Your mail is yours.

Who we are

HuginMail is an email app for Mac and iPhone, made by Laust Axelsen in Denmark and published at wilster.dk. Laust is the data controller for the HuginMail service. Questions, requests and complaints: laust@wilster.dk.

This policy covers the HuginMail apps (Mac, and iPhone through Expo Go), the HuginMail server they sign in through, and this website.

The Google data HuginMail uses

When you add a Google account, you sign in on Google's own page and Google asks you to allow these permissions:

• Your name, email address and profile picture (openid, email, profile), to show which account is which and to sign you in on your other devices.
• Read, compose, send and organise your Gmail (https://www.googleapis.com/auth/gmail.modify), to show your mail, send what you write, keep drafts in Gmail, and complete, snooze, move, label and mark mail read or unread when you ask.

HuginMail does not ask for permission to permanently delete mail, and it never moves mail to the trash for you.

What stays on your device

Each device keeps its own copy of your recent mail (messages, attachments you open, labels and a search index) in a local database, so the app is fast and works offline. This data goes directly between your device and Google's Gmail servers. It is not copied to any HuginMail server. Removing an account from the app, or deleting the app, removes that copy from the device.

What the HuginMail server keeps

A small HuginMail server lets your devices share one account and settings. It is hosted by Clever Cloud in the European Union. It keeps:

• Your HuginMail account: an internal id, and for each Google account you added its email address, name, profile picture link and Google account id.
• Google access keys: the refresh token Google issues when you sign in, and short-lived access tokens, encrypted at rest (AES-256-GCM). Your devices ask the server for a short-lived key and then talk to Gmail themselves. The server has no code that reads mail; its only calls to Google are signing in, refreshing or revoking keys, and fetching your name, email and picture.
• Settings you choose to sync: signatures, rules, VIPs, decisions about senders (such as "always Important" or "block", which include the sender's email address), domains whose images you allow, and appearance.
• Signed-in devices: a hashed session key, a device name and when it was last used.
• Rule bookkeeping: opaque Gmail message ids, so a rule acts on a mail only once across your devices. No subject, sender or content.
• Read receipts, if you turn them on for a mail you send: the mail carries a tiny image from the server. The server records only how many times it loaded and when, with no IP address, no device details and nothing about the mail. The recipient's mail app may block this image.

How the data is used

Only to run HuginMail for you: show your mail, act on it when you ask, sync your settings between your devices, and keep the service secure. HuginMail shows no ads, has no analytics or tracking in the apps or on this website, and does not sell, rent or trade any data.

Google API Services: Limited Use

HuginMail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the user-facing features of HuginMail described on this page.
• It is transferred to others only as needed to provide those features, to comply with the law, for security, or as part of a merger or sale with your notice. The only routine transfer is to our hosting provider, for the data listed above.
• It is never used or transferred for advertising, never sold, and never used to determine creditworthiness or for lending.
• No person reads your mail, except with your explicit permission for a specific message (for example, when you send one to us for support), when needed for security or abuse investigations, or when the law requires it.
• It is never used to develop, improve or train generalized artificial intelligence or machine-learning models.

When something leaves your device because you asked

• Sending mail goes through Gmail to the people you address.
• Claude (optional, Mac only, off until you turn it on): in Settings you can let the Claude app on your Mac use HuginMail: read and search your mail, tidy it (complete, snooze, mark read, tag), and draft replies. HuginMail then answers Claude's requests on your own computer only, protected by a key you control. Mail that Claude reads is processed by Anthropic under your agreement with them. Claude can't send or delete mail: its drafts wait in HuginMail for you to review and send. Turn it off in Settings at any time.
• Sharing and copying (for example "Copy mail for Slack" or the share menu) put mail where you choose.

Pictures and images

To show a sender's picture, the apps may look up their Gravatar using a one-way hash of their address. The Mac app may also fetch the sender domain's official mail logo (BIMI, through DNS) or its website's icon. Pictures are cached on your device. Images inside mail are blocked unless you allow them for a sender's domain, so senders can't use hidden images to see when you read their mail.

How long data is kept, and deleting it

• Your account and synced settings are kept until you delete them. Deleting your HuginMail account erases it from the server straight away and revokes HuginMail's access at Google for every account you added. Copies in the hosting provider's backups expire with their normal backup cycle.
• Removing one Google account from HuginMail deletes it from the server and revokes its access at Google.
• Devices unused for 180 days are signed out and their session removed. Rule bookkeeping is removed after 120 days, and read-receipt counts after 400 days.
• You can also remove HuginMail's access yourself on your Google account's third-party connections page.
• To delete your account, or anything else, by email: write to laust@wilster.dk from the address you signed in with. We do it within 30 days and confirm.

Deleting your HuginMail account never touches your mail in Gmail.

Security

All traffic uses HTTPS. Google refresh tokens are encrypted at rest with a key kept outside the database. Session keys and one-time sign-in codes are stored only as hashes. Mail never passes through the server, so a problem there cannot expose message content stored on your devices.

Your rights

Under the GDPR you can ask to see, correct, export or delete the data the HuginMail server holds about you, and object to or restrict how it's used. Write to laust@wilster.dk. If you're unhappy with the answer, you can complain to the Danish Data Protection Agency, Datatilsynet.

Children

HuginMail is not made for children under 13 and does not knowingly collect their data.

This website

wilster.dk sets no cookies and has no analytics. Fonts are served from wilster.dk itself. If you pick light or dark mode, that choice is remembered in your own browser only. The hosting provider keeps standard access logs for security.

Changes

If this policy changes, the new version appears here with a new date. If a change affects how Google user data is used, HuginMail will tell you in the app and ask for your consent first.