Otter Mail
OverviewChangelogPrivacyTerms
Download

Privacy Policy

Last updated: November 2, 2026

Otter Mail is an email app for Gmail, Outlook and IMAP mailboxes, on macOS, Linux, iPhone and the web, made by Christophe Kafrouni under the Otterware name. This policy explains what data Otter Mail accesses, where it goes, and what control you have. Otter Mail fetches and caches mail on your device. If you choose to use the OpenRouter agent, your chat and mail returned by its tools are processed and stored on our server and sent to OpenRouter and the selected model provider (see below). If you sign in to an Otter account, our server also learns which mailbox addresses you use and when they change. In the web app, it handles your Google and Microsoft sign-ins.

Data Otter Mail accesses from your Google Account

When you sign in with Google, you choose to give Otter Mail access to:

  • Gmail (https://mail.google.com/): to read, search, send, label, archive and delete your mail, and to manage drafts and labels, as you do in the app.
  • Gmail settings (gmail.settings.basic): to save the signature you edit in Otter Mail to your Gmail account, so it's the same in Gmail. Otter Mail changes no other Gmail setting.
  • Contacts (contacts.readonly, contacts.other.readonly): to show the photos and names of people you correspond with, and to suggest recipients as you type.
  • Calendar events (calendar.events.owned): to show calendar invitations you receive by email and to record your reply on your own primary calendar when you accept or decline. If you use an agent, its calendar tools can also list, read, create, edit and delete events on that primary calendar when you ask. Write tools request approval in the default supervised mode.
  • Basic profile (openid, email, profile): to know which account you added and to show its name and picture.

Otter Mail for iOS asks only for Gmail, Gmail settings and your basic profile: it has no calendar or contacts features. If you turn on background notifications for a Gmail mailbox on iPhone, you give our server a separate, narrower grant (gmail.metadata); see "Background notifications on iPhone" below.

Data Otter Mail accesses from your Microsoft account

When you add an Outlook mailbox (Microsoft 365, outlook.com, hotmail.com or live.com), you choose to give Otter Mail access, through Microsoft Graph, to:

  • Mail (Mail.ReadWrite, Mail.Send): to read, search, send, move, categorize and delete your mail, and to manage drafts and folders, as you do in the app.
  • Mailbox settings (MailboxSettings.ReadWrite): to read and manage your Outlook categories.
  • Calendar (Calendars.ReadWrite): to answer calendar invitations you receive by email and, if you use an agent, to list, read, create, edit and delete events when you ask. Write tools request approval in the default supervised mode.
  • Basic profile (User.Read) and offline_access: to know which account you added, and to stay signed in.

IMAP mailboxes

For an IMAP mailbox, Otter Mail connects to the mail server you name with the address and password you enter. The password is kept on that device (in the system's secure storage) and is not synced to your other devices. In the web app, a browser can't open a mail connection itself, so our server forwards the connection's bytes to your mail server; the encryption is negotiated in your browser, so our server carries only encrypted data and logs only the host, port and amount of data.

How the data is used and stored

  • Otterware uses data from Google, Microsoft and your mail servers only to provide Otter Mail's features to you. We do not sell it, use it for advertising, or use it to train artificial intelligence models. Optional agents process the content you provide and the content returned by their tools, as described below.
  • Your mail, labels and contact details are stored in a local database on your device, so the app is fast. On a Mac or Linux computer it stays in the Otter Mail folder in your home directory (~/.otter-mail); in the web app, in your browser's storage for this site. It stays until you remove the account or delete the app's data.
  • In the desktop app, Google and Microsoft sign-in tokens and IMAP passwords are stored on your computer, encrypted with a key kept in your macOS Keychain or, on Linux, your desktop's keyring (or, without one, sealed with an app key). In the web app, see "The web app" below.
  • Translation of foreign-language mail (Mac app) uses Apple's on-device translator. The text does not leave your Mac.
  • No analytics, tracking or crash reports are collected.

The Otter account (optional)

An Otter account (optional in the Mac app, required for the web app) brings your mailboxes, preferences and agent chats to every device you use and delivers new mail the moment it arrives. For this, Otter Mail's server at relay.mail.otterware.app (run on Cloudflare) stores:

  • the ID, address, name and picture of the account you sign in to Otter with (Google, Microsoft or an email and password), to know who is signed in;
  • the address, name and picture of each mailbox you use in Otter Mail, its provider (and, for IMAP, its server settings, never its password unless you turn on iPhone background notifications for it), and the display name and color you gave it;
  • for each signed-in device, its session (a random sign-in token), when it was last used, its browser or Mac name and its IP address, so you can see and sign out your devices;
  • your preferences: app settings, saved views, keyboard shortcuts, the theme and the agent's settings, and, if you connect the Hermes agent, its address and API key, which is stored encrypted;
  • your agent chats, whichever agent ran them (OpenRouter, Claude, Codex, Hermes or OpenClaw): what you asked, what the agent answered and the steps it took, including the mail it read or wrote for you (long results are shortened); the conversations, drafts, pages and files each chat opened; which agent it used; and, for a chat run by Claude or Codex, the name of the Mac it ran on. Deleting a chat deletes all of this.

