Who we are
MailGraph is made by [COMPANY NAME] [LEGAL FORM], [ADDRESS], [COUNTRY], company number [COMPANY NUMBER], VAT number [VAT NUMBER] ("we", "us").
Questions about privacy, and requests about your data: support@mailgraph.app. Anything else: support@mailgraph.app.
[Data protection officer: [NAME AND CONTACT], or: We have not appointed a data protection officer.]
In short
- Your mail is stored on your Mac, not by us. MailGraph on your Mac fetches your mail from your mail provider and keeps it on the Mac. We cannot see it.
- The AI is your choice. Nothing goes to an AI until you connect one. With your own Claude, ChatGPT or OpenRouter account, or a model on your Mac, none of your mail passes through us.
- With MailGraph AI, the text of your mail passes through our server to Anthropic, whose Claude answers. We keep none of it: not the question, not the answer. We keep what your use cost.
- The MailGraph account holds no mail. It holds your email address (encrypted), your devices and what you used of MailGraph AI.
- iPhone sync away from home is sealed with keys only your devices have. We carry it and cannot read it.
- We do not sell data, show no advertising, and run no analytics or tracking in the app, on the account site or on the website.
What this notice covers
- the MailGraph app for the Mac and for the iPhone;
- the MailGraph account, at
account.mailgraph.app; - MailGraph AI, the AI that comes with a MailGraph account;
- the website at mailgraph.app.
It does not cover what other companies do with your data under your own agreement with them: your mail provider (for example Apple, Google, Microsoft or Fastmail), and the AI you connect with your own account (Anthropic for Claude, OpenAI for ChatGPT, OpenRouter and the providers it uses). Their own privacy notices apply.
Using MailGraph without an account
You do not need an account to use MailGraph on your Mac.
What stays on your Mac. Your mail, your projects, everything MailGraph makes of your mail, and the record of every question sent to an AI. Passwords and sign-ins are kept in the Mac's Keychain. We have no copy of any of it.
What the app sends, on your behalf, to others:
- to your mail provider and, if you turn it on, your iCloud calendar: to fetch and send mail and to read and change events;
- to the AI you connect: the text of the questions described under "MailGraph AI" below (the same text, whatever the AI); with a model on your Mac, nothing leaves it;
- to the organisations that write to you: a request for their logo, at their own website, and the pictures in an email when you open it, from the sender's server (as in most mail apps);
- when you press to unsubscribe: the sender's own unsubscribe request.
What reaches us. Two small requests, which carry your Mac's internet address and nothing about you or your mail:
- The update check. A little after the app opens, and every few hours, it asks our update address whether there is a newer version, and downloads it from there.
- Whether MailGraph AI is offered. Only while the first run or Settings → AI is open, where you choose an AI, the app asks our server whether MailGraph AI is offered, at most every five minutes. Our server answers yes or no and writes nothing down.
[CONFIRM: whether Cloudflare keeps request logs for these two addresses with our settings.] We use these requests only to deliver updates and to show the AI choices.
The MailGraph account
You need a MailGraph account for MailGraph AI, and for your iPhone to sync with your Mac away from home.
Signing in. You sign in on account.mailgraph.app, in your browser, with your email address and a six-digit code we email to you. There is no password. The first time you sign in, this makes your account. The page sets no cookie, stores nothing in your browser and loads nothing from other sites.
