Privacy Policy

Last updated: September 29, 2026

Otter Mail is an email app for macOS and the web, made by Christophe Kafrouni under the Otterware name. This policy explains what data Otter Mail accesses, where it goes, and what control you have. In short: Otter Mail runs on your device (your Mac, or your browser) and fetches your mail from Google directly; your mail never passes through our server. If you sign in to an Otter account, our server learns which Gmail addresses you use and when they change. In the web app, it also handles your Gmail sign-in (see below).

Data Otter Mail accesses from your Google Account

When you sign in with Google, you choose to give Otter Mail access to:

• Gmail (https://mail.google.com/): to read, search, send, label, archive and delete your mail, and to manage drafts and labels, as you do in the app.
• Gmail settings (gmail.settings.basic): to save the signature you edit in Otter Mail to your Gmail account, so it's the same in Gmail. Otter Mail changes no other Gmail setting.
• Contacts (contacts.readonly, contacts.other.readonly): to show the photos and names of people you correspond with, and to suggest recipients as you type.
• Calendar events (calendar.events.owned): to show calendar invitations you receive by email and to record your reply on your own calendar when you accept or decline. Otter Mail touches only the events you answer.
• Basic profile (openid, email, profile): to know which account you added and to show its name and picture.

Otter Mail for iOS asks only for Gmail, Gmail settings and your basic profile: it has no calendar or contacts features.

How the data is used and stored

• Data from Google is used only to provide Otter Mail's features to you, in the app on your device. It is never sold, never used for advertising, and never used to train artificial intelligence models.
• Your mail, labels and contact details are stored in a local database on your device, so the app is fast. On a Mac it stays in the Otter Mail folder in your home directory (~/.otter-mail); in the web app, in your browser's storage for this site. It stays until you remove the account or delete the app's data.
• In the Mac app, Google sign-in tokens are stored on your Mac, encrypted with a key kept in your macOS Keychain. In the web app, see "The web app" above.
• Translation of foreign-language mail (Mac app) uses Apple's on-device translator. The text does not leave your Mac.
• No analytics, tracking or crash reports are collected.

The Otter account (optional)

An Otter account (optional in the Mac app, required for the web app) brings your mailboxes and preferences to every device you use and delivers new mail the moment it arrives. For this, Otter Mail's server at relay.mail.otterware.app (run on Cloudflare) stores:

• your Google account's ID, address, name and picture, to know who is signed in;
• the address, name and picture of each Gmail account you use in Otter Mail, and the display name and color you gave it;
• for each signed-in device, its session (a random sign-in token), when it was last used, its browser or Mac name and its IP address, so you can see and sign out your devices;
• your preferences: app settings, saved views, keyboard shortcuts, the theme and the agent's settings, and, if you connect the Hermes agent, its address and API key, which is stored encrypted.

To deliver new mail instantly, Gmail sends a notification through Google Cloud Pub/Sub to this server whenever one of your mailboxes changes. The notification contains only the address and a change number, never the content of your mail; the server passes it on to your devices, which then fetch the change from Gmail themselves. Notifications are not stored. Your mail and contacts never reach our server.

The web app

In a browser, your mail is fetched from Gmail by your browser and cached in the browser's own storage for this site, which you can clear at any time (it is also removed when you delete your browsing data). A browser can't keep a lasting Google sign-in on its own, so when you add a Gmail account in the web app, our server completes Google's sign-in and refreshes it when needed: your Google tokens pass through our server, but it does not store them. The long-lived token is encrypted by our server and kept only in your browser. In the Mac app, Google tokens never reach our server.

When data leaves your device

Otter Mail connects directly from your device to:

• Google (Gmail, People, Calendar and sign-in services), to do what you ask in the app.
• Image and icon services, to show sender pictures: Gravatar receives a one-way hash of a sender's email address, and Google's and DuckDuckGo's favicon services receive the domain of a sender's email address (never for personal addresses such as gmail.com). Images inside emails are downloaded from the servers the sender chose, as in any mail app.
• Links you choose to open, such as unsubscribe links, which are sent to the sender's own servers.
• Your agent, only if you set one up. The optional agent runs through a provider you install and sign in to yourself (Claude Code, Codex or Hermes). When you ask it something, the messages and mail content it needs are sent to that provider under your own account with them, and are subject to that provider's privacy policy. Nothing is sent to an agent unless you use it.
• Otter Mail's server, only if you sign in to an Otter account (see above).
• GitHub, to check for app updates. This shares only your IP address and the app version, as any download does.

Otter Mail does not share your Google data with anyone else.

Google API Services User Data Policy

Otter Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

• Removing a mailbox in Otter Mail (Settings → Mailboxes) deletes its local copy of your mail and its sign-in from your device. Nothing is deleted from Gmail.
• You can revoke Otter Mail's access at any time at myaccount.google.com/permissions.
• Deleting the ~/.otter-mail folder (Mac), or this site's data in your browser (web), removes all of the app's data on that device.
• Signing out of your Otter account ends that device's session. To delete your Otter account and everything our server stores about it, email us at the address below.

Children

Otter Mail is not directed at children under 13.

Changes

If this policy changes, the new version will be published on this page with a new date.

Contact

Questions about privacy: chris.kafrouni@gmail.com.