postage

Privacy policy

Last updated 14 November 2026

Postage Mail is made by me, Julian De Vita. I publish the iPhone and Mac apps and run the service that delivers new-mail alerts. The server that reads your email is usually yours, not mine, and the app doesn't send me your email, your contacts or anything about how you use it. The app has no ads, analytics or crash reporting built in.

How Postage handles your email

Postage has two parts: the app, and a server that watches your email accounts and sorts them. You run the server yourself, or someone you trust runs it for you. The app talks to that server and to your email provider, and your email doesn't pass through me.

Whoever runs the server can see the email it handles, the same way your email provider can. Only connect to a server run by you or someone you trust.

If you use a server that I run, I'm the person running it. It keeps the things described in the next section, and I use them only to run Postage for you. I don't read your mail, sell it, or share it with anyone, except where the law requires it.

What the server keeps

The server stores the email accounts you add, along with the password or Google sign-in it needs to read them. Those are encrypted.

It keeps a log of everything it does, such as moving a message to Updates, so you can see it in History and undo it. History is kept for a year, and the message subjects in it are removed after 90 days. It also keeps the sorting choices you make, like always putting a certain sender in Primary.

If the person running the server turns it on, the server also keeps a copy of your inbox, anything you've snoozed, and the last 90 days of your other folders, so the app can load quickly.

The person running the server can also turn on a nightly backup, which keeps a full copy of your mail on that server. The server's own logs note who each message was from and which tab it went to.

Your email stays at your email provider too, under their own privacy policy. Postage never permanently deletes it there.

  • Each user's mail store, Memory and assistant data are separate SQLCipher databases under data/users/<id>/, keyed with HKDF from that user's data key. The data key is wrapped by a 32-byte box key kept outside data/ and outside backups. This doesn't protect against root on the running box.
  • IMAP passwords and Google refresh tokens are AES-256-GCM encrypted under the user's data key.
  • The shared postage.sqlite (users, tokens, commands, History) is not encrypted.
  • Default retention: History 365 days, append-only for the first 30. Subjects and model notes are kept 90 days, finished commands 90 days, and rotated audit logs 365 days. store.days defaults to 90 outside Inbox and Later, with attachments up to 25 MB.
  • Backups keep the newest 7 database snapshots, still encrypted and without the box key. The optional nightly mbsync backup writes plain Maildir copies of each account.
  • The server only connects to an allowlist of hosts: your IMAP servers, OAuth token endpoints, the configured model, and the alert relay or APNs.
  • Server logs record the sender address and category of each message sorted, at INFO level.

New-mail alerts

When new mail arrives, your server sends an alert through my alert service, which sits behind Cloudflare, and then through Apple's notification service. The sender, subject and preview are encrypted so that only your phone can read them. My service, Cloudflare and Apple can see that an alert was sent and when, plus the unread count shown on the app icon.

My alert service doesn't store alerts or keep logs of them. You can turn alerts off in the app or in iOS Settings.

  • The server POSTs to /push/<device token> with a per-server bearer token, a 24-hour TTL and a body of at most 1200 bytes.
  • The body is HPKE-sealed (P-256, AES-256-GCM) to a Secure Enclave key on the device and padded to a fixed size. It holds the sender, subject, account, thread and preview.
  • In the clear: the device token, the time, the fixed text "New mail" and the badge count.
  • The relay is a stateless Starlette service with no database. Rate limits are in memory, and the access log is off.
  • Device tokens are stored on your server, in the encrypted mail store.

AI features

Sorting works without AI. The person running your server can connect an AI model for drafting replies and for sorting. If that model runs on their own hardware, your email stays there. If they use an outside AI service, the parts of a message it needs are sent to that service, under that service's terms.

An outside AI service is only used for sorting if the server owner turns that on separately.

  • [llm] takes any OpenAI-compatible endpoint, with an optional API key. With no [llm] section, the AI features are off.
  • Sorting sends the sender, subject, list headers and up to 2,000 characters of plain-text body.
  • Drafting sends the message plus examples of your own sent replies.
  • A model outside your network is used for writing only, unless sort_mail_with_cloud_model = true. Plain HTTP to such a model is refused.

Gmail and Google sign-in

If you add a Gmail account, you sign in with Google. Postage uses that access to read, sort and organise your mail and to send the messages you write, and for nothing else. I don't use your Google data for advertising, don't sell it, and don't read it, except when you ask me to (for example, to help with a problem) or the law requires it. You can remove Postage's access at any time at myaccount.google.com/permissions.

Postage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What's stored on your device

The app keeps the connection to your server, any sending passwords, and the Google sign-in it uses for sending in your device's Keychain. Keychain items don't leave the device. The app also keeps up to 150 MB of recent mail, which is protected while the device is locked, and any mail waiting to be sent. Contacts are looked up on the device and aren't uploaded.

Deleting your data

In the app, go to Settings, then This server, then Leave This Server. That deletes your mailboxes, History and everything else Postage kept for you on the server. It also removes Postage's access to your Google account and clears the app's data from your device. Your email at your provider isn't touched.

  • Google tokens are revoked, and mail-store, Memory and assistant data are purged.
  • The user's key is crypto-shredded and their directory removed, along with their tokens, invites, History and commands.
  • Older encrypted backups stay on disk but can't be opened without the key.
  • One row stays in history_erasures, naming the removed account or user id.
  • A server's only admin can't leave it.

This website

This site doesn't use cookies or analytics, and its fonts are served from here. Cloudflare hosts it and processes visitors' IP addresses to deliver the pages and block abuse. The Technical details checkbox is remembered in your browser and never sent anywhere.

Children

Postage isn't meant for children under 13.

Changes to this policy

If I change this policy, I'll update this page and the date at the top. If the change is significant, I'll also mention it in the app.

Contact

Questions about privacy go to [email protected].