The Short Version

GravesMail is a local-first email client. Your email is downloaded to your computer and stays there. I do not operate servers that store, read, or process your email. I do not collect personal information. I do not display ads. I do not sell data. The only data that ever leaves your computer is when you explicitly opt in to the Community Spam Intelligence feature, and even then, no email content is ever shared.

What Data GravesMail Stores

All data is stored locally in your user profile — under %LocalAppData%\GravesMail on Windows, or the platform equivalent on macOS, Linux, iOS, and Android. Here is what is kept and why:

The encrypted database. Your mail and nearly all of your supporting data live in one whole-database-encrypted store: every message, subject, sender, and attachment, plus your contacts, calendar, signatures, Quick Rules and advanced rules, safe and blocked lists, sender reputation, spam-filter training, tuned thresholds, and security settings. These were previously loose files alongside the database; they were consolidated into it, which strengthened their protection. They did not move off your device — nothing about where your data lives changed, only how it is stored locally.

Files that stay outside the database, because they are needed before it can be opened or must survive its loss:

• The database key — held in your device’s own secure keystore (DPAPI on Windows, Keychain on macOS/iOS, Keystore on Android, the system secret store on Linux). It cannot live inside the database it unlocks.
• Saved account credentials — your IMAP/SMTP passwords and OAuth2 tokens, encrypted with your device key and deliberately kept separate from the mail database.
• bmk.wrap — the wrapped copies of your Backup Master Key. It sits with your backups rather than in the database, precisely because a backup exists to survive the loss of that database.
• Your PGP keyring — kept in its standard on-disk format, with the private keyring under its own wrapping key.
• backups/ — encrypted backup files (.gravesmail-backup), AES-256 under the Backup Master Key
• Backup catalog — a local metadata index for instant browsing of backup contents (never transmitted)
• Deletion log — deleted message content for recovery (configurable retention: 30–365 days)

Files that ship with the app — the baseline spam model, the baseline YARA rules, and the geographic lookup table — are program assets, not your data. They are replaced when you update and are excluded from backups.

No data is stored outside this directory. No data is stored on remote servers.

What Data GravesMail Never Collects

• Email addresses — yours or anyone who emails you
• Email content — no subject lines, message bodies, or attachments
• Sender or recipient information
• Passwords or credentials
• Contact lists
• Calendar events
• IP addresses
• Your name, location, or any identifying information
• Usage patterns — I do not track how often you open the app, which emails you read, or how you interact with messages
• Crash reports or diagnostics — nothing is ever sent automatically
• Installation or registration data — there is no account to create

Backup Privacy

GravesMail creates encrypted backups of your whole local profile:

• Scheduled and manual device-local backups (full and differential) are AES-256 encrypted under a Backup Master Key that GravesMail generates and manages. The key is never stored in the clear — only wrapped copies are kept, wrapped both under your device’s secure keystore (so routine backups need no password) and under a recovery passphrase you set once. The recovery passphrase is required, not optional, and it is what lets these backups be restored on a new or replaced device. I never receive the key or the passphrase, and I cannot recover either one for you.
• Portable Password Backup (File → Portable Password Backup…) is sealed with a password you choose, using PBKDF2-SHA256 key stretching at 600,000 iterations. If you lose that password, the backup cannot be opened — by design, and by no one, including me.
• Backup metadata catalogs are stored locally and never transmitted. They allow instant browsing of backup contents without decrypting the full backup.
• Pre-operation snapshots are created before destructive operations (Quick Rules scans, purges, clear trash) as a safety net.

All backup files stay on your computer unless you copy them elsewhere yourself. A Portable Password Backup holds your entire profile — including saved account passwords and the keys that unlock your mail — protected only by the password you chose, so keep the file somewhere safe.

Quick Rules Privacy

Quick Rules data is stored in your local encrypted database. Messages your rules set aside in the Spam Trap, their match lists, and the rule definitions themselves never leave your computer. When you delete a rule or purge what it caught, the data is permanently removed from your local database.

How Your Credentials Are Stored

GravesMail keeps all of your mail and personal data encrypted at rest on every device. The encryption key is held in your device’s own secure keystore — DPAPI on Windows, Keychain on macOS and iOS, Keystore on Android, and the system secret store on Linux — so the data is readable only on your device. If you save your email credentials, they are encrypted the same way and can only be decrypted on the same computer, by the same user who saved them.

GravesMail never transmits your credentials to any server other than your email provider’s mail server for the purpose of logging in.

For Microsoft/Outlook accounts that use OAuth2 authentication, GravesMail uses the standard Microsoft Identity Platform flow. Authentication tokens are stored locally using the same encryption. GravesMail does not have access to your Microsoft account password.

