Privacy policy

Last updated 8 November 2026

KarmaMail is a mail application for Mac made by Christopher Naas ("we"). This policy explains what happens to your data when you use it. The short version: your mail is processed on your own Mac, KarmaMail has no server that receives your mail, and we do not collect, sell or share your data.

What KarmaMail accesses

When you add an account, KarmaMail connects directly from your Mac to your mail provider (for example Google, Microsoft, Apple iCloud or another IMAP server) using the sign-in you approve. It downloads your messages, folders, labels and attachments and stores them in a local database on your Mac so you can read, search and organize them. When you send, move, label or delete a message, KarmaMail asks your provider to do it on your behalf.

Passwords and sign-in tokens are stored in your Mac's Keychain. KarmaMail never sees the password you type on Google's or Microsoft's own sign-in page.

Google user data

If you connect a Gmail or Google Workspace account, KarmaMail requests access to read, send and organize your Gmail (the gmail.readonly, gmail.send and gmail.modify scopes), as you choose during sign-in. This data is used only to provide KarmaMail's mail features to you on your Mac: showing, searching, sending and organizing your own mail. Your Google data is not transferred to us or to any third party, except to an AI provider you choose yourself, as described below, when you use an AI feature on specific messages. It is not used for advertising, it is not sold, it is not read by people, and it is not used to train generalized AI or machine-learning models.

KarmaMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI features

AI features such as "Reply for me" and summaries are optional. They run only when you use them. You choose the AI provider (for example OpenAI, Anthropic, Google Gemini or a local model on your Mac) and enter your own API key. KarmaMail then sends the text needed for that request, such as the message you are replying to, directly from your Mac to that provider. That provider's own terms and privacy policy apply to the request. With a local model, nothing leaves your Mac.

What we collect

Nothing automatically. KarmaMail contains no analytics, tracking or advertising. If you choose to send us feedback or a problem report by email, we receive what you write and attach, and use it only to answer you and improve KarmaMail.

Keeping and deleting data

Your mail library stays on your Mac until you remove an account or delete KarmaMail and its data. Removing an account deletes its local mail and sign-in from your Mac; any unsent drafts are first saved to a separate folder on your Mac, which you can delete. You can revoke KarmaMail's access to a Google account at any time at myaccount.google.com/permissions, and to a Microsoft account at myapps.microsoft.com. Feedback emails are deleted on request.

Security

Connections to mail providers use TLS. Sign-in uses the providers' own pages with OAuth and PKCE where available. Credentials are kept in the macOS Keychain, and the app is signed and notarized by Apple.

Children

KarmaMail is not directed at children under 13.

Changes and contact

If this policy changes, we update this page and its date. Questions: hello@karmamail.no.