Privacy Policy

Your email stays in Gmail. PonyMail is a viewer and composer: it reads mail from Google’s API on demand and renders it in your browser. We do not copy your mailbox onto our servers, we do not sell personal data, and we do not use your mail for advertising or to train AI models.

• Account identity (your Google account ID and email address) — to sign you in and link your session to your connection. Legal basis: performance of a contract. Retained until you delete your account.
• Gmail access credentials — an encrypted (AES-256-GCM) connection key held by our authorised connector provider so we can call the Gmail API on your behalf. Legal basis: performance of a contract. Deleted immediately when you disconnect.
• Contact autocomplete cache — names and email addresses drawn from mail you send and receive, with counts and timestamps, so recipient fields autocomplete. Legal basis: legitimate interests in providing a usable mail client. Deleted on request or on account deletion.
• Your settings — blocked senders/domains and snoozed conversations with their wake times. Legal basis: performance of a contract. Deleted on account deletion.
• Technical logs — transient error and request logs used to keep the Service running and secure. Legal basis: legitimate interests. Kept for a short period, normally no longer than 30 days.

Message bodies, attachments, and thread contents are fetched live and cached only in your browser’s memory for the current session. They are not written to our database.

PonyMail’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the scopes needed to read, compose, send, and organise your mail and to resolve contacts. You can revoke access at any time in your Google account permissions.

• Google LLC — the source of your mail data.
• Our hosting, database, and authentication provider — stores the data listed above.
• Our OAuth connector provider — holds the encrypted Gmail connection key.
• Public avatar lookups (BIMI DNS records, Gravatar, favicon services) — a sender’s domain or hashed email address may be sent to retrieve a sender image.

We do not sell or share personal data for cross-context behavioural advertising. We use no advertising or analytics trackers.

PonyMail sets only strictly necessary storage: a session token that keeps you signed in and local preferences such as pane widths. No consent banner is required because we set no analytics, advertising, or profiling cookies.

Our providers may process data in the United States and other countries. Where data leaves the EEA or UK, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

Connection keys are encrypted at rest with AES-256-GCM, transport is TLS-encrypted, and row-level security restricts every record to its owner. No system is perfectly secure; see the Terms for the risk allocation.

If you are in the EEA, UK, or Switzerland you have the right to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority.

You can exercise access, portability, and erasure instantly using the buttons below while signed in, or email mike@olliepips.com. We respond within 30 days. Deleting your data also revokes PonyMail’s access to your Gmail.

California residents have the right to know, delete, and correct personal information, to data portability, and to non-discrimination for exercising these rights.

We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of — including for consumers under 16. We also do not use sensitive personal information for purposes requiring a limitation right. We honour Global Privacy Control signals by default as a matter of policy.

To exercise your rights, use the export or delete controls above, or email mike@olliepips.com. You may designate an authorised agent; we may ask you to verify identity via your signed-in account.

PonyMail is not directed to children under 16, and we do not knowingly collect their data.

We will update the “last updated” date above when this policy changes and, for material changes, notify you in the app.