To deliver new mail instantly, Gmail (through Google Cloud Pub/Sub) and Outlook (through a Microsoft Graph subscription) notify this server whenever one of your mailboxes changes. The notification contains only the address and identifiers of what changed, never the content of your mail; the server passes it on to your devices, which then fetch the change from Gmail or Outlook themselves. Notifications are not stored. This notification path does not send mail content to our server. Your agent chats (above) and the optional OpenRouter agent (below) are the only ways mail content reaches it.

Background notifications on iPhone (optional)

To alert your iPhone to new mail while Otter Mail is closed, you can connect a mailbox to background notifications (Settings → Mailboxes → the mailbox). Our server then watches that mailbox for new mail and checks that a message is new and unread before alerting your devices. For this it keeps, encrypted:

  • for Gmail, a separate grant limited to message metadata (gmail.metadata); the server asks only for message IDs, labels and history, never headers or content;
  • for Outlook, a separate grant with Mail.ReadBasic, User.Read and offline_access, apart from the app's own sign-in;
  • for IMAP, the mailbox's password, which you agree to store with us when you connect it. It allows reading the mailbox, but the server reads only message numbers, flags, dates and the Message-ID header, kept only as a one-way hash to avoid repeat alerts.

The alert sent through Apple's push service carries only a generic "New mail" text and identifiers, never the sender, subject or content. Your iPhone then fetches the message directly from Gmail, Outlook or your mail server to show its sender, subject and a short preview. Our server keeps no copy of your mail. Turning background notifications off, removing the mailbox or deleting your Otter account deletes the grant or password and stops the watch.

The OpenRouter agent (optional)

You connect the agent with your own OpenRouter API key and use your own OpenRouter account for billing. We store the key encrypted on Cloudflare, where Otter Mail's server can decrypt it to make your requests. We do not send the key back to your devices.

When you use this agent, our server runs the agent and receives your prompts, attached files and mail or calendar data returned by tools on your connected device. Tool results can include senders, recipients, subjects, message bodies, previews, attachments and event titles, times, locations, descriptions and attendees. We send the relevant conversation to OpenRouter and the selected model provider. Mailbox passwords and Gmail tokens are not sent to the agent server. The agent requires a connected app to access mail and does not independently sync your entire mailbox.

We store chat history and tool results on Cloudflare so you can resume the chat on another device. This history is not end-to-end encrypted: our server can read it. It remains until you delete the chat or your Otter account. Disconnecting OpenRouter deletes your saved key; signing out or removing a mailbox does not delete existing chat history.

We request OpenRouter providers that do not collect user data. OpenRouter and the model provider still process the request under their own policies. You can review OpenRouter's privacy policy and the selected provider's policy before using the agent. Nothing is sent to this agent unless you use it.

The web app

In a browser, your mail is fetched from Gmail, Outlook or your mail server by your browser and cached in the browser's own storage for this site, which you can clear at any time (it is also removed when you delete your browsing data). A browser can't keep a lasting Google or Microsoft sign-in on its own, so when you add a Gmail or Outlook mailbox in the web app, our server completes the sign-in and refreshes it when needed: your tokens pass through our server, but it does not store them. The long-lived token is encrypted by our server and kept only in your browser. In the desktop app, Google and Microsoft tokens never reach our server. IMAP connections from the web app pass through our server encrypted, as described under "IMAP mailboxes" above.

When data leaves your device

Otter Mail connects directly from your device to:

  • Google (Gmail, People, Calendar and sign-in services), Microsoft (Microsoft Graph and sign-in services) and your IMAP mail servers, for the mailboxes you add, to do what you ask in the app.
  • Image and icon services, to show sender pictures: Gravatar receives a one-way hash of a sender's email address, and Google's and DuckDuckGo's favicon services receive the domain of a sender's email address (never for personal addresses such as gmail.com). Images inside emails are downloaded from the servers the sender chose, as in any mail app.
  • Links you choose to open, such as unsubscribe links, which are sent to the sender's own servers.
  • Your agent, only if you set one up. The optional agent runs through a provider you install or configure and sign in to yourself (Claude Code, Codex, Hermes or OpenClaw). When you ask it something, the messages, mail content and calendar details it needs are sent to that provider under your own account with them, and are subject to that provider's privacy policy. Nothing is sent to an agent unless you use it.
  • Otter Mail's server, if you sign in to an Otter account, and OpenRouter and the selected model provider, when you use the optional OpenRouter agent (see above).
  • GitHub, to check for app updates. This shares only your IP address and the app version, as any download does.

Otter Mail shares Google data only for the features and services described in this policy.

Google API Services User Data Policy

Otter Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

  • Removing a mailbox in Otter Mail (Settings → Mailboxes) deletes its local copy of your mail and its sign-in from your device. Nothing is deleted from your mailbox itself.
  • You can revoke Otter Mail's access at any time at myaccount.google.com/permissions (Google), or account.live.com/consent/Manage (personal Microsoft accounts) and myapplications.microsoft.com (work or school accounts).
  • Deleting the ~/.otter-mail folder (Mac and Linux), or this site's data in your browser (web), removes all of the app's data on that device.
  • Signing out of your Otter account ends that device's session. Delete an agent chat to remove its server-side history. Deleting your Otter account removes the agent key and histories along with the account's other stored data. Contact us at the address below if you need help deleting your account.

Children

Otter Mail is not directed at children under 13.

Changes

If this policy changes, the new version will be published on this page with a new date.

Contact

Questions about privacy: chris.kafrouni@gmail.com.