MailchemyEffective 2026-10-12
Privacy Policy
How the Mailchemy closed beta handles your information.
Updated 2026-10-12 · Version 2026-10-12
Who is responsible
Mailchemy is provided by Anomys LLC-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, UAE. Contact office@anomys.com for privacy questions or requests.
This notice covers the invitation-only beta, its account service, desktop app and browser app. Availability depends on the client, enabled features and your provider. Publishing this notice does not mean every feature or installer is available.
Account and access information
We store your name, primary email, verification status, linked sign-in identities, and a password hash if you set a password. We process sign-in credentials, sessions, device records, network/browser metadata, access decisions and security records to authenticate you, prevent abuse and administer the beta. We record the versions of terms and privacy notice you accept or acknowledge, the time and method.
An invitation identifies its intended email address, expiry and acceptance. If public beta requests are enabled, they collect a name, email, operating system and optional testing note. Public requests are currently closed. Account sign-in and permission to access a mailbox are separate choices.
Server sync, device mail and shared data
When server sync is enabled and you connect a mailbox, Mailchemy stores imported message text and HTML, recipients, sender details, folder and label state, attachment metadata and a searchable index. Account records, mail metadata and the search index are held on our EU server; message bodies and attachment content are held in private, encrypted-at-rest Cloudflare R2 object storage in the EU (Eastern Europe) region, accessible only to our backend. The server uses encrypted provider credentials to continue syncing while your browser is closed. Server-held mail is not end-to-end encrypted; the service processes it to provide these features. Mailbox authorization is separate from app sign-in and can expire or be revoked.
Native direct connections in the desktop app keep their mail, OS-protected credentials, pending actions and recovery data on your device. Server mode does not send provider tokens to browser storage.
Mailchemy's backend stores account and device information, verified mailbox routing identifiers, quota coordination, shared settings, signatures, reminders, shared drafts and draft attachments. Shared drafts can contain message text, recipients and quoted mail. They are an intentional server-storage exception. This service is not entirely on-device and shared server data is not end-to-end encrypted between devices.
If you connect a Google calendar, Mailchemy stores your calendars and events on our EU server to display, remind you of and, where you request it, change them. If you allow contacts access, Mailchemy stores your provider contacts (names, email addresses and related details) and uses addresses from your synced mail to suggest recipients. You can disconnect contacts in Settings; this removes the stored provider contacts, while suggestions drawn from your synced mail remain until that mailbox is disconnected.
Local search checks cached mail; provider search sends search terms to your mail provider. Sending, reading and other requested mail operations communicate with that provider. Offline access covers only cached content. A closed browser or sleeping device cannot guarantee background synchronization or scheduled sending.
Images and optional integrations
Email HTML is sanitized and isolated from the app. Allowing remote images sends requests to the image host, which may reveal network information and that a message was viewed. You can manage image approvals in privacy settings.
To show sender pictures, our server looks up a hash of the sender's email address at Gravatar and the sender's domain at Google's favicon service. These requests do not include your account, mailbox credentials or message content. Results are cached for up to seven days and hold only the hash and domain.
Where call transcription is available in the macOS desktop app, recording starts only when you choose to record. Audio is captured and transcribed on your device, and transcripts stay on that device; they are not uploaded to Mailchemy. The speech model is downloaded once from our Cloudflare-hosted model store.
Where call recording is enabled in the browser app, recording also starts only when you choose to record. The audio is uploaded to our server and transcribed by Deepgram, a speech-recognition provider in the United States. Mailchemy deletes the audio as soon as the transcript is saved, and deletes unfinished uploads after 24 hours. Transcripts are stored with your account until you delete them or your account. Deepgram processes the audio only to return the transcript to us.
For any recording, you are responsible for telling other participants and obtaining any consent the law requires.
If you authorize an external MCP client or other integration, information returned through the access you grant leaves Mailchemy and is handled by that service. Review its permissions and privacy terms. Mailchemy does not currently send mailbox data to an AI provider. Before any AI feature uses your mail, we will update this notice to name the provider and what it receives, and ask for your permission in the app.
Google data and Limited Use
Mailchemy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. It also follows the Google Workspace API User Data and Developer Policy.
