Privacy policy
The short version
imaily runs on your computer. Your email is read by the application on your Mac directly from your email provider, and everything imaily stores is stored on your Mac. We do not operate a server that receives, stores or processes your email. We do not sell, rent or share your data with anyone.
Who we are
imaily is made by Sociably Media (Yorgos Kastritseas), Athens, Greece. Contact: [email protected].
What the application accesses
- Your mailboxes. imaily connects to the mail accounts you add, using IMAP to read and SMTP to send, with the credentials or sign-in you provide. It reads message headers, and message bodies for messages you open or that it needs to classify (for example receipts). It can move messages to your provider's Bin folder and mark them read when you ask it to. It never permanently deletes mail.
- Credentials. App-specific passwords and Google sign-in (refresh) tokens are stored in the macOS Keychain on your Mac. Short-lived Google access tokens are held in memory only. Credentials are sent only to your own mail provider (for Google accounts, to Google). If the Keychain cannot be used on your Mac, passwords fall back to your user configuration folder with owner-only permissions; Google sign-in is then unavailable rather than stored there.
- Local database. Standing rules, reminders, reply watches, a cache of recent briefings and receipts, and the things you ask imaily to remember are kept in a local SQLite file on your Mac. Delete the file and it is gone.
What leaves your computer
- Your mail provider. IMAP and SMTP traffic between your Mac and your provider, encrypted in transit (TLS).
- The AI provider. To write the briefing and understand your requests, imaily sends message subjects, sender names and addresses, short text snippets, and your typed requests to the AI provider you configure (by default Anthropic), using your own API key. That provider's terms govern that data; under Anthropic's API terms, data sent through the API is not used to train models. You can disable AI entirely; imaily then classifies mail with local rules only.
- Unsubscribe requests. When you click Unsubscribe, imaily sends the sender's own one-click unsubscribe request (RFC 8058) or opens their unsubscribe page in your browser.
- Remote images. With "Load images" on, images inside a mail are fetched from the sender's server when you open it, which lets senders know it was opened. You can turn this off in Settings.
- Update check. Once a day (you can switch it off in Settings → About) imaily asks
dl.imaily.app, served by Cloudflare, whether a newer version exists. The request identifies the app and its version (for example "imaily/0.6.0 Sparkle/2.10.0") and carries nothing about you or your mail; like any web request, Cloudflare may process your IP address to deliver it. Updates are signed by us and notarized by Apple.
Nothing else leaves your computer. imaily has no analytics, no telemetry, no crash reporting and no account system.
Google user data
When Sign in with Google is available, imaily will request the https://mail.google.com/ scope, which is required to read and send mail over IMAP and SMTP. imaily also requests your email address (openid, email) so you do not have to type it. That access is used only to show you your own mail inside imaily, to produce your briefing, to move or mark messages you ask it to, and to send mail you write. Google user data is processed on your Mac and is not transferred to any imaily server, because none exists; it does not pass through any imaily relay or hosted service. It is shared with third parties only as described above (your configured AI provider, with your own key, to produce the briefing you asked for) and is never used for advertising, sold, or used to build profiles. No person at Sociably Media reads it. It is not used to create, train or improve any machine-learning or artificial-intelligence model.
imaily's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke imaily's access at any time at myaccount.google.com/permissions; removing the account inside imaily revokes the token at Google and deletes it from your Mac's Keychain.
Early access and licences
These are the only places where we hold anything about you, and none of them involves your mail.
- Early access. If you leave your email address on imaily.app, we keep that address and the date you left it, and nothing else. We use it only to write to you when there is something to try. It is not a newsletter, we do not track whether you open what we send, and it is never shared. Ask and we delete it.
- Buying a licence. Stripe, through Link, is the seller: it takes the payment, handles VAT and sends your receipt, under its own privacy policy. Our licence service receives from Stripe your email address, what you bought and whether it is still active, and emails your key from [email protected] through our email provider, Maileroo. We keep that record so we can resend your key and extend it when you renew.
- Where it lives. The early-access list and the licence records are kept by Sociably Media on our own server at api.imaily.app, hosted by Netcup in Germany. To stop abuse of the forms, that server keeps a one-way hash of your IP address for at most 24 hours; the address itself is not stored.
- The licence check. The app checks your key on your Mac. It does not send the key, your email address or anything else to us to do so.
Your rights (GDPR)
Because your data stays on your computer, you exercise most rights yourself: remove an account in Settings to delete its credentials, delete the local database to erase everything imaily learned. If you emailed us, you can ask us to delete that correspondence at any time. If you asked for early access or bought a licence, email us for a copy of what we hold or to have it deleted; for a licence we keep only what tax law requires, and your key keeps working. Supervisory authority for Greece: the Hellenic Data Protection Authority (dpa.gr).
This website
imaily.app is a static site served through Cloudflare. It sets no cookies and loads nothing from third parties — fonts are served from this site. The early-access and "send my key again" forms post to our own licence service at api.imaily.app, described above. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint or track you across sites; it tells us page views and referrers, nothing about you. Cloudflare may process connection data (such as your IP address) to serve and protect the site, under its own privacy policy. There is no Google Analytics or other third-party tracking.
Changes
If this policy changes, the date at the top changes and the application's What's new log will say so.