Privacy

This describes what Mailwarden actually does, verifiable against the source at github.com/mansi104-ai/Fun. Every claim below corresponds to code, not intention.

Last updated 21 August 2026.

What Mailwarden can and cannot do

Mailwarden requests exactly two Google permissions:

Mailwarden deliberately does not request https://mail.google.com/ (permanent deletion) or gmail.send (sending mail as you).

Mailwarden's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What is stored

Sorting your mail uses message headers only. Per message we store:

• The sender's address and display name
• Date, size in bytes, and Gmail's own label IDs
• A salted hash of the subject — never the subject itself
• Whether an unsubscribe header and an attachment are present

We do not store message bodies, readable subject lines, or recipient addresses. There is no database column that could hold them.

Reading a message

When you click to read a specific email, Mailwarden fetches it from Gmail and shows it to you. That content is never written to the database, never logged, and never sent to an AI model. Closing the reader discards it. Each read is recorded in your audit log by message ID only.

AI and third parties

Classification runs on aggregate statistics about senders — message counts, unread rates, subject-template ratios, domains. No message content is ever transmitted to a model. Where a model is used, the request goes to OpenRouter (free tier) or Anthropic (paid tier), carrying only those aggregate figures.

Website analytics

The public pages count visits, using our own code and our own database. There is no third-party analytics service, no advertising tag, and no tracking cookie — which is also why you have not been asked to accept one.

Each recorded event holds exactly five things:

• An event name from a fixed list — for example pageview
• The page path, from a fixed list of public pages
• The host of the referring site, never the full URL
• A utm_source slug, when the link you followed carried one
• A visitor hash, described next

The visitor hash is SHA-256(daily salt + IP address + user agent). The IP and user agent are hashed and discarded — neither is ever written down. The salt is random, held in memory only, and replaced every day, so yesterday's rows cannot be re-identified even by someone holding both the database and today's salt: the salt that made them no longer exists. Analytics rows are deleted after 90 days.

None of this reads your mailbox, and none of it is joined to your account — the endpoint that receives these events is not told who you are. Your own actions inside the app are recorded separately, in the audit log you can read at /api/audit.

Selling data

We do not sell your data or your metadata, and we do not advertise against it. That is not merely a policy — the business model is one-time and subscription payments, and the architecture does not retain enough to sell.

Security

• Your Google refresh token is encrypted at rest with AES-256-GCM.
• All traffic is HTTPS; HSTS is enforced.
• Every action against your mailbox is written to an audit log you can read at /api/audit.

Known limitation, stated rather than hidden: the token encryption key is currently held as an environment variable on the host rather than in a managed key service. Migrating it is tracked work.

Deleting your data

Disconnecting revokes the Google token and purges your stored metadata within 24 hours. Mail already archived or trashed stays wherever it is in Gmail — Mailwarden moving out of your life does not move your mail back, so undo anything you want reversed first.

Where it runs

Mailwarden runs on Fly.io in Singapore (sin). Data is stored on an encrypted volume in that region.

Contact

Questions or a deletion request: mkb.kalra@gmail.com.

Back to Mailwarden · Terms