Privacy Policy

Who we are

Postal is operated by California Community Commerce, LLC ("we," "us"). This policy covers the Postal apps for Mac and iPhone and this website, postal.llc. Postal was called Supermail until October 2026; this policy covers it under either name. Questions go to support@postal.llc.

Google user data Postal accesses

When you add a Gmail account, Postal accesses this Google user data through Google's Gmail API, directly from your device:

• Your email: the messages and conversations in your Gmail account, including senders, recipients, subjects, dates, message text and formatting, attachments, and Gmail's IDs for them.
• Your labels: your Gmail labels (their names, colors and IDs) and which labels each conversation has, such as Inbox, Unread, Starred, Spam and Trash.
• Your account details: your Gmail address, and the names, send-as addresses and signatures in your Gmail settings.
• Your vacation responder: read only, so Postal can remind you while it's on. The public apps keep only whether it's on.

Postal also writes to your Gmail account when you ask it to: it changes a conversation's labels (read, done, starred, labeled, spam or trash), creates labels you name, adds and removes its own hidden reminder labels, and sends email you write. Each is described under "What Postal can do in your Google account" below.

Postal doesn't access your Google password, Google Drive or Google Contacts.

How we protect your data

Postal protects Google user data in these ways:

• It stays on your device. The public apps download your Gmail data straight from Google to your device and send it back only to Google. We run no server that receives it, so we can't read it. (Showing an email still loads the pictures and other content it points to, and unsubscribe contacts the sender, as described under "Where your data goes".)
• Encrypted in transit. Every connection to Google uses HTTPS (TLS).
• Encrypted on your device. On a Mac, your mail, labels, contacts, search index and the settings that come from your mail are kept in a database encrypted with SQLCipher (AES-256), and pictures from emails and unsent drafts are each encrypted with AES-256-GCM. The key is in your Mac's Keychain, and only your Mac user account can open Postal's folder. Postal doesn't encrypt the app's log, its settings file, attachments you download, or the temporary copy made when you open an attachment (deleted the next time Postal launches), so protect your Mac with a password and FileVault. On iPhone, iOS Data Protection encrypts the app's storage, unsent drafts use Apple's strictest protection, and your mail is left out of iCloud and computer backups.
• Protected sign-in. You sign in on Google's own page using OAuth with PKCE, so Postal never sees your Google password. Your sign-in tokens are kept in the Keychain (on iPhone, on that iPhone only). Remove Account deletes that account's downloaded mail and the other data Postal keeps for it on the device, and asks Google to cancel Postal's access (the exceptions are listed under "Removing your data").
• Only the access it needs. The public apps ask for one Gmail permission and never permanently delete email. Features that would need more access are left out of the public apps when they're built, not just turned off.
• Emails can't run code. Emails are shown in a sandbox where their scripts can't run. Links in an email open only as a web page, a new email or a phone call; other kinds of links are blocked. On a Mac, attachments you download are marked as downloaded from the internet, so macOS checks them before they open.
• Logs leave your mail out. The app's log doesn't record the text or subjects of your emails, and replaces each email address with a short code made on your device (details under "What stays on your Mac").
• Signed updates. Every Mac version is signed with our Apple Developer ID and notarized by Apple, and the app installs only updates signed by Postal.

If we learn of unauthorized access to Google user data, we'll tell Google and the people affected, as Google's policies and the law require.

What Postal can do in your Google account

You sign in on Google's own page (in your web browser on a Mac, or in Apple's sign-in window on iPhone), so Postal never sees your Google password. Postal asks Google for one permission, "Read, compose, and send emails from your Gmail account" (the gmail.modify scope). With it, Postal:

• Reads your email, labels, and attachments, and your Gmail display name and signature.
• Checks your Gmail vacation responder so it can remind you while it's on. Google returns the whole setting, including its message; the public apps use only whether it's on, and that stays on your device.
• Makes the changes you ask for, like marking email read, done, starred, labeled, spam, or trash, and creates new labels you name. Remind me takes a conversation out of your Gmail inbox and puts it back at the time you pick. It adds a Gmail label to the conversation containing only the reminder's due time in UTC, such as [Supermail]/Remind/20261001T1600Z. The label is hidden from Gmail's label and message lists and lets Postal on your other devices know when that conversation is due back in the inbox. Postal removes the label from the conversation when the reminder ends, and deletes its own reminder labels only when their due time is more than 30 days past and they're no longer on any email.
• Sends email you write, and searches Gmail when you search.

