This policy covers the frostyard.org website and Frostmail, the Frostyard mail client. It says what data each one handles, where the data goes, and how you remove it. Problem reports have their own privacy page.
Effective date: .
The frostyard.org website
- The site has no accounts and no forms. It sets no cookies. It loads no analytics, advertising or tracking scripts.
- Cloudflare hosts the site. Cloudflare processes each request, with your IP address, to serve the page and to protect the site. Cloudflare's dashboard shows us total traffic counts.
- Pages outside
/docs/load the Inter font from Google Fonts. Your browser fetches it from Google, which gets your IP address.
Frostmail and Google user data
Frostmail is a mail client for Linux and Windows. It runs on your computer. Frostmail's daemon, maild, connects from your computer to your mail provider. Frostyard runs no server between Frostmail and Google, and Frostyard never receives your Google data.
What Frostmail accesses
When you add a Google account, Frostmail signs in with Google OAuth. It asks for the Gmail scope, and for the scope of each other service that you turn on. When you add a Gmail account, you choose Contacts, Calendars and Tasks. All 3 start checked.
No Frostmail release includes a Frostyard Google client yet. Until one does, you sign in with a Google client that you create in your own Google Cloud project, and Google shows the app name of that project's OAuth consent screen (Google Auth Platform > Branding), at sign-in and in your Google Account. It does not show the name of the OAuth client. The scopes, the storage and the promises on this page are the same for both clients.
| Scope | Service | Use |
|---|---|---|
https://mail.google.com/ | Gmail | Read, search, move, delete and send your mail over IMAP and SMTP. |
https://www.googleapis.com/auth/carddav | Contacts | Read and edit your Google contacts over CardDAV. |
https://www.googleapis.com/auth/calendar | Calendars | Read and edit your events and invitations over CalDAV. |
https://www.googleapis.com/auth/tasks | Tasks | Read and edit your Google Tasks lists. |
Frostmail asks for no other Google scope. It does not ask for your Google profile.
How Frostmail uses the data
Frostmail uses your Google data only to show it to you, to search it, and to do what you ask: send, file or delete a message, edit a contact or an event, answer an invitation, or complete a task. Frostmail does not use Google data for advertising. Frostyard does not sell it, and does not use it to train AI or machine-learning models.
Where Frostmail keeps it
- Mail, contacts, calendars and tasks stay on your computer, in a SQLite database with a search index, and in message files beside it. The database is not encrypted. The folders are:
- The Flatpak on Linux:
~/.var/app/org.frostyard.Frostmail/. - A build from source on Linux:
~/.local/share/frostmailand~/.cache/frostmail. - Windows:
%LOCALAPPDATA%\Frostmail\Dataand%LOCALAPPDATA%\Frostmail\Cache.
- The Flatpak on Linux:
- Tokens and passwords. Frostmail keeps the access token in memory only. It keeps the refresh token, any app password, and your own Google client secret in a secrets store:
- On a Linux desktop, the desktop keyring (the Secret Service).
- On Windows, the file
secrets.dpapi, sealed for your Windows sign-in. - On a lodge host, the file
secrets.sealed, encrypted with AES-256-GCM under a systemd credential. - With
FROSTMAIL_SECRETS=file, which you set yourself, the filesecrets.jsonbeside the database. This file is not encrypted: it holds the secrets as plain text. On Linux, only your user can read it (mode 0600). On Windows, the permissions of your user profile folder protect it. A build from source falls back to this file when the desktop has no keyring. The Flatpak never does.
What leaves your computer
- Your mail provider. Frostmail talks to Google's servers:
imap.gmail.com,smtp.gmail.com, and Google's CardDAV, CalDAV, Tasks and OAuth endpoints. Mail that you send goes to its recipients through Google. - Remote images. Remote content in a message stays blocked until you choose Load Remote Content. Then Frostmail fetches it from the hosts that the message names, with no cookies and no
Referer, and follows up to 3 redirects to other hosts. Frostmail does not fetch an image URL that it recognizes as a tracker, but it does not check the target of a redirect. - Unsubscribe. Frostmail contacts a sender to unsubscribe only when you click.