What we hold, and why:
| What | Why | Legal basis [LAWYER] | How long |
|---|---|---|---|
| Your email address, encrypted, and a keyed hash of it to find your account | to sign you in and to send you the sign-in code and security notices | contract (Art. 6(1)(b)) | until you delete your account |
| Each device you sign in on: its kind (Mac or iPhone), the name it gives (for a Mac its computer name, which may contain your name), its app version, its public key, when it was added and last seen, the country of its last request (two letters, from our provider's lookup; never the internet address itself) | to know which devices may use your account, to show them to you, and to let a Mac approve an iPhone | contract; country: legitimate interest in account security (Art. 6(1)(f)) | until you remove the device, then 30 more days |
| Sign-ins: a hash of each sign-in token | to keep your devices signed in, and to notice when an old token is used again, which can mean it was copied | contract; legitimate interest in security | about 90 days per token |
| Sign-in codes: a hash of the code and of your address, and the tries | to check the code you type | contract | the code works 10 minutes; it is deleted within about a day |
| A security list: account made, sign-ins (how, Mac or iPhone, country), devices added, approved and removed (with their names), an old sign-in used again, signing out, account deleted | so you, and we, can see what happened to your account | legitimate interest in security | 12 months per entry, also after the account is deleted |
| Rate limits: counts keyed by a hash of your internet address that changes every day; for buying, cancelling or keeping a plan, counts keyed by your account | to stop someone flooding an address with codes or guessing codes, and to limit checkouts and changes to a plan | legitimate interest in security | 2 to 3 days |
| MailGraph AI: whether you used the free start, when it ends, how much it is; for a paid plan, what it gives you, its status, when its billing period ends, whether it was cancelled for that day, and Paddle's customer number for you; the money spent each month, or each billing period of a paid plan | to know what you may still use, and to find your plan at Paddle when you cancel or keep it from your Mac | contract | until you delete your account |
What the account never holds: your mail, its subjects, summaries, your projects or contacts, the passwords or addresses of your mail accounts, your internet address in plain form. The only content of yours that passes through it is the sync records described below, sealed so that we cannot read them.
Emails we send you: the sign-in code, and a notice when we signed out one of your devices because an old sign-in of it was used again. We keep no copy of these emails. [CONFIRM what Cloudflare's email sending keeps, for example the recipient and delivery status, and for how long.]
MailGraph AI
What it is. MailGraph AI is for people who do not have a Claude or ChatGPT plan of their own. MailGraph on your Mac sends its questions to our server, and our server asks Anthropic's Claude with our own agreement and key. Your iPhone never asks.
What is sent. Nothing until you connect MailGraph AI. Connecting asks one made-up question (a made-up hotel booking), so you see it work. After that MailGraph reads by itself: the mail already on your Mac, then new mail as it arrives, and the questions you ask yourself. A question can contain:
- the text of your emails, a long one cut to its start and its end;
- who wrote to whom and who was copied (names and email addresses), the day, the subject;
- the names of attached files, and the text of attached PDFs that the AI chose to read (the text is taken out on your Mac; the file itself is never sent), and the text of files on your Mac that you linked to a project;
- what MailGraph knows already: your projects, their summaries and facts, the people in them;
- in a question about a project, your calendar events around it (titles, places, notes and who is invited);
- when you write an email with help: your name, the date, your draft and the conversation it answers;
- of mail filed as advertising, only the sender, the day, the subject and how many emails that sender sent you, to find real mail that was filed there by mistake.
What is never sent: other advertising mail, security codes and junk; mail from or to a sender or domain you excluded from AI; mail in a project you excluded; mail of a mail account for which you turned off "Read mail with AI". The switch is on for each account until you turn it off. Before anything is sent, card numbers, bank account numbers, the part of a link after the page, and long codes are taken out.
What is not taken out. Names, email addresses, phone numbers, street addresses, amounts, dates and whatever your mail says, including about health, beliefs or money. Please think about this before you connect MailGraph AI, and exclude senders, projects or whole accounts you do not want read.
What we keep. Nothing of the question and nothing of the answer: they pass through our server's memory and are not written to any log, database or file. We keep the money each question cost, added up per month (per billing period for a paid plan), and for at most 10 minutes while a question runs, the most it could cost. We do not keep which emails were in a question; the list of every question stays on your Mac, in Settings.
