Privacy Policy

The short version

• Your mail lives on your devices and with your mail provider. The app talks to your provider directly, and we don’t keep a copy of your mailbox.
• The smart parts, like the Focus Inbox, run on your device.
• There are no ads, no analytics and no crash reporter in the app. We don’t sell your data.
• A few features need a server. What they send is encrypted wherever it can be, and each section below says what we can and can’t see.

Who we are

Fetch! is made by Dimitrios Daskalakis, a sole proprietorship in Greece, in the European Union. For the personal data described here, that’s who the data controller is. “We” and “us” in this policy mean the same.

Questions, requests or complaints go to privacy@fetchmail.co.

On your device

Without any of the optional features below, Fetch! is a mail app that runs on your Mac, iPhone or iPad and connects straight to your mail provider.

Your mail and passwords

Your mail, contacts and search index are stored in the app’s own storage on your device, protected by the operating system. Passwords and sign-in tokens are kept in the device keychain and don’t sync to other devices. None of this passes through our servers.

Google accounts

When you add a Google account, you sign in on Google’s own page, so we never see your password. Google gives the app a token that lets it read, send and organise your mail, read and add calendar events, and read basic settings such as your send-as addresses. If you turn on read tracking for a Gmail account, the app asks for full mail access as well. You can remove this access at any time in your Google Account settings.

Microsoft accounts

When you add an Outlook.com or Microsoft 365 account, you sign in on Microsoft’s own page, so we never see your Microsoft password. Microsoft gives the app a token to identify your account and read, send and organise your mail through Microsoft Graph. The permissions are shown on Microsoft’s consent page. Your mail syncs directly between Microsoft and your device, and the app’s token stays in your device keychain. You can remove this access in your Microsoft account settings.

Smart features

The Focus Inbox, and the check that catches a missing attachment or a forgotten subject, use Apple’s on-device model. Nothing is sent anywhere to be processed.

On the Mac you can choose to download the model behind search by meaning, about half a gigabyte, from Hugging Face. Hugging Face sees your IP address during the download. After that, the search runs on your Mac.

Images and logos

Images in messages load from the sender’s servers, like in any mail app, unless you block remote content in Settings. To show a company’s logo next to its mail, the app asks Google’s public favicon service for that company’s icon, sending only the sender’s domain.

iCloud

Some things sync between your own devices through your iCloud account, under Apple’s terms. These are app preferences, your Board and tasks, and, if you work with a team, some of your team keys, which live in iCloud Keychain.

Updates

The Mac app checks a signed update feed, hosted on Google Cloud Storage, and downloads updates from there. It doesn’t send a profile of your Mac. On iPhone and iPad, updates come from the App Store.

Crash reports

The app has no crash reporter or analytics. If you test Fetch! through TestFlight and choose to send a crash report or feedback, Apple passes it on to us under Apple’s TestFlight terms.

AI agents Mac

You can let an AI agent, such as Claude, ChatGPT, Gemini or Grok, work with your mail. Fetch! runs a small server that only your own Mac can reach, and you approve each agent and choose what it may do, from read-only to full access. Whatever an agent reads is sent to that agent and to the company behind it, under your agreement with them. None of it passes through us.

Between your devices

Your devices talk to each other, and to your teammates’ devices, through our relay. That’s how a Mac that stays on sends new-mail alerts to your iPhone and iPad.

Everything that passes through the relay is encrypted on the sending device for the devices meant to read it. A new-mail alert carries the sender, the subject and the start of the message, encrypted on your Mac so only your phone can open it. Apple delivers the notification but sees only “New Mail”.

To deliver messages, the relay keeps a record for each device.

Push token

So Apple can deliver to the device.

Device details

A random install id, the platform, the device’s name (on a Mac, its computer name) and delivery status.

Queued messages

Encrypted, until the device picks them up or they expire. Alerts expire within hours. Team content can wait up to two years for a device that’s offline.

A device’s record is removed after 90 days without activity. Every Mac registers with the relay when the app starts, so it’s ready when you pair a phone.

Pairing a phone with a Mac by QR code passes three encrypted messages through the relay. They’re deleted within five minutes.

