Privacy Policy

Who We Are

MailVault is operated by MB Modernios Aplikacijos, a company registered in Lithuania. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and Lithuanian data protection laws.

The MailVault Desktop Application

MailVault is a privacy-first desktop email client. The application:

• Stores your mail locally on your computer: messages, attachments, folders, and account settings live in a folder on your own disk.
• Does not send your mail to our servers. The app connects directly to your email provider (over IMAP and SMTP, or Microsoft Graph for Outlook.com). We have no access to your emails.
• Stores credentials in your operating system's secure credential store (macOS Keychain, Windows Credential Manager, or the Linux Secret Service). We never see or store your passwords or sign-in tokens.
• Does not include analytics, tracking, or telemetry about how you use the app or about your mail.
• Has its source live on GitHub. You can verify all of the above by reading the source code.

The app only connects to anything other than your email provider in these cases:

• Updates. The app checks GitHub for new versions and release notes. These requests carry no personal data.
• Premium. If you subscribe to Premium, the email address you choose for the subscription, a random identifier for this device, its name, platform, operating system version, and app version are sent to our billing server to manage your subscription and devices. Payments are processed by Stripe. Billing never uses or receives Google user data or any email content.
• AI features you turn on. AI features run on your computer by default, using your operating system's on-device model or an open-weight model you download once from Hugging Face and then run offline. If you connect your own AI provider instead, the text you ask it to work on is sent to that provider under your own account and its terms. Mail from Gmail and Google Workspace accounts is never sent to a connected AI provider; it is only processed on your computer (see Google User Data below).
• Images in messages. Showing images hosted elsewhere contacts the server that hosts them, as in any email client.

Google User Data

This section explains how MailVault handles data from your Google account when you add a Gmail or Google Workspace account with "Sign in with Google".

Data We Access

With your permission, MailVault requests these Google OAuth scopes:

• https://mail.google.com/: access to your Gmail mailbox over IMAP and SMTP, including your messages, attachments, labels and folders, and message flags, and the ability to send mail as you. Gmail's IMAP and SMTP servers accept only this scope.
• openid and email: your Google account's email address, used once at sign-in to confirm it matches the address you entered.

How We Use It

Google user data is used only to provide the email client and backup features you see and control in the app, and all of this happens on your computer:

• downloading your messages and attachments so you can read and search them, including offline;
• keeping a local copy of each message as a standard .eml file, and backing up or exporting it to a location you choose;
• sending mail and replies, including messages you schedule to send later;
• organizing mail: marking messages read or unread, flagging, moving, snoozing, and sorting them with rules you set;
• deleting messages, and removing messages from the server when you choose to keep only their verified local copy.

Sharing and Transfer

MB Modernios Aplikacijos does not receive, store, or have access to your Google user data. It never reaches our servers, and we do not sell, share, or transfer it to anyone. Google user data leaves your computer only when you take one of these actions yourself:

• sending an email, which Gmail delivers to the recipients you choose;
• backing up or exporting mail to a folder or drive you choose.

Google user data is used only to provide the app features listed above. It is not used for billing, our newsletter, website analytics, marketing, or any other purpose. It is never used for advertising of any kind, never sold to data brokers or anyone else, never used to determine creditworthiness or for lending, and never used to develop, improve, or train artificial intelligence or machine learning models, whether ours or anyone else's.

AI Features and Google User Data

MailVault's AI features (summaries, writing help, quick replies, and automatic tags) process Gmail messages only with models that run entirely on your computer:

• Apple's on-device foundation model, built into macOS;
• an open-weight model such as Llama, downloaded once from Hugging Face and then run offline in MailVault. Hugging Face only hosts the model file; nothing is sent back to it;
• an Ollama server running on your own computer.

Mail from a Google account is never sent to a cloud AI provider, even if you connect one for your other accounts. MailVault integrates no third-party AI service that receives Google user data. Google user data, raw or derived, is processed locally and is never shared with any model provider, and it is never used to create, train, or improve any AI or machine learning model, including foundational or generalized models.

How We Protect It

• All connections to Google use encrypted TLS connections.
• Sign-in uses OAuth 2.0 with PKCE. MailVault never sees your Google password.
• Your OAuth tokens are stored in your operating system's secure credential store, not in plain files.
• Your mail is stored in your user account's data folder, protected by your operating system's file permissions. We recommend turning on full-disk encryption (FileVault on macOS, BitLocker on Windows).

Retention and Deletion

Your Google user data stays on your computer for as long as you keep it there. Removing the account in MailVault's Settings deletes its stored tokens and its mail from MailVault's data folder. Copies you backed up or exported to other locations stay until you delete them. You can revoke MailVault's access at any time at myaccount.google.com/permissions. Because we never receive Google user data, there is none on our servers to delete.

Limited Use

MailVault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

The MailVault Website

When you visit mailvaultapp.com or interact with our website, we may collect the following. None of it comes from the app or involves Google user data.

Newsletter Subscription

If you subscribe to our newsletter, we collect your email address. We use this solely to send you updates about MailVault (new releases, features, tips). You can unsubscribe at any time by contacting us. Legal basis: your consent (GDPR Art. 6(1)(a)).

Contact Form

If you contact us through the website form, we collect your name, email address, and message. We use this to respond to your inquiry. Legal basis: your consent and our legitimate interest in communicating with users (GDPR Art. 6(1)(a) and (f)).

"I Want This" Votes

If you click the voting button, we store a hashed (anonymized) version of your IP address to prevent duplicate votes. We do not store your actual IP address. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

Analytics

This site uses self-hosted, first-party analytics. All analytics data is processed and stored on our own server and is never shared with, or sent to, any third party. We do not use analytics cookies and we do not store personal information. Visits are counted using an anonymous identifier derived from your IP address and browser signature, hashed with a secret key that is automatically deleted every 24 hours — after that, re-identifying any visitor is impossible, even for us. Raw IP addresses and browser signatures are never written to disk. What we record: pages viewed, referring site, clicks, scrolling, and approximate time on page — in aggregate, to understand which content works and to improve the site.

What We Do NOT Collect

• We do not use cookies for tracking or advertising.
• We do not use third-party analytics (no Google Analytics, no tracking pixels).
• We do not sell, rent, or share your personal data with third parties.

Data Storage and Security

Website data (newsletter subscriptions, contact messages, votes) is stored on our web server. IP addresses are hashed using SHA-256 before storage for privacy. We take reasonable measures to protect your data, but no system is 100% secure.

Your Rights (GDPR)

As an EU/EEA resident, you have the right to:

• Access your personal data we hold.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data.
• Data portability — receive your data in a structured format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time.

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

Data Retention

Newsletter subscriptions are retained until you unsubscribe. Contact form messages are retained for up to 12 months. Vote data is anonymized and retained indefinitely.

Third-Party Services

Our website loads resources from:

• Google Fonts — to serve the Inter typeface. Google may collect your IP address. See Google's Privacy Policy.
• Tailwind CSS CDN — to serve stylesheets. No personal data is collected.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Contact

MB Modernios Aplikacijos
Lithuania
Website: mailvaultapp.com/#contact