Who receives it. Anthropic, which runs the Claude model that answers. Anthropic receives the question from us, not from you, under our agreement with it. [CONFIRM before launch, from the signed agreement: how long Anthropic keeps questions and answers (the account plan noted 30 days on 17 October; we are asking for zero retention), that it does not use them to train its models, and what it keeps longer when its safety systems flag a question.] Anthropic may answer a question its first model declines with another Claude model.
Where. Our server runs on Cloudflare's network, in the Cloudflare location that receives your request, normally the one nearest you; that can be outside the European Union. What our server stores is kept in the European Union [CONFIRM in the Cloudflare dashboard]. Anthropic processes questions in [CONFIRM: location, by default the United States]. See "Outside the European Union".
Our role. [LAWYER, proposal:] For your account and what you use of MailGraph AI, we decide why and how data is used, so we are the controller. For the text of your mail that MailGraph AI handles to answer your questions, we act on your instructions, as your processor. [Alternative if the lawyer finds that we are the controller of this processing, for example because you use MailGraph for purely personal purposes: state our purpose (answering the questions MailGraph asks about your mail for you) and our legal basis (contract, Art. 6(1)(b); for people other than you who appear in your mail, legitimate interest, Art. 6(1)(f)).]
iPhone sync
At home your iPhone syncs with your Mac over your own network. Nothing reaches us.
Away from home your Mac leaves what changed for your iPhone in your account's mailbox on our server, and your iPhone picks it up there. Each record is sealed on your Mac with a key that only your iPhone can open. We cannot read it. We see which of your devices sent a record to which, when, and how large.
While you add an iPhone, the first messages between it and your Mac are not sealed: they hold the iPhone's name, the Mac's name and an id, their public keys and one-time numbers, so that both screens can show the same six-digit code. Everything after that is sealed.
What is synced is what MailGraph made of your mail (summaries, projects, people, what is coming, tickets, your calendar), never the text of an email: at most the few words a summary quotes from it. Your iPhone fetches your mail itself, from your mail provider. Your mail passwords never pass through us.
How long: until your iPhone has picked a record up, and 7 days at most. Removing an iPhone or signing out deletes what waits for it.
Legal basis [LAWYER]: contract (Art. 6(1)(b)); for the sealed content we act as your processor.
People who write to you, or appear in your mail
Your mail holds data about other people: who writes to you, who is copied, who is named. When you use MailGraph AI, that data passes through our server to Anthropic, as described above, and is not kept by us. We cannot tell these people individually, because we do not see the mail and do not know who they are. If you are one of them, you can contact us at support@mailgraph.app. What happens to the mail itself is decided by the person whose mailbox it is, so you may want to ask them too.
Who receives data
We use these companies to run the account and MailGraph AI. Each processes data only on our instructions. The full list, with what each does and where, is at mailgraph.app/sub-processors.
- Cloudflare runs our server, stores the account and the sync mailboxes (in the European Union) and sends our sign-in emails. It also hosts our update files [and the website].
- Anthropic answers MailGraph AI's questions.
- Paddle sells the paid plans of MailGraph AI, as our reseller. With each checkout we give it your account's internal number, so that the plan reaches your account; it tells us your plan's status and dates, refunds and chargebacks, and its customer number for you. Paddle holds your card and billing details; we keep none of them. [Paddle is a merchant of record: it sells to you in its own name and is responsible for your payment data. LAWYER: confirm the wording, and that "on our instructions" above does not apply to Paddle.]
Our professional advisers, such as our lawyer and our accountant, may see data when they need it to advise us, bound to keep it confidential. [LAWYER: Paddle's checklist asks the notice to name them.] We give data to authorities only when the law requires it. [LAWYER: wording.]
Outside the European Union
- Anthropic is based in the United States. MailGraph AI's questions go to it. [CONFIRM the safeguard: the EU-U.S. Data Privacy Framework, if Anthropic is certified, and/or the European Commission's standard contractual clauses in Anthropic's data processing terms.]
