Your mail stays on your computer. Here is exactly what that means.

1. Who we are and what this covers

Flux Mail is a desktop email, calendar, and contacts application for Windows, Linux, and macOS, made by Eerie Labs LLC, a Florida limited liability company ("we", "us"). This policy covers the Flux Mail application and this website, getfluxmail.com. It describes what data the app handles, where that data goes, and what little we collect ourselves.

Flux Mail is a client. It connects to accounts you already have with other providers, such as Google, Microsoft, or any IMAP mail service, on your behalf. Those providers have their own privacy policies that govern your account with them.

2. What the app stores on your computer

To show you your mail without a network round trip for every click, Flux Mail keeps a local copy of your data. All of it is stored in your own user profile on the computer where you installed the app, and none of it is sent to us.

• Mail. Message headers, bodies, and attachments for each account, going back as far as the account's "Mail to keep offline" setting allows. Drafts you write in the app, and a full-text search index built from your messages.
• Calendar and contacts. Events, invitations, and RSVPs from the calendars you sync, and the contacts from the address books you sync.
• Account settings. Each account's address, display name, color, signature, what it syncs, how notifications and the reply button behave, and your rules, snoozes, pins, and folder choices.
• Sender decisions. Which senders you have approved, blocked, or filed as Newsletters or Notifications, so the app can apply the same decision to their future mail.
• Credentials. IMAP passwords and the OAuth tokens Google and Microsoft issue when you sign in. These are not kept in the database or in any file we manage. They are stored by your operating system: Windows Credential Manager, the macOS Keychain, or your Linux desktop's Secret Service.
• Sender logos. A small cache of company logos looked up for senders, kept for up to 30 days per domain.
• A diagnostics log. The app writes a capped, local sync log that helps diagnose sync problems. It stays on your computer. We never receive it unless you choose to send it to us when asking for help.

The app's data folder is %APPDATA%\com.getfluxmail.app on Windows, ~/.local/share/com.getfluxmail.app on Linux, and ~/Library/Application Support/com.getfluxmail.app on macOS.

3. Who the app talks to over the network

Flux Mail makes network connections only for the following purposes. There are no others.

• Your mail, calendar, and contact providers. Google, Microsoft, and the IMAP, SMTP, and CalDAV servers you configure. This is the app doing its job: fetching and sending mail, syncing calendars and contacts, and applying the changes you make. Connections use TLS.
• Update checks. The app checks for a new version shortly after launch and every six hours by fetching a small release manifest from GitHub, where our releases are published. GitHub sees your IP address, as any web server does. The check sends nothing about you or your accounts. You can turn automatic checks off in Settings → About. Updates are installed only when you choose to, and only if they are signed with our key.
• Sender logos. To show a company's logo next to its mail, the app looks up the sender's domain. It queries Google Public DNS over HTTPS for the domain's BIMI record, fetches the logo from the address that record names, and otherwise asks Google's favicon service for the domain's icon. Only the domain name is sent, never the message or your address. A lookup happens at most once a month per domain and the result is cached locally. Because the request is the same for every recipient, it cannot reveal which message you opened or when.
• Setting up an IMAP account. When you add an account by address, the app looks up your mail domain's MX records through Google Public DNS over HTTPS and consults Thunderbird's public autoconfiguration database so it can fill in server settings for you. Only the domain name is sent.
• Remote images in messages. Images hosted on a sender's server are blocked by default, because loading one tells the sender you opened the message. The app fetches them only when you click "Show images" for a message or for a sender you choose to trust.
• Links you click. A link in a message opens in your web browser. From then on, the site you opened is in charge.

The app includes no analytics, usage tracking, crash reporting, or advertising, and it never contacts a server we operate.

4. Google user data

When you add a Google account, Flux Mail asks Google for permission to access it on your behalf. You sign in with Google in your own browser; the app never sees your Google password. Google then issues the app a token, which the app stores in your operating system's keychain and uses only from your computer.

