Privacy policy
Last updated 2 November 2026
Postreed is a mail app made by Embrace Technologies Ltd, a company registered in Ghana ("we", "us"). This policy covers the Postreed apps and this website. In short: Postreed runs on your devices and talks straight to your mail provider. We do not receive, read, store or sell your mail.
Google user data. Postreed's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What the app does with your mail
When you add an account, Postreed connects from your device directly to your provider: Gmail, Outlook, iCloud or any IMAP and SMTP server. It downloads your messages so you can read, search, sort, reply and send. Your mail, attachments and search index are stored only on your device, in the app's local database. No copy goes to us.
Signing in
For Gmail and Outlook, Postreed opens your browser to Google's or Microsoft's own sign-in page. We never see your password. The provider gives the app an access token, which is kept in your device's secure storage (the macOS Keychain, or the iOS and Android secure store) and is used only to reach your mailbox. For other providers, the password or app password you type is kept in the same secure storage.
Google user data
If you add a Google account, Postreed asks for these permissions:
| Permission | Why Postreed needs it |
|---|---|
https://mail.google.com/ | To read, search, organise, move, delete and send mail in your Gmail mailbox from inside the app. This is the core of a full mail client. |
openid, email | To confirm which Google account you signed in with, so it matches the address you entered. |
Your Gmail data (messages, labels and the addresses in them) is used only to provide the mail features you see in the app. Specifically:
- It is processed on your device and is not sent to Embrace Technologies or stored on our servers.
- It is not used for advertising, including retargeting, personalised or interest-based ads.
- It is not sold, and it is not transferred to anyone except as described in this policy: to provide the features you use, when you choose to send it (see AI features below), for security, or to comply with the law.
- No person at Embrace Technologies reads it, unless you give us permission for specific messages (for example, when asking for support), it is needed for security such as investigating abuse, or the law requires it.
- It is not used to train AI or machine-learning models, ours or anyone else's.
Syncing between your devices
If you pair a second device, Postreed keeps your accounts and settings in step through our sync relay at sync.postreed.app. Message content is never synced; each device downloads its own mail from your provider.
- What is synced: your settings and your account setup. By default this includes sign-in credentials, so a new device does not have to sign in again; for a Google account that means its OAuth tokens. You can turn off the switch that sends account passwords to paired devices, and each device will then ask you to sign in on its own.
- End-to-end encryption: every record is encrypted and signed on your device with keys that never leave your devices. The relay stores only these encrypted records and cannot read them. We cannot read them either.
- What the relay can see: your devices' IP addresses, device names and platforms, device IDs and public keys, and the size, number and timing of the encrypted records. We use this only to run the service.
- Retention: records stay until your devices replace or remove them. Relay backups are kept for up to 30 days. To have your sync data deleted, email us (see below).
Sync is optional. If you never pair a device, nothing is sent to the relay.
AI features
AI features are optional and use a provider you choose: Anthropic, OpenAI, Google Gemini, your own server, or a model running on your own computer. You supply the API key. Postreed sends the message text, sender, recipients, date, subject and attachment names (never the attachment files) directly from your device to that provider when:
- you ask for it, for example to summarise a message or draft a reply, or
- you create a workflow that uses AI. That workflow then runs on new mail that matches it until you pause or delete it.
That data is handled by your chosen provider under their terms. It does not pass through us. For Gmail, this transfer happens only because you turned on that feature, and the Limited Use requirements above still apply. The iPhone and Android apps do not send mail to any AI provider.
Agent access (MCP)
On Mac, you can let AI tools on your computer, such as Claude Desktop, work with your mail through Postreed. It is off by default. When you turn it on, each tool needs its own token, the connection stays on your computer (no network port is opened), and sending always needs your confirmation in the app. Credentials and raw message source are never exposed. What a tool reads goes to that tool's own AI provider under its terms. Postreed keeps a local log of agent actions for 90 days by default.
Other connections the app makes
- Remote images and sender logos: blocked by default. If you allow them, the app loads images from the sender's servers and may look up sender logos (BIMI records, and Gravatar using a one-way hash of the sender's address).
- Account setup: to find your server settings, the app looks up your email domain's public DNS and autoconfiguration records.
- Unsubscribe: when you press Unsubscribe, the app contacts the address the sender provided for that.
- Updates (Mac): the app checks
updates.postreed.appfor new versions. You can turn automatic checks off in Settings.
What we do not do
Postreed contains no analytics, advertising or crash-reporting code, and it does not track you across apps or websites. This website sets no cookies and uses no analytics. It loads its typeface from Google Fonts.
Deleting your data
- On your device: removing an account in Postreed deletes its downloaded mail, search index, attachments and stored credentials from that device. Deleting the app removes everything it stored.
- Google access: you can revoke Postreed's access to your Google account at any time at myaccount.google.com/permissions. For a Microsoft account, use account.live.com/consent/Manage or your organisation's settings.
- Sync relay: email [email protected] and we will delete your encrypted sync records within 30 days, including from backups.
Security
Connections to mail providers and to the relay use TLS. Credentials are kept in the operating system's secure storage. Sync data is end-to-end encrypted. On Mac, your mail database is protected by macOS file permissions, and by FileVault if you use it. On iPhone and Android it is protected by the system's app sandbox.
Children
Postreed is not directed at children under 13, and we do not knowingly collect their information.
Your rights
Under Ghana's Data Protection Act, 2012 (Act 843), and similar laws where you live, such as the GDPR, you can ask what data we hold about you and ask us to correct or delete it. Because your mail stays on your devices, the only data we hold is the encrypted sync data and anything you send us by email.
Changes
If we change this policy, we will update the date above and post the new version here before it takes effect. We will not use Google user data in a new way without asking for your consent.
Contact
Embrace Technologies Ltd, Ghana. Email [email protected].