Privacy policy
Last updated October 2026
OpenMail is a connector that lets AI agents read your email through the Model Context Protocol (MCP). It is read-only by default; it sends email only from a mailbox where you turned sending on, and only messages you approve. This page explains what OpenMail keeps and what it does not.
What we store
- Your OpenMail login email and a one-way (Argon2id) hash of your password.
- For each mailbox you add: a name, the mailbox address and username, the provider and server settings, and the mailbox password encrypted with AES-256-GCM using a key unique to your account.
- API keys as one-way SHA-256 hashes, with a short prefix, name, and created and last-used times so you can tell them apart.
- Session records for signed-in browsers, which expire after seven days.
- A send log for each email sent through OpenMail: time, mailbox label, recipient count, status, message id and which connection sent it. It holds no message body, subject or addresses.
- For apps you connect with “Sign in with OpenMail” (OAuth): the app's name, its redirect address and, if it identifies itself with a public metadata document, a cached copy of that document; plus the connection (when you approved it and last used it) and its access and refresh tokens as one-way SHA-256 hashes.
What we do not store
- Email messages, attachments, subjects, or contacts. They are fetched from your provider when your agent asks and passed straight back to it.
- Plain-text passwords, API keys or OAuth tokens. They are never written to logs.
What OpenMail returns to your assistant
When an assistant you connected calls OpenMail, it can receive:
- For each mailbox: its name, address, provider preset, IMAP server name and an internal account ID.
- For each message: sender and recipient names and addresses, subject, date, message ID, read and flag status, size, the message text, and attachment names, types and sizes. Attachment files themselves are never returned.
- Folder names with message and unread counts.
Nothing else about you is returned. Mailbox passwords and your OpenMail password are never returned.
How your data is used
Mailbox credentials are used only to sign in to your provider when you, or an agent holding one of your API keys or an app you approved, make a request. OpenMail does not sell, share, or analyse your data, and does not use it for advertising, profiling or training models.
Your agent
Messages OpenMail returns go to the agent you connected. How that agent and its provider handle them is covered by their own policies.
Sending email
Sending is off until you turn it on for a mailbox and allow it for the connection. When you approve an email, OpenMail delivers it through your own mail provider's SMTP server to the recipients you approved, and tries to save a copy in your Sent folder. OpenMail does not keep the message.
Where your data is stored and who helps us run OpenMail
OpenMail runs on a server rented from Contabo GmbH in the European Union. These providers handle limited data for us:
- Contabo GmbH: server hosting, where the database and logs are kept.
- Cloudflare: DNS for openmail.tools, and forwarding of mail sent to support@openmail.tools. Traffic to the service itself does not pass through Cloudflare.
- Google (Gmail): the inbox where support email is read.
- Let's Encrypt: HTTPS certificates. It receives no user data.
Your mail provider is the one you choose. OpenMail connects to it only on your behalf.
How long we keep data
- Email content (messages, subjects, addresses and attachments, read or sent): never stored. It is held in memory only while a request is answered.
- Account and mailbox settings, including encrypted mailbox passwords and an optional separate SMTP password encrypted with its own key binding: kept until you remove the mailbox or delete your account.
- Send log (no message content): kept for 90 days.
- Signed-in browser sessions: 7 days. OAuth access tokens: 1 hour. OAuth refresh tokens: 30 days. API keys: until you revoke them.
- Web server access logs (IP address, time, address requested, browser type and response status; never passwords, tokens or cookies): 14 days, then deleted automatically.
Security
All traffic uses HTTPS. Reading never marks mail as read. Sending is off until you turn it on for a mailbox and allow it for that connection. OpenMail cannot delete, move or flag mail. Revoke an API key, disconnect an app, turn sending off or remove a mailbox from your dashboard at any time, and it stops working immediately.
Deleting your data
Removing a mailbox in your dashboard immediately deletes its stored settings and encrypted password. To delete your whole account, email support@openmail.tools from your login address. We delete it within 30 days, usually much sooner. Deletion removes your login, sessions, API keys, connected apps and every mailbox with its encrypted password from the database at once. OpenMail keeps no other copies.
Requests from authorities
We disclose data only when legally required, share only the minimum needed, and tell the affected user unless we are not allowed to.
Changes
If this policy changes, the date above changes too. Material changes will be announced on this site.