Privacy policy

Summary in one paragraph

MailTwin runs on your Mac. When you ask a cloud AI provider to act on an email, the necessary message or draft and any selected style examples go directly from your Mac to that provider; they never pass through a MailTwin AI server. Provider API keys stay in macOS Keychain and are presented only to the provider you chose. Apple Intelligence and Ollama can run locally. MailTwin's separate update, configuration, licensing, and optional telemetry traffic is listed below.

Inbox Cleanup stays local. It examines sender, subject, date, mailbox, and read/flagged state for up to 150 messages on your Mac. Bodies and attachments stay unopened, and cleanup data is not sent to an AI provider or any new MailTwin network service.

Service traffic and processors

Apart from AI requests you explicitly initiate, MailTwin makes only these service requests:

• Updates — Sparkle fetches the signed appcast.xml and, when you install an update, its signed DMG from updates.mailtwin.ai. Ordinary connection metadata reaches Cloudflare; MailTwin sends no telemetry install UUID.
• Remote configuration — the public config.json is fetched from updates.mailtwin.ai about every four hours with the app build in its User-Agent and no install UUID.
• Licensing — activation sends your license key and the label MailTwin Mac · <stable 8-character hash>; later validation sends the key and returned LemonSqueezy instance ID directly to LemonSqueezy. It also receives ordinary connection metadata. LemonSqueezy's privacy policy applies.
• Telemetry — only after you opt in, the pseudonymous events described below go to telemetry.mailtwin.ai. Crash files are not uploaded.
• Provider connection warm-up (build 75) — when you open the assistant panel with a cloud AI provider selected, MailTwin may open an empty, unauthenticated connection to that provider’s API host so your first explicit action streams sooner. The warm-up carries no email content, no prompt, no install UUID, and no API key; nothing about your mail is sent until you explicitly run an action. Apple Intelligence and Ollama are never contacted this way.

Data that stays on your Mac

• AI provider API keys — stored in macOS Keychain under service ai.mailtwin.keys. A key is sent only to its provider as authentication for the direct request you initiate; it is never sent to MailTwin or Smilodon AS.
• License key and the LemonSqueezy instance ID — Keychain, same service. Used to validate your activation against LemonSqueezy.
• Indexed style profiles — sample emails from your Sent mailbox, body LZFSE-compressed, stored in ~/Library/Application Support/MailTwin/.
• Request log — redacted previews of the last 200 AI requests, viewable in Settings → Privacy.
• Cost tracker — per-day token totals so the soft caps work.
• Identity (name + email collected at onboarding) — UserDefaults. Used in greeting templates. Never transmitted by telemetry.
• Workspace and voice data — local Activity receipts, reply-aware Waiting On identities, learned Inbox Cleanup sender choices, Voice Studio preferences, My Actions templates, and Relationship Memory citation metadata are stored under ~/Library/Application Support/MailTwin/. An Activity receipt may contain a sender, subject, or account so you can recognize it, but never a message body, prompt, or AI output. Sent-message bodies are read for the local voice index only after you choose Index or Re-index: never automatically — not at launch, not on a timer, not in the background; the onboarding invitation and Voice Studio start it only on your button press. New installs default to 200 messages per account (2,000 maximum), read in five-message Mail batches. Stop prevents later batches but cannot interrupt the Apple Event already executing. None of this is telemetry.
• Clipboard watch during guided Groq setup (build 80) — while the guided setup panel that catches your free access code is on screen, and only then, MailTwin checks the general pasteboard for new text and tests it against a single pattern: a code beginning gsk_. Text that does not match is discarded immediately — it is never stored, logged, added to a diagnostics report, or transmitted. The watch stops the moment that panel closes, and nothing about your clipboard ever leaves your Mac.
• Time-saved counter (build 81) — MailTwin keeps a running estimate of the writing time it has saved you, stored on your Mac in timesaved.json. The file holds a total, a count of replies, and short one-way hashes used only to avoid counting the same reply twice. It contains no subject, sender, recipient, account, message identifier, or any part of a message, and nothing about it is transmitted anywhere, including to us. Resetting MailTwin deletes it.
• Complete deletion, and a quieter diagnostics report (build 86) — “Wipe everything” now also clears the container MailTwin shares with its Mail extension, which held your display name, primary address, signature and frequent-correspondent addresses; previously those survived a reset. The diagnostics report you can copy for support no longer lists Mail window titles, because a Mail window is titled with the message subject.

Data that goes to the AI provider you chose

When you trigger an AI action (reply, summarize, improve draft, etc.), we send to the provider:

• The body of the email you're acting on (or your draft).
• That one message's subject line and its sender/recipient addresses — the model needs them to write a useful reply.
• A short prompt that describes the action.
• A style-context fragment built from up to 5 of your past sent messages, scoped to the same recipient / topic / account when available.
• Explicit workspace context — if you click Use selected in Relationship Memory, up to three selected cited excerpts are added visibly to the assistant request. Voice Studio preferences relevant to a style action are also included. Neither is sent silently.
• Keywords expanded inside Mail (build 77) — pressing Expand keywords in Mail’s own reply window sends exactly what a panel action sends: the keywords you typed above the quote, the original message’s subject and sender/recipient addresses, and the short prompt describing the action. No new category of data leaves your Mac, nothing is sent until you press that button, and nothing is written back into the draft unless the result passes every validator.

