Privacy Policy

1. What Darwin MailOS is

Darwin MailOS is a personal email-management application built and operated by its owner, an individual, for that owner's own mailbox. It is not offered to the public, has no user accounts other than the owner's, and is not sold. The only Google user whose data it processes is the owner. This website exists because Google requires a public home page and privacy policy for applications that use Gmail permissions.

2. Google data accessed

With the owner's authorization, Darwin MailOS reads from the connected Gmail account:

• the account's email address and the mailbox change counter that Gmail uses to report new or changed messages (used to identify the account and to find new mail);
• for recent inbox messages: message and thread identifiers, labels, date, size, and these headers: From, To, Cc, Subject, Date, Message-ID, In-Reply-To, References, List-Id, List-Unsubscribe, Auto-Submitted, Precedence;
• for messages that the local rules cannot classify from the headers alone: the message text (the plain-text part, or the HTML part converted to text);
• the list of label names, the number of drafts, the identifiers of recently sent messages and the identifiers of messages in the trash (identifiers and counts only, never their content), read as an independent check that nothing in the mailbox was created, changed or removed while the application was connected.

On first connection the application reads at most the inbox messages of the last 14 days, up to 500 messages. Afterwards it reads only the mailbox change history and new inbox messages. The content of older mail is not read.

3. Purpose of access

The data is used for one purpose: to help the owner manage their own mail. Concretely, the application sorts messages into attention categories, notes deadlines and commitments, writes short summaries, prepares draft replies for the owner to review, and delivers a daily digest to the owner. These features are the whole of the application's user-facing functionality.

4. OAuth scope requested

Darwin MailOS requests exactly one Gmail scope: https://www.googleapis.com/auth/gmail.readonly ("View your email messages and settings"). The application checks the scope Google actually granted at the moment of consent; if anything broader were granted, the application revokes the grant and refuses to run.

5. What it does not do in the current phase

• It does not send email and has no sending function.
• It does not create drafts inside Gmail; draft replies exist only inside Darwin MailOS until the owner decides what to do with them.
• It does not delete, trash, archive, move or forward messages.
• It does not add, remove or change labels, and does not mark messages read or unread.
• It does not change Gmail settings, filters, forwarding or vacation responders.
• It does not download attachments.
• It does not register for Gmail push notifications and runs no server that receives data from Google.

The application's Gmail client can only issue read requests to a fixed list of endpoints; any other request is blocked in the code before it reaches the network. Any future change of capability would require a new scope, a new consent from the owner and an update to this policy.

6. Local storage and retention

Everything Darwin MailOS stores itself is kept on the owner's own computer; the only transfers to other parties are the ones described in sections 10 and 12. The database runs in an isolated environment on that computer that cannot be reached from the internet and has no connection to the internet itself. Backups of the database are made on the same computer and rotated (the newest 14 daily and 8 weekly copies are kept); they are protected by file permissions and are not separately encrypted. Records are retained until the owner deletes them or disconnects the account; the application does not currently delete database records automatically.

7. Message content cache

When the text of a message is needed, the application fetches the message and keeps the raw copy in a temporary, permission-restricted cache on the owner's computer for at most 72 hours. The cache is purged on every synchronization run. The text is used locally to classify the message and, where applicable, to build the minimized packet described in section 10. Message bodies are not written to the database; only a cryptographic hash and the length of the text are recorded.

8. Metadata and database records

For each message the database keeps:

• Gmail message, thread and history identifiers;
• labels, date and size;
• the subject line;
• the sender's domain and a hashed form of the sender address;
• the number of recipients (not their addresses);
• hashed message identifiers;
• whether mailing-list headers were present;
• the attachment count with hashed file names, types and sizes;
• the processing state.

It also keeps the results of processing: the attention category, priority, a short summary, extracted deadlines and commitments, draft reply text prepared for the owner, and a log of processing decisions. Recipient addresses and message bodies are not stored.

9. Attachments

Attachments are never downloaded. The application records only a hashed file name, the media type and the size, and it never sends attachment content anywhere.

10. AI assistant processing

Darwin MailOS uses two AI assistant services that the owner subscribes to personally, as processors, to classify messages, write summaries, extract commitments and prepare draft replies:

• Anthropic — Claude, used through the Claude Code command-line tool on the owner's Claude subscription;
• OpenAI — ChatGPT/Codex, used on the owner's ChatGPT subscription.

