Privacy Policy

Effective October 28, 2026

Who we are

Omamail is an open-source email and calendar client developed by Jason Lee and published at github.com/huacnlee/omamail. It is available as an Omarchy plugin and as a standalone desktop application for macOS, Linux and Windows. In this policy, "Omamail", "we" and "us" refer to the application and its developer.

Data Omamail accesses

Omamail only accesses data from accounts that you add and sign in to yourself. For each account, it accesses:

• Account identity: the email address of the account and the sender names and aliases configured with your mail provider, so that Omamail can show which account you are using and send from the right address.
• Email: messages, threads, headers, attachments, labels or folders, and read, starred and similar states, so that you can read, search, organize, reply to and compose mail.
• Calendars: your list of calendars and the events on them, so that Omamail can show calendar invitations, record your replies to them and add invited events to a calendar you choose.
• Credentials: the OAuth tokens or passwords needed to connect to your accounts.

Google user data

When you sign in with a Google account, Omamail asks Google for permission to use the following scopes, and uses each one only for the purpose described:

• https://www.googleapis.com/auth/gmail.modify — to read your messages and attachments, and to apply the changes you make in Omamail, such as archiving, deleting, labeling, marking as read and saving drafts.
• https://www.googleapis.com/auth/gmail.send — to send the messages you write and choose to send.
• https://www.googleapis.com/auth/calendar.events — to read calendar events related to invitations you receive, record your responses, and add events to your calendar when you ask Omamail to.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list your calendars so you can choose where an event is saved.

Google user data is used only to provide and improve the user-facing email and calendar features of Omamail that you use. It is not used for advertising, is not sold, is not used to build user profiles, and is not used by the developer to develop, improve or train generalized artificial intelligence or machine learning models. No human, including the developer, reads your Google user data, unless you explicitly provide it, for example when you attach it to a bug report.

Omamail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How data is stored

All data Omamail keeps is stored locally on your device, in locations only your user account can read:

• Credentials, such as OAuth refresh tokens and passwords, are stored in your operating system's credential store: Keychain on macOS, Credential Manager on Windows, or the Secret Service keyring on Linux. Access tokens are kept in memory only and are never written to disk.
• OAuth client settings that you supply yourself are stored in a file in Omamail's configuration directory that only your user account can read.
• Cached mail and calendar data, drafts, unsent mail waiting in the outbox, and your settings are stored in Omamail's application directories on your device, so that Omamail can start quickly and keep working while you are offline.

None of this data is uploaded to the developer or to any service other than the provider the data belongs to.

How data is shared

Omamail does not share, sell, rent or transfer your data to the developer or to third parties, with the following exceptions, each of which happens only as a direct result of something you do:

• Your mail and calendar providers. Omamail communicates directly with the services of the accounts you add, such as Google, Microsoft, HEY, or the IMAP, SMTP, JMAP and CalDAV servers you configure, to read and change your data and to send the mail you write.
• AI assistant (optional, off unless you use it). Omamail can work with an AI coding assistant command-line tool that you have installed and signed in to yourself, such as Claude Code, Codex or OpenCode. Only when you explicitly ask the assistant about a message or conversation does Omamail pass the content of that message or conversation to the tool you selected, which then processes it under the terms and privacy policy of its provider and your account with it. The developer of Omamail does not receive this content. Any reply, draft or action the assistant proposes is shown to you, and nothing is sent or changed until you approve it. If you never use the assistant, no mail content is passed to any AI tool.
• Remote content in messages. Images hosted on senders' servers are blocked by default. If you choose to load them for a message, your device requests those images from the sender's servers, which can reveal your IP address to them.
• Links and unsubscribe requests. When you open a link in a message, it opens in your web browser. When you use one-click unsubscribe, Omamail sends the unsubscribe request to the address the sender provided.
• Legal requirements. The developer does not hold your data and so cannot disclose it. Your providers' own policies govern any requests made to them.

Data retention and deletion

• Signing out of an account in Omamail deletes that account's stored OAuth refresh token from your device.
• You can delete all locally cached data, drafts and settings at any time by removing Omamail's application data directories, or by uninstalling Omamail and removing those directories.
• You can revoke Omamail's access to your Google account at any time from your Google Account permissions page. Revoking access stops Omamail from reading or changing your Google data.
• Your data on your providers' servers remains subject to their own retention policies. Deleting Omamail's local data does not delete mail from your mailbox.

Security

Omamail connects to Google and other cloud providers over encrypted HTTPS connections. Google sign-in uses OAuth 2.0 with PKCE through your web browser, so Omamail never sees your Google password. Credentials are kept out of logs and command lines, and message content is sanitized before it is displayed. The source code is public so that anyone can review how data is handled.

Children

Omamail is not directed at children under 13, and the developer does not knowingly collect personal information from anyone.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new effective date. Significant changes will also be noted in the release notes on GitHub.

Contact

For questions about this policy or about how Omamail handles your data, open an issue at github.com/huacnlee/omamail/issues.