The provider's privacy policy applies to that traffic. Your API key with that provider is what authenticates the call; from the provider's perspective the request looks identical to any other request from your account.

MailTwin never sends to the provider: any mail beyond the message, draft, and style samples listed above, content from your other accounts, your Keychain, your license key, or the name and email you entered at onboarding.

Auto-update (updates.mailtwin.ai)

MailTwin uses Sparkle 2 to check for updates roughly every 24 hours. The check fetches an XML appcast from https://updates.mailtwin.ai/appcast.xml. The fetch carries a User-Agent of the form MailTwin/<build>. Cloudflare (which serves the file) records the request IP and User-Agent in standard CDN logs. We do not associate update fetches with any other identifier.

Updates are signed with an EdDSA private key held by Smilodon AS. Sparkle verifies the signature against the public key embedded in MailTwin before installing — even if our update host were compromised, an attacker couldn't ship you a malicious update.

Remote configuration (updates.mailtwin.ai)

MailTwin fetches a small JSON document at https://updates.mailtwin.ai/config.json roughly every four hours. Its purpose is to flip a kill-switch on a specific provider/model combination if a third-party API ships a breaking change. The fetch carries the same User-Agent as the appcast above and no other client information.

Opt-in telemetry (telemetry.mailtwin.ai)

Opt-in only — off by default. If you enable telemetry in Settings → Privacy, MailTwin sends pseudonymous product-usage events to https://telemetry.mailtwin.ai/events. A record contains an event name and a strictly limited set of properties (such as action, provider, duration, or error class), a random rotating installation UUID, the MailTwin build, macOS version, and an ISO timestamp. The UUID can distinguish one installation until it is rotated, so it is pseudonymous rather than anonymous; it is not linked to your name, email, license, or purchase.

Cloudflare necessarily processes the source IP at its edge to deliver and rate-limit the request and derives a two-letter country code. The MailTwin Worker stores the country code, but writes neither the IP nor User-Agent to D1. MailTwin and Smilodon AS do not persist the source IP.

Telemetry never includes email content, addresses, subjects, prompts, AI responses, your name, or your email. The accepted event and property schema is fail-closed. The local audit is available in Settings → Privacy → “Show what's been sent”.

Accepted records are stored in Cloudflare D1 for no more than 90 days. A daily scheduled purge deletes older rows using the server-side receipt time. They are used only to understand feature use, reliability, and app/macOS compatibility; they are not sold or rented.

Turning telemetry off clears the unsent local queue and local audit, rotates the current UUID, and stops future sends. It does not instantly erase records already received; you can request deletion using the current UUID, or they expire automatically within 90 days.

Crash reports

MailTwin writes crash dumps locally to ~/Library/Logs/MailTwin/. This release has no crash-upload mechanism: MailTwin does not send those files anywhere. A diagnostics report lists crash filenames and sizes only, never crash contents. You can inspect or delete the local files at any time.

Payments and licensing (LemonSqueezy)

Purchases are handled by LemonSqueezy as the merchant of record. When you buy a license, LemonSqueezy collects the data needed for payment processing and tax compliance (your name, email, country, and payment details). Their privacy policy applies.

License activation calls https://api.lemonsqueezy.com/v1/licenses/* from your Mac with your license key and a hashed machine fingerprint (derived from IOPlatformUUID plus the bundle id). The fingerprint is used to enforce the seat limit.

What we never collect

• Email content of any kind, except in the request you make to the AI provider you chose.
• Email addresses (yours or others').
• Subjects.
• Freeform prompts you typed.
• AI provider responses.
• MailTwin and Smilodon AS do not persist your source IP. Cloudflare necessarily processes it in transit at the edge for the website, update/configuration delivery, telemetry delivery, and rate limiting, and derives a country code for opted-in telemetry; the MailTwin Worker does not write the IP to D1. AI providers and LemonSqueezy process connection data under their own policies.

Your rights (GDPR, CCPA)

You can export your local settings (Settings → Privacy → Export settings) and delete local MailTwin data (Settings → Privacy → Wipe everything). For purchase or license data held by Smilodon AS or LemonSqueezy, email [email protected]. We will respond within the period required by applicable law.

Telemetry is pseudonymous and is not linked to your name or purchase email, so an email address alone cannot locate those rows. To request deletion before the automatic 90-day expiry, include your current installation UUID. You can retrieve it on your Mac with defaults read ai.mailtwin.app telemetryInstallId; support can help you do this.

Turning telemetry off rotates that UUID. Rows received under an older, rotated UUID cannot then be linked back to you or recovered from your email address; the 90-day automatic deletion is the backstop.

Children

MailTwin is not directed at children under 13. We don't knowingly process data from anyone under 13.

Changes to this policy

Material changes will be posted here and noted in the app's release notes. The "Last updated" date at the top reflects the most recent change.

Contact

Smilodon AS
Norway
[email protected] for privacy questions, [email protected] for product questions.