Cookies & Local Storage

Public pages

Public policy pages do not set analytics or advertising cookies or run tracking scripts. Fonts are bundled. Hosting requests expose normal network metadata; the deployed Caddy proxy does not enable access logs. Externally hosted media, when configured, sends requests to its host.

Account cookies

Account session cookies are normally valid for up to 30 days with renewal during use. OAuth uses temporary state. Invitation cookies are capped at seven days and terms-confirmation cookies at 30 minutes. These support authentication, access and your explicit signup choice. Clearing them may sign you out or interrupt registration; it does not delete your server account.

App and offline storage

The desktop app uses local databases and OS credential storage. The browser app uses browser storage for preferences, authorization, cached mail and recoverable work where those features are enabled. Its service worker caches static app assets, not mail or account API responses. Other browser storage can still contain private mail. Storage is subject to browser eviction, quotas and your device security.

The app may synchronize settings and drafts through your account. Clearing local storage can remove unsent work, so save it first. Server-mode browser caches are disposable and bounded to 25 MiB: recent summaries last up to seven days and opened bodies up to one day, subject to earlier eviction. A last-verified app identity, without authentication or provider tokens, can reopen cached mail while offline for up to 24 hours or the remaining session lifetime, whichever is shorter. Sign-out and detected session revocation remove this offline identity. An offline device cannot learn of remote revocation until it reconnects. An installed browser app cannot guarantee background work after it closes; enabled server workers can continue independently.

Operational reporting

First-party activity, version and platform reporting is described in the Privacy Policy. It does not add advertising cookies or a persistent analytics identifier. Advertising and third-party analytics are not implemented. Any future optional tracking must be disclosed and any required choice obtained before it is enabled.

Privacy Policy