Privacy policy

What Puffin Mail accesses, where information goes, and the choices you control.

Effective October 19, 2026 · Applies to this website and the current Puffin Mail preview

1. The website and support

This site is hosted on Cloudflare. It does not include advertising, analytics scripts, tracking pixels, account registration, mailing-list forms or embedded third-party fonts. Cloudflare processes network and request information, such as IP addresses, requested URLs, browser information and access times, to deliver and protect the website. Cloudflare may use necessary security cookies or other protection mechanisms under its privacy policy. We do not add cookies for advertising or analytics.

If you email support, we and our email service provider process your address, message and any attachments to answer your request, investigate an issue or meet legal obligations. Please do not send passwords, API keys, access tokens or private mailbox exports. We keep correspondence while needed for the request and reasonable follow-up, subject to legal and security needs; you may ask us to delete it. Website hosting and support are separate from the app's mailbox storage.

2. Accounts and information the app uses

Puffin connects to the accounts you add. Depending on the service and features you use, this includes your account identity; message headers, bodies, recipients, attachments, labels, folders, drafts and mail settings; contacts, photos, phone numbers, groups and notes; and calendars, events, guests, reminders and invitations. This information supports mail, calendar, contact, organization, reading and optional assistant features. We do not operate a Puffin server that collects your mailbox or an AI proxy that receives your prompts.

Adding an account allows the app to synchronize in the background while it is running, according to your settings. User-requested actions, configured rules, and enabled synchronization features may change data at the connected provider. The app does not send your mailbox to its developer as part of ordinary synchronization.

3. Google account access

Google sign-in happens in your browser on Google's authorization pages. Puffin receives tokens for the permissions you grant, rather than your Google password. Its Google features request the following access:

• Gmail: read, compose, send and organize email, including full mail access for the assistant's separately approved permanent-deletion operation. Permanent deletion cannot be undone.
• Gmail settings: manage filters and automatic replies and read configured sender identities and signatures.
• Contacts: read and manage contact fields, photos, lists and group memberships.
• Calendars: read and manage events, calendar subscriptions and calendar properties, including creating or deleting calendars where permitted.
• Drive files: upload files you select for calendar attachments and share those uploaded files with selected guests. This permission is limited to app-created or individually authorized files, rather than unrestricted access to Drive.

Google data is used for the user-facing features described here. Puffin Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

We do not sell Google user data, use it for advertising, or use it to train or improve generalized AI models. Any optional AI processing must comply with these restrictions, with appropriate provider settings and terms. A sharing approval does not authorize prohibited uses.

4. Local storage and device permissions

Account passwords, refresh tokens and AI credentials use macOS Keychain. The main mail, calendar and contact cache, including cached contact photos, uses SQLCipher encryption with a Keychain-held key. Recovery drafts and optional saved assistant chats use an encrypted vault. OpenPGP and S/MIME key material is managed separately by GnuPG.

Attachments opened in other apps, exported files, printing, OS-managed previews, notifications, backups and historical copies have their own lifecycles and protections. Local encryption does not mean every copy is encrypted or securely erased. Reading and contact import features can use macOS services and permissions you enable.

Importing Mac Contacts requires your permission. Optional Mac-to-Google contact syncing is off by default. If you enable it, chosen Mac contact data, including supported photos, is uploaded to the Google account you select. Copies then exist at Google as well as on your Mac.

5. Optional AI and translation

The assistant and translation features are optional and require a configured connection. The current release supports the official OpenAI and Anthropic Claude commercial APIs using your own API key. AI requests are sent directly from your Mac to the chosen service.

Depending on your request, information can include your prompt, message or attachment text, account and selection context, contacts, calendar information, previous conversation turns and results returned by assistant tools. Setting up a connection does not itself upload the entire mailbox. Assistant tools can retrieve additional information during a chat; its content is included in the review before it is sent to a model.

Before each model request, Puffin shows the destination and full request content for single-use approval. Earlier chat context and tool results may be sent again in subsequent approved requests. Translation has its own content review. Approval to share information with a model is separate from approval to perform a proposed mail, contact or calendar change.

OpenAI and Anthropic process approved content under their applicable API terms and your account configuration. They may retain content for service delivery, safety, legal or other purposes allowed by those terms; Puffin does not promise Zero Data Retention. OpenAI requests use store:false; Claude requests can use ephemeral prompt caching. Neither setting eliminates all provider retention. Use eligible API terms and disable voluntary data sharing before sending Google-derived information. Consumer chat subscriptions are not the API connection used here.

See OpenAI's Services Agreement, OpenAI's API data controls, Anthropic's Commercial Terms and Anthropic's Privacy Center. Each user's provider configuration may differ. The developer's personal API settings do not establish retention guarantees for all users.

6. External tools, remote content and sharing

Optional web search, page fetching, MCP integrations and script skills have separate single-use approvals. Queries, URLs, arguments and included data go to the service or program shown in that review. Results can return to the assistant and be included in a later model-request review. These destinations may have their own logging, retention and network access. Local MCP programs are trusted external processes; they do not receive the same sandbox restrictions as skill scripts.

Remote email images are initially blocked. If you load them or allow a sender, requests may reveal your IP address, request time and identifiers embedded in image URLs to that host. Opening links contacts the destination. Sending mail, inviting calendar guests, sharing Drive attachments, copying between accounts and exporting data also disclose information to the recipients or destinations you choose.

7. Access, removal and deletion

You can change settings, stop optional AI use, disable integrations and remove an account from Puffin. Local account removal stops synchronization and removes the saved local credential and account records. It does not delete your data at Google or another provider, revoke Google's grant automatically, delete separate saved chats or recovery items, erase exports and backups, or remove content already sent to an AI or tool provider.

Revoke Google's authorization separately through Google Account connections. Manage saved chats, drafts, exports and remote data through their own controls. Request deletion of data held by an AI, tool or mail provider directly with that provider. For information you supplied to Puffin support, contact [email protected]. We cannot delete a mailbox we do not host.

8. People, transfers and updates

The developer does not routinely receive or read your mailbox. If you choose to send specific content to support, access is limited to what is needed to handle your request and any applicable legal or security requirements. Avoid including other people's private information unnecessarily.

Hosting, email, Google, model and external-tool services may process information in countries other than yours, depending on their terms, infrastructure and your account settings. We do not promise a particular processing region for all users.

This policy will be updated when the app's practices change, with a revised effective date and additional notice where required. For privacy questions, applicable access or deletion requests, or concerns about this policy, email [email protected].