- Cloudflare is based in the United States. What we store with it is kept in the European Union, but a request is handled in the Cloudflare location that receives it, which can be outside the EU, and Cloudflare's email sending [CONFIRM where it processes]. [CONFIRM the safeguard in Cloudflare's data processing addendum.]
- Paddle is based in the United Kingdom. [CONFIRM when engaged: the UK adequacy decision.]
You can ask us for a copy of these safeguards at support@mailgraph.app.
How long we keep data
- Until you delete your account: your encrypted email address, your account, what you may use of MailGraph AI and what you spent each month or billing period.
- Devices: until you remove one, and 30 days after that.
- Sign-in tokens: about 90 days each. Sign-in codes: they work 10 minutes and are deleted within about a day.
- Security list: 12 months per entry.
- Sync records: until your iPhone picks them up, 7 days at most.
- MailGraph AI questions and answers: not kept by us. [Anthropic: CONFIRM.]
When you delete your account we delete at once your address, your account, your devices, your sign-ins, your sync mailbox and your MailGraph AI figures. Three things stay:
- the security list, until each entry is 12 months old, so a misuse of the account can still be looked into;
- a one-way hash of your account's internal number, with no end, so that restoring a backup can never bring your account back (it cannot be turned back into your address or anything else);
- what you spent, added into totals per month that name no account.
[CONFIRM: our provider keeps restore points of our databases for [30] days, so deleted data can exist in them for up to [30] days after deletion.]
Your rights
You have the right to:
- see the data we hold about you, and get a copy (access);
- have it corrected if it is wrong;
- have it deleted (erasure), which for you means deleting your account;
- limit what we do with it while a question about it is being settled (restriction);
- take it with you in a machine-readable form (portability);
- object to what we do on the basis of legitimate interest;
- complain to a data protection authority: in the EU country where you live, where you work, or where you think the rules were broken. [If the company is in Belgium, ours is the Belgian Data Protection Authority, Gegevensbeschermingsautoriteit / Autorité de protection des données, [CONFIRM address and website].]
How. Email support@mailgraph.app from the address of your account. We answer within one month. You can also, at any time:
- delete your account yourself, on its own page (account.mailgraph.app/delete, which Settings in MailGraph opens on the Mac and on the iPhone): we email you a code for deleting, and with it the account goes at once;
- remove an iPhone from your account ("Stop syncing"), or sign out on your Mac (both in Settings → MailGraph account, on the Mac);
- stop using MailGraph AI: disconnect it in Settings → AI. This stops all questions to it at once. It leaves you signed in, because your iPhone may sync through the account.
Security
- Our server runs no request logging: no question, answer, address or token is written to a log.
- Your email address is encrypted in our database; sign-in tokens and codes are stored only as hashes.
- Each device signs every request with its own key, kept in its Keychain, so a token copied off a device is of no use elsewhere. An old sign-in used again signs that device out and tells you.
- Sync records are sealed end to end; we hold no key to them.
- MailGraph AI questions travel encrypted (HTTPS) to our server and from it to Anthropic. They are not end-to-end encrypted: our server must read a question to pass it on. It keeps none.
If a breach puts your data at risk, we tell the data protection authority within 72 hours where the law requires it, and you without delay when the risk to you is high.
AI and automated decisions
MailGraph uses AI to sort your mail into projects, write summaries, find dates and tasks, answer your questions and help you write. The AI can be wrong: check what matters before you rely on it. MailGraph does not use AI to make decisions about you that have legal or similarly significant effects.
Children
MailGraph and the MailGraph account are not meant for anyone under [16]. [LAWYER: age.]
Cookies
The account site and the website set no cookies, store nothing in your browser and run no analytics.
Changes to this notice
When we change this notice, we put the new version here with its date, and tell you in the app before a change that matters takes effect.
Contact
[COMPANY NAME], [ADDRESS], [COUNTRY]. Privacy: support@mailgraph.app.