PostForged — Privacy Policy

Last updated: 2026-10-02

PostForged is a personal email client that connects directly to your own email accounts (Google / Gmail and Microsoft / Outlook) and shows your mail in one unified, tag-based stream. The short version: your email content never passes through our servers. The only thing we hold is the push registration described below. A few optional features send something from your device straight to an outside service, and each one is listed under “Third-party services”.

Who we are

PostForged is published by Vivid Software LLC (VSBIE), 4570 Gulf Breeze Pkwy, Gulf Breeze, FL 32563. Contact: [email protected].

No backend, no data collection

PostForged runs entirely on your device and talks directly to Google and Microsoft over their official, encrypted APIs. There is no PostForged server in the middle.

• We never receive, store, read, or transmit your email content.
• We have no analytics server and no ad network. The only data we store is the push registration described under “Push notifications” below.
• We do not sell, share, rent, or monetize your data. Ever.

What is stored, and where

Everything PostForged stores lives only on your device:

You can erase all of it any time from Settings → Privacy → Erase all data, which permanently deletes the local data and disconnects your mailboxes.

Permissions we request, and why

When you connect a mailbox, your provider (Google or Microsoft) asks you to grant access. We request the minimum needed to be a functioning mail client:

• Read your mail — to display it.
• Send mail — to compose, reply, and forward.
• Modify / labels (read-write) — to mark read, archive, and file with tags.
• Calendar events (calendar.events) — to create invitations you attach to a message and show your own upcoming events. We do not request calendar settings or sharing access.
• Contact suggestions — built locally from mail you have already received. We request no contacts permission.

You grant these directly to your provider through their own secure sign-in window. PostForged never sees or stores your email password. You can revoke access at any time in your Google or Microsoft account security settings.

Optional AI features (bring your own key)

AI features are optional and off until you link a provider. You choose Google Gemini, OpenAI or Anthropic and supply your own API key. The key stays on your device, and every request goes from your device directly to that provider. We never see your key or the text you send.

What each feature sends, and only when you tap it:

• Summarize: the message's subject, the sender's name and up to 6,000 characters of its text.
• Suggest tags: the subject, the sender's name, up to 2,000 characters of the message, and your tag names.
• AI help with a draft: the draft you are writing and your instruction.

The provider's own terms for your key decide what it keeps. Some free tiers, Gemini's among them, let the provider use what you send to improve its products. A paid key usually doesn't.

Google user data — Limited Use disclosure

PostForged's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we request and why. With your permission PostForged uses gmail.modify to show your messages and let you mark them read/unread, tag, archive and delete them; gmail.send to send only the messages you write and send yourself; and calendar.events to create an invitation you attach to a message and to show your own upcoming events. We request nothing we do not use.

Where your mail lives. Your device talks to Google directly, using your own credentials. Message content, attachments, contacts and calendar entries are stored only on your device. We operate no mail server, database, search index or backup, and we keep no copy of your mail. Because your mail never reaches any system we control, no employee or contractor of ours can read it.

Specifically, we do not:

• transfer Google user data to third parties, except to run a feature you choose (the AI provider you linked, when you tap an AI button; LanguageTool, when you tap “Fix writing”; unavatar.io, if you turn Sender avatars on), as required by law, or as necessary for security operations;
• use Google user data for advertising of any kind, or serve ads at all;
• sell Google user data — we sell software subscriptions only;
• allow humans to read your Google user data, except with your explicit consent for a support issue you raise, to comply with law, or for security purposes such as investigating abuse;
• use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models. AI features are off by default and use a provider and key you supply. When you tap Summarize, the subject, the sender's name and up to 6,000 characters of that message go from your device to that provider, and nothing else is sent.

Push notifications. To tell your device that new mail has arrived, we operate one small service that stores only your email address paired with your device's push token. Google's notification tells us a mailbox changed — it contains no sender, subject or message content — and we send your device a generic "New mail" alert. Your device then fetches the message from Google itself. We store no messages, no message metadata, and no Google tokens. When you register a device we briefly receive a short-lived access token solely to confirm you control that mailbox; it is used once, in memory, and discarded — never written to disk or logged.

Revoking access and deleting data. Disconnecting a mailbox in PostForged deletes that account's cached mail from your device, removes its saved credentials from your operating system's keychain, and deletes its push registration from us. Deleting the app removes all remaining local data. You can revoke PostForged's access at any time at myaccount.google.com/permissions.

Third-party services

PostForged talks to a small number of outside services. Only the AI provider and LanguageTool ever receive message text, and only when you tap their buttons. This is the complete list:

We receive no payment, data, or benefit from any of these lookups, and none of them are used for advertising, profiling, or tracking you across apps or websites.

Settings sync

If you use PostForged on more than one device, your settings (tags, rules, signatures, category photos) are synced by writing a hidden message to yourself, inside your own mailbox. It never passes through us, and we operate no settings server. Deleting that message simply stops the sync.

Data retention

Push registrations (email address + device token) are kept while the mailbox is connected, and are deleted when you disconnect it, when the app is removed, or automatically when Apple reports the device token is no longer valid. Registrations inactive for more than 12 months are purged.

Who processes data on our behalf

The push endpoint runs on Vercel with a Supabase Postgres database, and delivers through Apple's Push Notification service. Those three handle the push registration described above. They never receive your mail.

Security incidents

If we ever discover a breach affecting the push registration data, we will notify affected users by email at the address registered, and any applicable regulator, without undue delay and within 72 hours of becoming aware.

Children

PostForged is not directed to children under 13, and we do not knowingly collect data from anyone under 13.

Changes

If this policy changes we'll update the date above and note it in the app's release notes.

Contact

[email protected]