Postal never permanently deletes email, and the public apps don't access your Google Drive, Calendar, or Contacts.

What stays on your Mac

Postal keeps your mail on your Mac so it's fast and works offline, encrypted:

Postal doesn't keep Gmail's replies or emails' web content in a disk cache; they stay in memory while the app runs. Attachment previews use temporary files, and any left over are deleted the next time Postal launches. Still protect your Mac with a password and FileVault, because the log, the settings file and your downloaded attachments aren't encrypted by Postal.

What stays on your iPhone

The iPhone app keeps the same kinds of data (your email, labels, reminders, unsent drafts, pictures from emails, and a search index) in its own app storage, which other apps can't read and which iOS Data Protection encrypts on disk. With a passcode set, mail storage and pictures become readable after the first unlock following a restart and stay readable while locked, so new mail can arrive in the background; unsent drafts use Apple's strictest protection and can't be read shortly after the iPhone locks. That copy is left out of iCloud and computer backups. Settings that come from your mail (your account order, the colors you give accounts and Super Labels, and what the app remembers for new-mail notices) are kept in that same storage. The app's log is also left out of backups and protected the same way. It doesn't include email text, subjects, label names or label IDs; each email address is replaced with a short code made on your iPhone. It can include Gmail message, conversation and attachment IDs. Apple's system log also gets each line, with its text marked private. Lines from earlier versions get the same cleanup when the app opens, but can still name a label until the log rolls over, and their copies in Apple's system log aren't hidden. Your other settings, app choices like colors and swipes, are included in backups. Pictures, stylesheets and fonts that emails load from the web stay in memory, never in a cache on disk, and the web cache earlier versions left on disk is cleared. Your Google sign-in is kept in the iPhone's Keychain, on that iPhone only. "Try the demo" shows made-up mail and sends nothing anywhere. Attachments you open go to the app's temporary storage, and leave it only if you share or save them. The iPhone app doesn't file crash or bug reports.

Where your data goes

The public apps don't include analytics, advertising, or tracking code. Postal connects only to:

Google

To sync, search, change, and send your mail, over an encrypted connection.

The senders of your email

On Mac and iPhone, showing an email can load remote pictures, stylesheets and fonts from addresses the email names. The servers hosting them, including other companies the sender uses, receive your IP address and may learn when you view the email. Links you click open in your web browser.

Unsubscribe (⌘U, Mac only), only when you use it

Postal uses the unsubscribe method the sender provides: a one-click unsubscribe request sent to the sender's web address, an unsubscribe email sent from your Gmail, or the sender's unsubscribe page opened in your browser.

GitHub, for app updates (Mac)

Starting with the public-update release, the Mac app checks for updates about once an hour by downloading an update feed from GitHub's public finishedgoods22/supermail-releases repository, which holds only release files, and downloads new versions from there. These requests use HTTPS without a GitHub account, token, or cookie. GitHub receives your IP address and a User-Agent naming Postal, its update library (Sparkle), and their versions. Sparkle's optional system profile is turned off. Every update is signed by Postal, and the app refuses anything else.

Apple iCloud, for your settings

If you're signed in to iCloud, Postal syncs your settings between your Macs and iPhone through Apple's iCloud key-value storage, in your own iCloud account. There's no Postal server in between. The public apps sync only your app choices, such as colors, swipes, the iPhone's conversation bar, what the ! key does, Smart Compose, tooltips, light or dark, how long Undo Send waits, and the missing-attachment warning. They sync no email, account addresses or label names; account and Super Label colors aren't synced. Text size, windows and notifications are never synced.

