Privacy

Wonnet keeps a copy of your mail on your devices and syncs it through a server. The apps start on our server; this page says what it stores and why. If you run your own server, we see nothing at all.

What we store

• Your mail accounts: their addresses and providers, and what the server needs to reach them: a Gmail refresh token, or a JMAP server's address, username and password. Credentials are sealed with AES-GCM before they are stored.
• Your mail: for each message its sender, recipients, subject, date, labels and the names and sizes of its attachments, and the bodies of the messages the server has fetched. This is what lets the apps sync, search and snooze, and send mail later.
• Mail waiting to be sent: a message you sent with undo send or send later stays on the server until it goes out, and for seven days after.
• Your sessions: each signed-in device has a token. We store only its hash. Sign-in codes and links to add another account are stored as hashes and expire within minutes.

What we don't

• Your attachments' contents. We keep their names and sizes only. Small images shown inside a message are kept as part of its body.
• What you read and when. The site and the apps have no analytics and set no tracking cookies.
• Remote images. Images in a message stay blocked until you ask for them, so senders can't tell that you opened it.

How we use it

Only to show you your mail and to carry out what you do in the apps: archiving, labelling, sending, snoozing. We don't sell it, share it, use it for advertising or to train models, and no person reads it unless you ask us to for support.

Google user data

A Gmail account gives Wonnet access to your email address and to read, change and send your mail. Wonnet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting it

Removing an account in the apps forgets its credentials and the bodies of its mail at once, and stops syncing it. To have everything of yours deleted, write to [email protected]. You can check all of this in the source.