SuperMail is a mail client that runs on your Mac. This policy explains what data it handles and where that data goes.

The short version

• Your mail is downloaded from your mail provider directly to your Mac and stored there.
• There is no SuperMail server. We do not receive, store or see your mail, contacts or account data.
• We do not sell your data, show ads or use your data to train AI models.

Data stored on your Mac

SuperMail keeps a local copy of your messages, folders and settings in its data folder on your Mac so it can show your mail quickly and offline. Passwords and sign-in tokens are stored in the macOS Keychain. Removing an account or deleting the app removes this data.

Signing in with Google or Microsoft

When you choose "Sign in with Google" or "Sign in with Microsoft", the provider's own sign-in page opens in your browser. SuperMail receives a token that lets it access your mailbox over IMAP and send mail over SMTP. The token is stored in your Keychain and only sent to Google or Microsoft.

For Gmail, SuperMail requests the scope https://mail.google.com/ to read, organize, send and delete your mail on your behalf, plus your name and email address to label the account. You can revoke access at any time in your Google account settings or your Microsoft account settings.

Google API Services User Data Policy

SuperMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the mail features you see in the app. It is not transferred to anyone except as described in this policy, is not used for advertising, and is not read by humans.

Other connections the app makes

• Account setup: to find the right server settings for an address, SuperMail may look up the mail domain via public DNS (including DNS over HTTPS) and the public Thunderbird configuration database.
• Sender pictures: SuperMail may load sender pictures from Gravatar and website icons from the sender's domain. These requests reveal the sender's address hash or domain, not your mail.
• Optional AI features: if you add your own Anthropic API key, the messages you ask the AI to work with are sent to Anthropic under your key and Anthropic's terms. Nothing is sent unless you set this up.
• Local assistant access (MCP): if you connect an assistant such as Claude to SuperMail's local MCP server, that assistant can read and organize your mail as you ask it to. This runs only when you set it up.

Children

SuperMail is not directed at children under 16.

Changes

If this policy changes, the new version will be posted on this page with a new date.

Contact

Questions about privacy: max.giess@googlemail.com