Ghostmail Privacy Policy

Effective 17 June 2026 · Last updated 15 August 2026

Ghostmail (“the app”) is a macOS email client published by Matter ApS (“we”, “us”, “our”), a company registered in Denmark.

The short version: Ghostmail runs on your Mac, talks directly to your email providers, and Matter ApS operates no servers that receive your data.

1. We operate no servers and collect no data

Matter ApS does not run any backend service for Ghostmail. We do not receive, store, or have access to your email, your credentials, or any usage data. There is no analytics, no telemetry, no advertising, and no tracking of any kind. We do not sell or share data, because we never receive it.

2. Email account credentials

When you add an email account, your credentials are stored only on your Mac:

• Passwords and OAuth tokens are encrypted at rest using AES‑256‑GCM and kept inside the app’s sandboxed container.
• This data is never transmitted to Matter ApS.
• For Gmail and Outlook accounts, sign‑in uses the provider’s standard OAuth 2.0 flow. The resulting access and refresh tokens are stored locally and used solely to connect to your mailbox.

Removing an account from the app, or deleting the app, deletes this data from your Mac.

3. Email content

Ghostmail connects directly from your Mac to your email provider using standard protocols — IMAP and SMTP, or the Microsoft Graph API for some Microsoft accounts. Your messages are fetched, displayed, sent, and cached on your device. This content does not pass through Matter ApS at any point.

4. Optional AI email classification

Ghostmail includes an optional feature that uses an AI model to classify incoming emails as important or not. This feature is off by default and only operates if you turn it on and supply your own API key for a third‑party AI provider.

When enabled, for each classified email the app sends the following to the AI provider you selected:

• the sender’s name/address,
• the subject line, and
• up to the first 500 characters of the message body.

The provider is one you choose:

• Anthropic — sent to https://api.anthropic.com (model: Claude Haiku), governed by Anthropic’s privacy policy. Under Anthropic’s commercial API terms, data submitted via the API is not used to train Anthropic’s models.
• OpenRouter — sent to https://openrouter.ai, an AI model gateway, governed by OpenRouter’s privacy policy. Ghostmail restricts OpenRouter in two ways: every request carries OpenRouter’s data_collection: deny routing preference, which limits routing to downstream providers that do not collect or train on prompts; and the model can only be chosen from a fixed, vetted list — anthropic/claude-haiku-4.5, openai/gpt-4o-mini, google/gemini-2.5-flash, and mistralai/mistral-small (Anthropic, OpenAI, Google, and Mistral respectively; none of these providers train on data submitted through their paid APIs).

In all cases, email-derived data is used solely to produce the importance classification, is never used to train or improve any AI/ML model — whether Ghostmail’s, the provider’s, or anyone else’s — and is never transferred to any other party. Ghostmail has no server component: no email data, classification result, or API key ever passes through or is retained by Matter ApS.

Your API key is stored locally on your Mac and used only to authenticate these requests. Matter ApS does not receive this data or your key. If you do not enable this feature, no email content is ever sent to any AI provider. You can disable it at any time in the app’s settings.

4a. Google API Services — Limited Use disclosure

Ghostmail’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Ghostmail does not transfer Google user data to third‑party AI tools except as described in section 4 above — an optional, off‑by‑default feature under the user’s sole control — and Google user data is never used, by Ghostmail or any provider it connects to, to develop, improve, or train generalized AI and/or machine‑learning models.

5. Local diagnostic logs

For troubleshooting, the app writes connection logs (IMAP/SMTP/Graph) to its local sandbox container on your Mac. These logs do not contain passwords or access tokens, are rotated/size‑limited, and never leave your device.

6. Third parties

The only third parties involved are services you connect the app to:

• Your email provider (e.g. Google, Microsoft, or any IMAP/SMTP host you configure).
• An AI provider (Anthropic or OpenRouter), only if you enable AI classification.

Each is governed by its own privacy policy. Matter ApS has no access to these accounts.

7. Data retention and deletion

All Ghostmail data lives on your Mac. We retain nothing because we receive nothing. To delete all app data, remove your accounts within the app or delete the app and its sandbox container.

8. Children

Ghostmail is not directed at children under 13 and we do not knowingly handle data from them.

9. Changes to this policy

We may update this policy. Material changes will be reflected by updating the “Last updated” date above and posting the revised policy at https://matteraps.com/ghostmail/privacy.

10. Contact

Questions about this policy or your data:
Matter ApS
Email: support.ghostmail@matteraps.com

Governing law: Denmark.