Scope
This policy applies to Karnymail, the desktop application for Windows published by Karnytine Labs LLC (“Karnymail”, “we”, “us”). It covers the information Karnymail handles from the email, calendar, contacts and tasks accounts you connect to it, including Google accounts.
Information Karnytine Labs collects
None. Karnymail runs entirely on your computer. Karnytine Labs does not operate a server that receives, stores or reads your mail, calendars, contacts, tasks or account details. Karnymail has no user accounts with us, no advertising, and no analytics, tracking or crash-reporting services.
Where your data is stored
Karnymail keeps a copy of your mail, calendars, contacts and tasks in a database on your own computer, in your Windows user profile, so you can read and search them. Passwords, app passwords and sign-in tokens are encrypted with Windows' own data protection for your user account. Data travels only between your computer and the services you connected, over encrypted connections.
How your data is protected
Karnymail protects your data, including the Google user data described below, with these measures:
- No copy leaves your computer. Karnytine Labs runs no server that receives your data, so there is no central store of it to be breached. Karnymail includes no analytics, advertising or third-party tracking code.
- Encryption in transit. Every connection to Google's APIs uses HTTPS (TLS). Mail connections must be encrypted with TLS. The only exception is a mail “bridge” program running on your own computer, whose traffic never leaves it.
- Encrypted credentials. Google sign-in tokens, passwords and app passwords are encrypted at rest with Windows' Data Protection API (DPAPI), so only your Windows user account on that computer can decrypt them. Short-lived Google access tokens are kept in memory only and are never written to disk.
- Secure sign-in. Google sign-in happens in your own web browser, so Karnymail never sees your Google password. It uses OAuth 2.0 with PKCE and a one-time state value, and the answer goes only to a temporary address on your own computer.
- Least privilege. Karnymail requests only the Google permissions its features need, as listed below.
- Local storage protected by Windows. The local database and downloaded messages are stored in your Windows user profile, which other non-administrator users of the computer cannot open. They are not separately encrypted by Karnymail. For full encryption at rest, turn on BitLocker or Windows Device Encryption.
- Isolated content. Email content is shown in a sandboxed view. By default, remote images load only in mail from your contacts. Files saved from email are marked as coming from the internet, so Windows' own protections apply to them.
- Signed software. Karnymail's installer and updates are code-signed by Karnytine Labs LLC. The app installs an update only if it carries that signature.
- You stay in control. Removing an account deletes its stored credentials and its local data. You can revoke Google access at any time (see below).
Google account data
If you connect a Google account, you sign in with Google in your web browser and choose what to allow. With your permission, Karnymail uses Google's APIs from your computer to:
- read your email address and name, to identify the account in the app;
- download your Gmail messages and labels so you can read and search them, send the mail you write, save your drafts, and carry out what you do to a message (mark it read or unread, flag it, move or archive it, delete it, or permanently delete it from Trash);
- show your Google calendars and create, edit and delete events, and change each calendar's colour;
- show your Google Contacts and add, edit and delete contacts and contact groups, and suggest addresses when you write mail; and
- show your Google Tasks lists and create, complete, edit and delete tasks and lists.
Gmail access uses Google's https://mail.google.com/ permission, which is what
Gmail requires for the standard IMAP and SMTP mail protocols. Karnymail connects from your
computer directly to Gmail's servers (imap.gmail.com and smtp.gmail.com) over TLS and signs in
with your Google sign-in token; mail never passes through a server of ours. You can instead
connect Gmail with an app password that you create in your Google account and can revoke there
at any time.
Google data is used only to provide these features to you, inside the app on your computer. It is never sent to Karnytine Labs, sold, used for advertising, used to train artificial-intelligence or machine-learning models, or shared with anyone else. Karnytine Labs staff cannot see it.
Limited Use
Karnymail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Karnymail:
- uses Google user data only to provide and improve the user-facing features described above;
- does not transfer Google user data to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users;
- does not use or transfer Google user data for serving advertisements, including personalized or retargeted advertising; and
- does not allow humans to read Google user data, unless you give affirmative consent for specific data (for example, a message you choose to send us for support), it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law.
Other connections Karnymail makes
- Updates: Karnymail checks karnytine.com for new versions and downloads them from there. Like any web request, this reveals your IP address to the web server; no account or mail data is sent.
- Account setup: when you add an account by address, Karnymail may look up your mail provider's server settings from your email domain's own configuration service or Mozilla Thunderbird's public settings directory, which receives the domain.
- Pictures in email: by default, pictures hosted on the internet load only in mail from your contacts. Loading them contacts the sender's server, as in any email app. You can change this in Settings.
Retention and deletion
Data stays on your computer until you remove it. Removing an account in Karnymail's
Settings removes that account and its calendars, contacts, tasks and message list from
the app. To erase every downloaded copy, delete Karnymail's data folder
(%APPDATA%\Karnymail) after uninstalling. You can revoke
Karnymail's access to your Google account at any time at
myaccount.google.com/permissions,
and remove an app password at
myaccount.google.com/apppasswords.
Children's privacy
Karnymail is a general-audience productivity app and is not directed to children under 13. Karnytine Labs does not knowingly collect personal information from children.
Changes to this policy
This policy may be updated when Karnymail or our data practices change. The revised policy will be posted on this page with a new effective date.
Contact
For privacy questions or support, contact support@karnytine.com.