Your Fetch Cloud account

Fetch Cloud is optional. It powers new-mail alerts without an online Mac, scheduled sends, snooze, read tracking, share links and working with your team. You sign in to it with your Google or Apple account, whichever you prefer, even if your mail is elsewhere.

Your identity

The email address of the Google or Apple account you sign in with, and that company’s id for your account. If you sign in with Apple and hide your email, we get a private relay address from Apple instead.

Your devices

Each device’s name, type and public keys, when it was last seen, and the IP address it last connected from. Your device list shows this to you, with an approximate country worked out on our server.

Your preferences

App settings, the list of mail accounts you’ve added (their addresses), and the Focus Inbox corrections and sender rules you make, so every device stays in step.

Diagnostics iPhone

If the app finds its screen has stopped responding, it sends a short technical reading about the app’s state, the app version, the iOS version and the device model. No mail, no content and no location. We keep the last 50 readings, for 14 days after the most recent one.

You can delete your Fetch Cloud account in the app. That deletes all of the above, your enrolled mailboxes, snoozes, read tracking and share links, and cancels a subscription bought on the web. What you’ve shared with a team stays with the team, as described under Working with your team.

New-mail alerts from Fetch Cloud

When you let Fetch Cloud watch a mailbox, it can alert your devices about new mail without an online Mac. The complimentary plan covers two mailboxes.

Google

Fetch Cloud asks Google for its own permission, separate from the one on your device. It can read message headers, such as sender, recipients, subject and date, but not message bodies. It can also send mail and manage drafts, which is only used to send the scheduled messages you’ve set. Google gives the permission to our server directly, where it’s stored encrypted. The access on your device never leaves it.

Microsoft

Fetch Cloud asks Microsoft for its own permission, separate from the app on your device. For new-mail alerts, this is metadata-only access: it can read details such as sender, recipients, subject and date, but not message bodies or attachments. This permission cannot send messages or change your mail. Microsoft gives the permission to our server directly, where the tokens are stored encrypted. The app’s access on your device never leaves it. If you choose to enable Cloud Send Later, a separate sign-in asks for permission to manage drafts and send your scheduled messages.

Other mail providers

For other providers there’s nothing narrower than your password, so your app sends it to us over an encrypted connection. It’s sealed right away with a key held in Google Cloud’s key management service, and only the part of Fetch Cloud that watches mailboxes can open it. We also store the server name, port and username.

How watching works

For each new message, Fetch Cloud reads its headers, decides whether to alert you based on your notification settings, and sends an alert encrypted for your devices. It remembers which recent messages it already told you about, as fingerprints held only in memory, and saves only its position in the mailbox. For Gmail, Google tells us that something changed through Google Cloud Pub/Sub. We also count watch time and alerts per month for each account.

When you remove a mailbox, we revoke Google’s permission, delete the stored Microsoft authorisation or delete the sealed password, and delete that mailbox’s watch data.

Scheduled sends and snooze

Scheduled sends

A scheduled message waits as a draft in your own mailbox, not on our servers. We keep a small record of when to send it and which draft it is. When Fetch Cloud sends a Gmail message for you while your devices are asleep, it reads that draft at send time and sends it through Google with the permission above. Records are deleted 30 days after the send.

Snooze

When you snooze a conversation, we store its subject, the ids that identify it and the time it should come back. At that time we send an email to your own address, through Amazon Web Services, which brings the conversation back to the top of your inbox. Records are deleted 30 days after.

Read tracking

Read tracking is off until you turn it on for an account. When it’s on, each recipient gets their own copy of your message with a tiny image, and links that pass through our server first. When a recipient opens the message or clicks a link, we record the time, their IP address, the browser or mail app, an approximate country and network, and whether it looked like a person or an automated scanner.

To match opens to messages, we store a one-way fingerprint of each recipient’s address, the message ids and the original links. Tracking stops 30 days after you send, and the data is deleted about 90 days after that. The app shows you each open and click, with its time, IP address, browser or mail app, approximate country and network.

Your recipients aren’t Fetch! users, so please use read tracking where you’re allowed to. The Terms of Use say more.

Share links

A share link lets anyone read one email in their browser. The app encrypts the email before it leaves your device, and the key is only in the link itself, so we can’t read it. If you add a passphrase, we store only a secure hash of it.