These services receive data only after the owner has explicitly confirmed, inside the application, that the services' consumer privacy controls were reviewed. Before anything is sent, the application applies these limits:

• Only messages classified as routine (bulk or notification mail) or ordinary personal correspondence are eligible. Messages classified as sensitive are never sent (section 11).
• What is sent is a minimized packet: the subject line, the sender's domain (never the full address), a language hint, and the message text reduced to at most 4,000 characters with quoted history, signatures, links and tracking elements removed and with secrets, email addresses, phone numbers, bank identifiers, national identification numbers and street addresses redacted.
• Recipients, dates, message identifiers, other headers and attachments are never sent.
• The AI services cannot send, edit, delete or otherwise change anything in Gmail, and they cannot instruct the application to do so. Their answers are used only to sort mail, write summaries and prepare drafts that the owner reviews; nothing is sent anywhere as a result of an answer.

Anthropic and OpenAI receive and process the minimized text under their own consumer terms and privacy policies, which govern how long they keep it and under what conditions their staff may access it (for example for safety or legal reasons). The owner has turned off the setting that would allow either provider to use this content to improve or train its models. Darwin MailOS itself does not use Google user data to create, train or improve any machine-learning or artificial-intelligence model, including foundation models, and does not permit the providers to do so on its behalf.

11. Sensitive data

Every message is classified locally before anything else happens. Messages whose subject or text indicates financial, legal or immigration, medical, insurance, tax, identity-document, school or minor-related, account-security or private family matters are held on the owner's computer for the owner's own review and are never sent to an AI service. Messages containing secrets such as passwords, access tokens or payment-card numbers are quarantined locally. Content that looks like an attempt to instruct the software is treated as data, never followed, and can only raise a message's sensitivity level.

12. Sharing and disclosure

Google user data is shared only with the following processors, only for the purposes above:

• Anthropic and OpenAI, as described in section 10 (minimized text of eligible messages, only after the owner's confirmation);
• Telegram, which delivers two kinds of messages to the owner's own private bot conversation: the daily digest (message subjects, sender domains, ages, categories, deadlines and references to pending drafts) and, separately, each draft reply prepared by the application (its full text, so the owner can approve, change or discard it). Neither message ever contains the original message bodies.

No other person or organization receives Google user data from Darwin MailOS. The application is used by its owner alone; no employee, contractor or other person reads the owner's mail through it, and the owner is the only human with access to what it stores. The providers named above handle the minimized text they receive under their own policies (section 10). Beyond this, data would be disclosed only for security purposes (for example to investigate abuse) or where required by applicable law; no other transfer will take place without the owner's explicit prior consent.

13. No sale, no advertising

Google user data is never sold, never used for advertising or ad targeting, never used for credit or lending decisions, and never transferred to data brokers or advertising platforms.

14. Security safeguards

• The Google sign-in credential is stored in a permission-restricted file on the owner's computer and is held only by the process that synchronizes mail. The database, the automation assistant and the AI clients never receive it.
• The Gmail client can perform only read requests to a fixed list of endpoints; every other request is blocked before any network connection is made.
• The database and the application service run in isolated containers without public network ports.
• Message content is cached temporarily with restricted permissions and purged automatically.
• Application logs never contain message bodies, headers or email addresses.
• Every processing decision is recorded in a log that the application can add to but cannot edit or erase.

15. Revoking access

The owner can revoke Darwin MailOS's access at any time from the Google Account permissions page (myaccount.google.com/permissions) or with the application's own revoke command. Once the credential is revoked or expires, the application stops reading Gmail immediately and does not attempt to reconnect on its own.

16. Deletion

Because the application runs on the owner's own computer, the owner can delete any stored data at any time: the temporary cache expires by itself within 72 hours; database records, backups and the stored credential can be removed by the owner. Disconnecting the account and deleting the local database and its backups removes all Google user data held by the application. Requests concerning stored data can be sent to the contact in section 19.

17. Google API Services User Data Policy

Darwin MailOS's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Because Gmail data is a Google Workspace restricted scope, Darwin MailOS also follows the Google Workspace API User Data and Developer Policy. In particular, Google user data is used only to provide the user-facing features described in sections 2 and 3; it is transferred only to the processors named in section 12, only to provide those features, and only with the owner's consent; it is never used for advertising or lending decisions; it is never used to create, train or improve a machine-learning or artificial-intelligence model beyond the owner's own use of the features; and no human other than the owner reads it through the application, except as required for security purposes or by applicable law.

18. Changes to this policy

This policy will be updated whenever the application's data practices change, for example if a future phase requests additional Gmail permissions. The version number and dates at the top of this page identify the current text.

19. Contact

Darwin MailOS has a single user, its owner. Questions about this policy or about stored data can be sent to the user support email address that Google displays on the Darwin MailOS sign-in (consent) screen before any access is granted; that address is monitored by the owner. No other contact channel exists, and this site collects no information.