Sync is on unless you turn it off. On Mac, open Settings, choose Appearance, and uncheck "Sync settings with your other Macs and iPhone through iCloud"; on iPhone, open Settings and turn off "Sync settings through iCloud". Turning it off stops syncing from then on. Turning sync off or using Remove Account doesn't delete settings already stored in your iCloud account, and Postal doesn't yet have a way to delete them there. We never receive them; Apple keeps them in your iCloud account under Apple's privacy policy.

Crash and bug reports

Postal sends no crash or bug reports; it saves them on your Mac, and you choose whether to email one to us.

AI features, on your device

The public apps send no email to any AI service. Smart Compose and AI search use Apple's on-device model: it runs on your device, and nothing it reads is sent to any AI service (AI search then runs the resulting Gmail search, like any search).

How we use Gmail data

• Postal uses data from your Google account only to provide the features you see in the app: showing, searching, organizing, and sending your mail, and reminders.
• We don't sell Gmail data or transfer it to anyone except as described above, to provide those features, for security, or when the law requires it.
• We don't use Gmail data for advertising, and we don't give it to advertisers or data brokers.
• We don't use Gmail data to create, train, or improve AI or machine-learning models.
• No one at Postal reads your email, unless you ask us to (for example, to fix a problem), for security, or when the law requires it.

Postal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing your data

Postal's copy of your mail stays on your device until you delete it. The easiest way is Remove Account: on iPhone, open Settings, tap the account, then Remove Account (or swipe left on it and tap Remove); on Mac, open Settings, choose the account, then Remove Account (or right-click the account there). After you confirm, Postal deletes that account's downloaded mail, drafts, pictures, attachment copies, settings and notifications from that device, and asks Google to cancel its access (it tries again on a later launch if you're offline). Nothing in Gmail is changed or deleted: your mail and any reminder labels stay there. Your other devices signed in to that account in Postal may need to sign in again. You can also:

• Remove Postal's access to Gmail in your Google Account settings.
• On iPhone, use Remove Account before deleting the app. Deleting the app removes its app storage, but sign-in information in the iPhone's Keychain may remain, and attachments you saved or shared outside the app aren't deleted. Removing its Google access (above) makes any remaining sign-in stop working.
• On a Mac, to remove Postal's files by hand, quit Postal and delete the Postal folders listed under "What stays on your Mac" (in Downloads, only the attachment files Postal put there and any bug reports you saved, not the whole folder), plus ~/Library/WebKit/email.supermail.mac, ~/Library/HTTPStorages/email.supermail.mac and the settings file ~/Library/Preferences/email.supermail.mac.plist, then delete the app. That doesn't remove Postal's items in your Keychain, lines already in Apple's system log, your backups, or settings already synced to iCloud.
• To delete crash reports or anything else we hold, email support@postal.llc and we'll remove it.

This website

postal.llc has no cookies or analytics. It uses JavaScript only for its animations and interactive previews. Our host, Vercel, keeps standard server logs (such as IP address, browser type, and the page requested) to run and protect the site, for as long as Vercel's log retention for our plan allows.

What we keep, and for how long

California Community Commerce, LLC runs no server that stores your mail. We receive email content only when you choose to send it to us: when you email us (including with Send Feedback in the app, which sends your note from your Gmail along with the app's version, your device model and its system version), we get your address, your message and anything you attach (such as a bug report you saved). We use it only to answer you and fix problems, and we keep it in our email until it's no longer needed or you ask us to delete it. To have anything we hold deleted, email support@postal.llc.

Children

Postal isn't meant for children under 13, and we don't knowingly collect their data.

Changes

We'll update this policy when Postal changes what it does with data. The date at the top shows the latest version.

Contact

Questions or requests about your data: support@postal.llc.