Privacy Policy
MoonshotMail is a personal macOS email client. Its developer builds it for their own use with their own Google accounts, and it isn't distributed to anyone else. This policy describes how MoonshotMail handles data it receives from Google.
What MoonshotMail accesses
When you sign in with Google and grant access, MoonshotMail requests:
- Gmail (
gmail.modify): your messages, threads, labels, and drafts, so it can show, search, and organize your mail and send replies you write. This scope can't permanently delete mail, and MoonshotMail never asks for one that can. - Basic profile (
openid,email,profile): your name and email address, to tell your accounts apart.
How it uses that data
- To display your mail as conversations, search it, and organize it with Gmail labels.
- To send email only when you explicitly choose to send it.
- To generate optional summaries using Apple's on-device models. Your mail is never sent to an outside AI service.
Where it's stored
MoonshotMail runs entirely on your Mac and talks directly to Google's APIs, plus the picture downloads and unsubscribe requests described below. It keeps a local copy of mail metadata and content in a database on your Mac so it can work quickly and search offline, and it stores sign-in tokens in the macOS Keychain. There's no MoonshotMail server. The app has no analytics, telemetry, or advertising.
Sender pictures
To show a picture beside each sender, MoonshotMail looks in this order:
- A photo or emoji you chose for that sender, kept only on your Mac.
- The sender's photo in your Mac's Contacts. MoonshotMail reads Contacts only with your permission, on your Mac, and never changes or uploads them.
- The sender's own website, for a company address. MoonshotMail requests the public home page of the sender's domain and the icon files it lists. The request names only the domain, never your address or anything from your mail.
- Gravatar (gravatar.com), for a person. MoonshotMail sends a one-way SHA-256 hash of the sender's email address, which is how Gravatar looks pictures up.
Pictures, and "no picture found" results, are cached on your Mac, so each source is asked rarely. Logos and Gravatars aren't shown beside messages that fail Gmail's sender authentication.
Pictures in automated mail
Newsletters, sales, receipts, and other automated mail often show pictures kept on the sender's servers. MoonshotMail downloads those pictures in the background when such mail arrives, whether or not you ever read it, and never at the moment you read it, so a sender can't tell whether or when you opened a message. Before downloading anything, it removes tracking pixels: tiny or hidden images, and images from mail services' open-tracking addresses, which exist only to report that mail was opened. Those are never downloaded.
The other pictures are downloaded straight from the addresses in the mail, over HTTPS and without cookies, and kept on your Mac until the mail leaves your inbox. As with any mail app that shows pictures, the servers that host them see your Mac's IP address, which suggests a rough location, when the mail arrives. Other mail never loads pictures from the internet unless you ask to see a message's original with its remote images. Apart from these pictures, the sender-picture lookups above, and the unsubscribe requests below, nothing from your mail is sent anywhere.
Unsubscribing
Automated mail usually says how to leave its mailing list, in a standard header the sender adds (List-Unsubscribe). MoonshotMail's Unsubscribe button uses that header, and it acts only when you click it and confirm, once for each click. It never unsubscribes on its own, and it never follows unsubscribe links inside a message. Depending on what the sender offers, it does one of these, and tells you which before it does it:
- Sends one request to the sender's unsubscribe address, containing only the standard words
List-Unsubscribe=One-Click, over HTTPS and without cookies. - Sends a short unsubscribe email from your Gmail account to the address the sender names. It appears in your Sent mail like anything you send.
- Opens the sender's unsubscribe page in your web browser, where you finish. MoonshotMail sends nothing.
Either way, the sender learns that your address wants off their list, as it would from any mail app's unsubscribe. MoonshotMail doesn't unsubscribe from mail that fails Gmail's sender authentication, since answering could confirm your address to a spammer. It remembers on your Mac which lists you left, and when. If you ask it to, it then archives that sender's mail in your inbox, in Gmail. If a sender keeps writing after you unsubscribe, you can report them as spam: after you confirm, MoonshotMail moves their mail in your inbox to Gmail's Spam folder, which Gmail empties after 30 days. Blocking a sender instead stays on your Mac: their mail stays in Gmail, MoonshotMail stops showing it, and nothing is sent to them.
Sharing
MoonshotMail doesn't sell your Google data, and it doesn't share or transfer it to anyone, except for the requests above: a sender's domain goes to that domain's own website, a hash of a sender's address goes to Gravatar, the pictures in automated mail are requested from the addresses that mail names, and an unsubscribe you confirm goes to the sender who asked for it. It doesn't use your data for advertising, and it doesn't use your data to develop, improve, or train generalized AI or machine-learning models.
MoonshotMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Removing your data
Removing an account in MoonshotMail deletes its sign-in tokens from your Mac. Deleting the app's data removes the local copy of your mail. You can revoke MoonshotMail's access to your Google account at any time at myaccount.google.com/permissions. Your mail itself stays in Gmail.
Changes
If this policy changes, the new version will be posted on this page with a new effective date.