Each time the link is opened, we record the time, the timezone and type of device the browser reports, and the IP address. IP addresses are deleted after 90 days. The app shows you when and on what kind of device the link was opened, not the IP address.

Working with your team Q1 2027

Comments, assignments, shared conversations, shared drafts and Shared Sent are end-to-end encrypted. The keys live only on your team members’ devices, so what we store on our servers we can’t read. Shared conversations include the messages and attachments in them, so they contain other people’s mail too.

To run the team, our servers can see some things that aren’t encrypted.

The member list

Each member’s Fetch Cloud email address, their role, and when they joined or left.

Activity

Which device added something and when, and how big it is. Team names aren’t visible to us.

Public keys

To invite someone, the app looks up their devices’ public keys by email address. That lookup shows whether an address uses Fetch Cloud.

Invites travel as ordinary email from your own account. When you create a team, you get a 24-word recovery phrase that never leaves your device, and we keep an encrypted recovery copy of the team keys that only that phrase can open.

What you’ve shared stays with the team if you leave, and a team’s content is deleted when its last member deletes the team. The relay can hold an encrypted copy of a team’s state for up to two years.

Live editing of drafts and comments, available in Labs, is encrypted the same way.

Payments

In the App Store. Apple is the seller and handles your payment. We receive a signed confirmation of the purchase, which we use to turn on your subscription.

On the web and the Mac. Stripe is the merchant of record. It sells you the subscription and handles payment, tax and invoices under its own privacy policy. We send Stripe your account email and account id, and keep Stripe’s customer id and your subscription status.

We never see your card details.

Our website

fetchmail.co has no cookies, no analytics and no tracking. It loads fonts from Google Fonts and some code from jsDelivr, which see your IP address when they send them. If you switch between light and dark, your choice is saved in your browser.

The Fetch Cloud web pages, where you sign in and manage your subscription, keep you signed in with cookies and your browser’s storage, plus a random id for your browser that lasts one year. Everything is served by us, with no third-party scripts.

If you sign up for the beta or to hear about the launch, we keep your email, the devices you picked and your choice, and use them only to send the TestFlight invite or the one launch email.

Who helps us

We don’t sell your data, and we don’t share it with anyone except these providers, each for the reason given.

Our servers are in the EU. Where a provider handles data in the United States, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Ask us for a copy.

Why we’re allowed to

How long we keep it

Your mailbox

We don’t keep it. It’s on your devices and with your provider.

Fetch Cloud account

Until you delete the account.

Enrolled mailboxes

Until you remove the mailbox or delete the account.

Relay records

90 days after a device was last active. Queued messages until delivered or expired, at most two years.

Scheduled sends and snooze

30 days after they’re done.

Read tracking

About 90 days after tracking ends, which is 30 days after sending.

Share links

Until the link is deleted or expires. IP addresses of views, 90 days.

Team content

Until the team is deleted. The relay’s encrypted copy, up to two years.

Diagnostics

14 days after the latest reading.

Server logs

Only as long as needed to keep the service secure and working.

Payments

Stripe and Apple keep purchase records as the law requires them to.

Your rights

You can ask for a copy of the data we hold about you, and ask us to correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to processing based on legitimate interest, and withdraw consent at any time. We extend these rights to everyone, wherever you live, and we answer within 30 days.

Most of it you can manage yourself. Remove a device, a mailbox or a share link in the app, or delete your Fetch Cloud account. Mail that lives only on your device or with your provider isn’t ours to hand over or delete.

If you think we’ve got something wrong, you can complain to the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, dpa.gr, or to the authority where you live.

Security

The app talks to your mail provider and to our servers over encrypted connections. Alerts, team content and share links are encrypted on your device before they leave it. Passwords for other mail providers are sealed with a managed key, and Google permissions are stored encrypted. No system is perfect, and if something goes wrong that affects your data, we’ll tell you and the authorities as the law requires.

Children

Fetch! is for people aged 16 and over. If you think a child has given us personal data, write to us and we’ll delete it.

Changes

When Fetch! changes, this policy will too. We’ll update the date at the top, and for changes that matter, we’ll tell you by email or in the app before they apply.