The app requests these permissions, and uses each one only for the purpose given:

• Read, compose, send, and permanently delete all your email from Gmail (https://mail.google.com/). Showing your inbox and folders, searching, sending and replying, moving and labeling messages, blocking senders on the server, and emptying Trash and Spam. The permanent-delete part of this permission exists only so that Empty Trash and Empty Spam can do what they say.
• See, edit, create, or change your email settings and filters in Gmail (gmail.settings.basic). Reading and setting your vacation auto-reply. The app does not change any other Gmail setting.
• See, edit, share, and permanently delete all the calendars you can access using Google Calendar (calendar). Showing your events, creating and editing them, and sending and answering invitations. The app does not share calendars with anyone.
• See, edit, download, and permanently delete your contacts (contacts). Showing your address book, editing contacts, and suggesting addresses as you type. The app does not delete contacts.

Limited Use disclosure. Flux Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the mail, calendar, and contacts features you see in the app.
• It is stored only on your computer. It is never transferred to us or to any third party. There is no exception for the usual carve-outs, because there is no server to transfer it to.
• It is never used for advertising, never sold, and never used to build profiles or train models.
• No person at Eerie Labs LLC can read it. It is not available to us.

5. Microsoft account data

Adding an Outlook.com or Microsoft 365 account works the same way: you sign in with Microsoft in your browser, and the app receives a token that stays in your keychain. The app asks for permission to read and write your mail, send mail, read and write your mailbox settings (for the automatic-reply feature), read and write your calendars and contacts, read your basic profile (to learn the account's address), and keep access between sessions. Everything in sections 2 and 3 applies to Microsoft data exactly as it does to Google data.

6. Keeping, removing, and revoking

• How long data is kept. Local data for an account stays on your computer for as long as the account is in the app, within the limit set by its "Mail to keep offline" setting. Lowering that limit removes the older local copies. The copy on your provider's server is not affected.
• Removing an account. Settings → Accounts → Remove deletes that account's mail, calendar, contacts, and settings from the local database and deletes its password or tokens from your keychain. Your account with the provider is untouched.
• Uninstalling. Uninstalling the app removes the program. Delete the data folder named in section 2 to remove all local data, and remove the Flux Mail entries from your keychain if your uninstaller leaves them.
• Revoking access. You can revoke the app's access at any time, without the app, from your Google account's third-party access page or your Microsoft account's app access page. The app's token stops working immediately.
• Data we hold. We hold no data from the app, so there is nothing for us to delete on request. For the alpha sign-up list, see section 7.

7. The website and the alpha sign-up

This website is static pages. It sets no cookies, runs no analytics, and loads nothing from third-party servers; its typeface is served with the site. Like any website, the service that hosts it may keep standard server logs, including the IP address of each request.

If you request an alpha invite, we receive what you put in the form: your email address, optionally your name, which platforms and mail providers you use, and any notes you add. We use this only to run the alpha: to send you builds, to ask what you think, and to tell you about Flux Mail releases. We do not add you to a marketing list and we do not share the list with anyone else. Sign-ups are delivered to us, and our replies to you are sent, through Resend, an email delivery service that processes your address on our behalf and keeps a copy of our alpha list for us. Email support@getfluxmail.com and we will remove you from the list, including from Resend.

8. Sharing and selling

We do not sell personal data and we do not share it with third parties for their own purposes. The only parties that see any of your data are the providers you connect to the app, the services named in section 3, for the narrow purposes given there, and, for the alpha list, Resend, which delivers sign-ups and our email to you. We would disclose data only if required by law, and since we hold none from the app, that could only ever reach the alpha sign-up list.

9. Security

• Sign-in to Google and Microsoft uses OAuth 2.0 with PKCE in your own browser. The app never handles your password for those accounts.
• Passwords and tokens are stored by your operating system's credential store, not in files the app manages.
• All connections to providers use TLS.
• HTML in messages is sanitized before it is displayed, scripts are never run, and remote content is blocked until you ask for it.
• Updates are installed only when signed with our release key; a tampered or downgraded update is refused.
• Your local database is as secure as your user account on the computer. Use the disk encryption your operating system offers if others can access the machine.

10. Children

Flux Mail is not directed to children under 13, and we do not knowingly collect information from them.

11. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change means the app would start sending data somewhere it did not before, we will say so in the release notes of the version that introduces it, and in the app, before it takes effect.

12. Contact

Questions about this policy or about your data: support@getfluxmail.com.

Eerie Labs LLC, a Florida limited liability company, United States.