Mailchemy accesses Gmail, Google Calendar and Google Contacts data only to provide the features you use in the app: reading, searching, organizing and sending your mail; showing, creating and changing calendar events, finding free times with your guests and reminding you of events; and suggesting recipients. We do not sell Google user data, use it for advertising, or transfer it to others except as needed to provide these features, for security, or to comply with law.
We do not use Google user data to develop, improve or train artificial-intelligence or machine-learning models, other than models personalized for you alone. Human access to Google user data is limited to the circumstances those policies permit, such as your explicit permission for specific support, necessary security investigation or legal obligations. We do not claim completed Google verification or a security assessment.
Providers and processing locations
Hetzner hosts the account, admin and browser services on our EU VPS. Mailgun's EU service delivers account emails and processes the recipient, message and delivery information; account-email open and click tracking are disabled. Google and Microsoft process the sign-in, mailbox, calendar and contacts requests you authorize. Cloudflare provides DNS for our domains and private R2 object storage (EU, Eastern Europe region) for message bodies and attachments. Cloudflare proxy/CDN delivery is not part of this deployment. Gravatar and Google's favicon service receive the sender-picture lookups described above. Where browser call recording is enabled, Deepgram (United States) transcribes the audio as described above.
Our operator is in the UAE. Support sent to support@mailchemy.app or office@anomys.com is processed by the email providers handling that correspondence and may be accessed by our team in the UAE. Providers and your devices may process information outside your country. We use information for the purposes described here and apply applicable requirements to international transfers. We may disclose necessary information to comply with binding legal obligations or address security incidents; Google data remains subject to the restrictions above.
Usage and diagnostics
The admin service shows access state, connection/setup information, sync errors and device contact. Background contact is not counted as intentional activity. The app reports foreground activity with app version, client type and coarse platform; it does not report the pressed key, click target, message content or search terms. Daily usage records cover 30 UTC calendar days. Installer-request records, including version, platform, purpose and a retry identifier, are retained for 90 days. An hourly maintenance task removes expired usage and installer-request records while the server is operating.
Activation, latest client versions and first reported desktop launch are retained while the account exists. These records do not prove a completed installation. Administrator actions have audit records. A bug-report action prepares an editable email; you choose whether to send it and attach logs or screenshots. Avoid including credentials or unrelated private mail.
Retention and deletion
Account records and shared workspace content are retained while needed to provide your account and its features, until removed through the applicable account or content-deletion workflow. Device caches remain until cleared by the app, you or browser storage management. Support correspondence is retained while needed to resolve the request and related follow-up. Invitation, access-audit and abuse-prevention records are retained as needed to secure the beta, resolve access disputes and prevent deleted data from being recreated; these records do not have a blanket automatic deletion period.
Server draft uploads are limited to 10 MiB per file, 20 files and 25 MiB per draft, and 100 MiB of server draft attachments per account. Saved drafts, attachments and original transfer-recovery records are not subject to automatic age-based deletion. They remain until the applicable user deletion workflow or account deletion removes them. Incoming attachments are fetched through authenticated requests when requested rather than copied eagerly. We do not claim antivirus scanning. Imported search indexes the first 65,536 text characters of each message; provider search covers uncached history.
You can request access, correction, export or deletion, withdraw consent where processing relies on consent, and raise an objection or privacy concern. Contact us so we can verify ownership and handle the request under applicable law. Where applicable, you may complain to the competent data-protection authority. We do not condition statutory rights on accepting these terms.
Account deletion removes the active account and its owned server data, including message content in object storage. That content becomes unreadable immediately and a background cleanup removes it, normally within a few days. It does not delete messages at Google or Microsoft, revoke provider consent automatically, erase recipients' copies or remotely wipe offline devices. An active-database deletion cannot erase independently retained copies in the same transaction. Automated offsite backups are not yet enabled in this closed prelaunch deployment; we do not promise disaster recovery. Any backup rollout must disclose its retention and deletion handling before testers are invited.
Cookies and changes
We use essential authentication cookies and device storage for the functions described in the Cookies & Local Storage notice. Advertising and third-party analytics are not implemented. Published notices carry a version and effective date; earlier versions remain accessible. Material changes will be explained before they take effect, with separate permission requested where required.