Geolocation Is Local

GravesMail looks up the geographic origin of incoming mail as one of its spam signals. That lookup happens entirely on your device, against a country-to-IP-range table embedded in the app. There are no DNS queries, no external API calls, and no third-party lookup service. Your message metadata is never sent anywhere to be geolocated.

IP geolocation data by DB-IP (db-ip.com), licensed under CC BY 4.0.

External Image Blocking & Tracking Pixel Protection

External images are blocked by default to prevent senders from learning your IP address, that you opened their email, when, and from what device.

Tracking pixels (invisible 1×1 images used solely for read-receipt tracking) are detected and stripped separately. These are independent controls — you can load images without loading trackers.

End-to-End Encryption (OpenPGP)

GravesMail supports standard OpenPGP for end-to-end encrypted and signed mail. Everything happens on your device: keys are generated locally, your secret key never leaves your machine, and encryption and decryption are performed by the app. There is no key escrow, no keyserver upload, and no service of mine in the path — I have no copy of your keys and cannot read your encrypted mail.

What PGP hides: the message body and attachments.

What PGP does not hide: the subject line, the To/From/Cc, and when the message was sent. Those travel in the clear and remain visible to mail infrastructure, including your provider. This is a limit of PGP/MIME itself, shared by every client that implements it, Proton included — not something GravesMail can fix, and not something I’ll imply otherwise.

PGP protects mail in flight — from interception and from your mail provider. It is not an anti-forensics tool. Once a message is decrypted, it is cached in GravesMail’s local encrypted database so you can search and read it offline, which means it is protected on disk by your device encryption rather than by PGP.

If you lose your secret key, mail encrypted to it is permanently unrecoverable. I cannot recover it for you — there is no escrow copy, which is the same design choice that means no one else can read your mail either.

Password-Protected Email

When you send a message with Password-protect (no key needed), the message body and every attachment are encrypted on your device into a standard AES-256 ZIP before the message leaves. The sealing happens locally — nothing is uploaded to me or to any service to perform it, and there is no server in the path.

The password is yours alone. GravesMail shows it to you once, never emails it, never stores it, and never transmits it. I have no copy of it and no way to open what you sent. You share it with your recipient out-of-band — by phone, text, or encrypted chat.

The protection is the password and nothing else. There is no expiry and no remote revocation, because both would require a server I deliberately do not run. As with any email, the message’s subject, To/From, and timing still travel in the clear.

One further limit, stated plainly because you should hear it from me rather than discover it: the ZIP format encrypts file contents, not the archive’s structure. Anyone who intercepts the message can still see how many files are inside and their rough sizes and timestamps — though not their names, which are replaced with neutral placeholders, and not their contents. If that metadata alone would tell someone something you need kept private, this feature is not the right tool for that message.

Community Spam Intelligence (Opt-In Only)

If you choose to enable Community Spam Intelligence in Settings, GravesMail will periodically send anonymous spam filter data. This consists of word-frequency scores only — words paired with numbers indicating spam correlation. No email content, addresses, contacts, or identifying information is ever included.

The data is anonymous and cannot be used to reconstruct your emails or identify you. You can preview exactly what would be sent before enabling. You can disable it at any time.

Five Platform Builds

• Windows — code signed by Luke Graves via Microsoft Azure Code Signing
• Linux — obfuscated code, AES-256 encrypted training data
• macOS — obfuscated code, AES-256 encrypted training data
• iOS — obfuscated code, AES-256 encrypted training data
• Android — obfuscated code, AES-256 encrypted training data

All five platforms have identical privacy characteristics. No platform sends data home or behaves differently with respect to privacy. One capability genuinely differs by platform, and it is a detection limit rather than a privacy one: the System AV Protection Layer uses your installed antivirus on Windows and is not available on macOS, Linux, or mobile, where it reports “not available” instead of implying a scan it never ran.

Third-Party Services

GravesMail connects only to your email provider (over encrypted TLS/SSL connections) and, for Microsoft accounts, the Microsoft Identity Platform for OAuth2 authentication. GravesMail does not use any advertising networks, analytics services, crash reporting services, or tracking platforms.

Open for Inspection

Your database, backup files, and deletion log are all ordinary local files under your control — on your disk, in your user profile, where you can see them, copy them, or delete them. Nothing is hidden in a service you cannot inspect, and nothing phones home.

Children’s Privacy

GravesMail does not knowingly collect any information from anyone, including children under 13. Since GravesMail does not collect personal information by default, it does not present specific risks to children’s privacy.

Changes to This Policy

If this privacy policy is updated, the changes will be posted on this page with a new “Last updated” date. Since GravesMail does not collect email addresses or contact information, I cannot notify you directly of changes. I encourage you to check this page periodically.

Contact

Summary