Privacy · Flomsi

No account with us, no analytics, no crash reports, no ads.
Your mail is stored on your device. Passwords and sign-in tokens are kept in the system's credential store.
The app connects to your mail provider, and to Google or Microsoft if you sign in with them. Nothing else, unless you load a message's remote images or open a link.

What this covers

This policy covers the Flomsi apps for macOS, Windows, iOS and Android, the mailctl terminal tool, and this website, flomsi.nz. Flomsi is open-source software, published at github.com/zondaxxx/Flomsi by its maintainers (“we” below). Everything this page says about the apps can be checked against that source code.

What the app keeps on your device

What	Where
Mail	Messages, folders, the search index and cached attachments, in a SQLite database in Flomsi's data folder: `~/.mail_` on macOS, `%USERPROFILE%\.mail_` on Windows, the app's own storage on iOS and Android.
Your settings	Drafts, snoozed conversations, account names, signatures, key preset and theme, in the same database.
Passwords and tokens	Keychain on macOS and iOS, Windows Credential Manager, on Android the app's private storage encrypted with a key held in the Android Keystore, and the Secret Service keyring for `mailctl` on Linux. Never in the database.
Opened files	Attachments you open are written to a folder inside Flomsi's data folder. On a computer, attachments you save go to your Downloads folder; on a phone you share them to another app.

The first sync keeps the newest 200 messages of Inbox, Sent and Archive (All Mail on Gmail), and 50 of Junk and Trash. Older mail is downloaded only when you ask for it.

Flomsi writes no log file of its own. Warnings, such as a folder that failed to sync, go to the system's console log without passwords or message text; mailctl writes an IMAP transcript only when you ask for one with --wire.

On Android, Flomsi opts out of system backup and of moving data to a new phone, so its data stays on that phone. On other systems your own backups, such as Time Machine, iCloud Backup or File History, may include Flomsi's data like any other files on the device.

How long it is kept

Flomsi keeps cached mail, drafts and settings until you remove the account or uninstall the app. Passwords and tokens stay in the credential store until you remove the account; access tokens from Google and Microsoft expire after about an hour and are replaced as needed.

How it is protected

Connections to your provider use TLS. Passwords and tokens are held by the system's credential store. The mail database is not encrypted by Flomsi: it is protected by your device's own encryption, such as FileVault, BitLocker or the phone's storage encryption, and by your account on the device.

What the app sends, and where

Your mail provider. Flomsi connects to each account's IMAP and SMTP servers over TLS or STARTTLS, to fetch mail and to carry out what you do: send, archive, delete, move, star, mark as read. The servers are the ones you enter, or the ones Flomsi fills in from your address.
Google or Microsoft, if you sign in with them. Their sign-in page opens in your browser or in the system's sign-in window. Flomsi receives tokens from them and later asks their token service for fresh ones. From the ID token it reads only your email address.
Remote images, only when you ask. Images from the web are blocked in every message. If you click Load images, that message's images are fetched from the servers they point to, which can then see your IP address and that the message was opened.
Links you click open in your default browser.

Nothing goes to us. Flomsi contains no analytics, crash reporting, advertising or tracking code, and it makes no requests to a Flomsi server, because there is none.

Signing in with Google

When you choose Continue with Google, Flomsi asks for these permissions:

Scope	Why
https://mail.google.com/	Read, send, delete and organise your Gmail over IMAP and SMTP, the protocols Flomsi uses. Google offers no narrower scope for IMAP.
openid, email	Learn which address you signed in with, so the account is added under the right name.

Flomsi uses this access only to show your mail on your device and to do what you ask of it in the app. Data from your Google account is stored only on your device, and in your own backups of it. It is not sent to us or to anyone else, not used for advertising, not sold, and not used to train AI models. No one at the project can read it.

Flomsi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Microsoft

When you choose Sign in with Microsoft, for Outlook, Hotmail or Microsoft 365, Flomsi asks for these permissions:

Scope	Why
https://outlook.office.com/IMAP.AccessAsUser.All	Read and manage your mail over IMAP.
https://outlook.office.com/SMTP.Send	Send mail as you over SMTP.
offline_access	Stay signed in without asking you again, through a refresh token kept in the credential store.
openid, email, profile	Learn which address you signed in with.

The same rules apply as for Google: the access is used on your device, only for what you do in the app, and the data goes nowhere else.

Google and Microsoft sign-in is available in builds made with Flomsi's app registrations. The 0.2.0 downloads were built before those were added and use app passwords only.

Notifications

New-mail notifications are made on your device by Flomsi itself, from mail it has already fetched, and show the sender and the subject, or the first line of the message when it has none. No push service is involved, so a phone gets no notifications while Flomsi is closed. Your system's notification settings decide where they appear, including on the lock screen.

Attachments

Attachments are downloaded from your mail server when you open or save them, unless they came with the message during sync. Files that can run code or open a web page are never opened from Flomsi: after a warning you can save them on a computer, or share them on a phone.

Deleting your data

Remove an account in Settings. Flomsi deletes that account's mail and folders from the database, its cached files, and its password or tokens from the credential store. Mail on the server is not touched.
Uninstall the app. On Android and iOS this removes Flomsi's storage. On iOS, Keychain entries can outlive the app, so remove your accounts first. On macOS and Windows, removing the app leaves the .mail_ folder in your home folder: delete it yourself, after removing your accounts in Settings so the credential store is cleared too.

Revoking access

Removing an account in Flomsi does not withdraw the permission you gave Google or Microsoft. To do that, remove Flomsi at myaccount.google.com/permissions for Google, at account.live.com/consent/Manage for a personal Microsoft account, or at myapps.microsoft.com for a work or school account. An app password is revoked on the provider's page where you created it.

This website

flomsi.nz is a set of static pages. It sets no cookies, runs no analytics, and loads nothing from other sites: fonts, images and scripts are all served from flomsi.nz, and each page's Content Security Policy tells your browser to refuse anything from elsewhere. The live demo on the home page runs in your browser and stores nothing.

The site is served by a server the Flomsi project runs. Its web server keeps no access log, so your visits, IP address and requests are not recorded. Downloads and links to github.com take you to GitHub itself, where GitHub's privacy statement applies.

Changes

If this policy changes, the new version will be published on this page with a new effective date. Earlier versions stay in the repository's history.

Contact

Questions about privacy go to GitHub issues. Please do not post passwords, tokens or the contents of your mail there.