- Account setup. For a provider that Frostmail does not know, setup asks the domain's own autoconfig server for its settings, with your address, and Thunderbird's ISPDB, with the domain only, and it looks up the domain's DNS SRV records. A
gmail.comorgooglemail.comaddress skips this step. - lodge, if you choose it. lodge is a server that you run on your own host. If you connect Frostmail to it in Settings, the app uses a
maildon that host, and your mail data lives there. Nothing turns this on for you. - Agents on your lodge host, if you allow them. On a lodge host, an agent with an agent token that you issue in lodge can read your mail, contacts, calendars and tasks. A token with the
;writescope also lets the agent flag and move messages, write drafts, create and complete tasks, and set Remind Me. A token with the;sendscope also lets it send a draft. Porter, the lodge assistant, gets a;writetoken: it can flag, move and draft mail and create and complete tasks, but it cannot send mail. Porter sends its prompts, which can hold your data, to the model that you configure in lodge: a local model, or a model provider that you choose. That provider handles the text under its own terms. The Flatpak on its own, with no lodge, has no agent access. - Problem records. Frostmail writes its own errors to the systemd journal on your computer, and sends nothing. On a Frostyard image, ChairLift sends a problem report only after you turn reporting on. A report holds no mail or Google data. See Problem reports.
Frostmail has no analytics, no telemetry and no ads. Frostyard does not sell, rent or transfer your Google data to anyone.
Limited Use
Frostmail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoke access and delete your data
- Revoke access. Open your Google Account, then Security > Your connections to third-party apps & services (myaccount.google.com/connections). Select Frostmail, or the app name of your own OAuth consent screen, and remove its access. Frostmail then cannot reach your Google data.
- Remove an account. In Frostmail, choose Settings > Accounts > Remove Account, or run
mailctl account rm ID. Frostmail deletes the account's messages, contacts, events and tasks from its database, and tries to delete its password and refresh token. The message files in the data folder, the cache, and the names and organizations in the People list can stay. To remove them, delete all local data as below. The mail on Google's servers does not change. - Delete all local data. Quit Frostmail, and keep it closed until you finish: an open app starts
maildagain. Then stopmaild, so that it does not write the files again:- The Flatpak: run
flatpak kill org.frostyard.Frostmail, thenflatpak uninstall --delete-data org.frostyard.Frostmail. Its keyring items stay;secret-tool clear application org.frostyard.Frostmailremoves them. - A build from source on Linux: run
systemctl --user disable --now maild.service, andmailctl shutdownfor amaildthat you started by hand. Then delete~/.local/share/frostmailand~/.cache/frostmail. Its keyring items stay;secret-tool clear application frostmailremoves them. Its log lines are in the systemd journal, which drops them by its own retention. - Windows: run
maild -autostart off, so that it does not start at sign-in, andmailctl shutdown, and check that both succeed. Then delete%LOCALAPPDATA%\Frostmail\Dataand%LOCALAPPDATA%\Frostmail\Cache. The secrets file is inData. - A lodge host: its data is apart from your desktop's, and deleting the desktop's folders does not touch it. On the host, stop
frostmail.service, and delete/var/lib/frostmailand/var/cache/frostmail. The secrets file is in/var/lib/frostmail.
- The Flatpak: run
Problem reports
Frostyard images and ChairLift can send short problem reports after you turn reporting on. Problem reports says what a report holds, how long it is kept, and your rights.
Contact
Controller: Frostyard Privacy Admin
Questions about this policy: privacy@frostyard.org
Changes
When this policy changes, the effective date changes with it. The history of this page is in frostyard/frostyard-org.
Source
Frostmail is open source. These facts come from its release v0.7.0.
- Google scopes: the scopes and the Google endpoints; internal/oauth/manager.go asks only for the scopes of the services that are on.
- Providers: the Gmail, CardDAV, CalDAV and Tasks servers.
- Storage: the database, the message files and the cache.
- Secrets: every secrets store, and what an account removal deletes.
- The Flatpak's data: where the Flatpak keeps its data and its keyring items.
- Remote content: remote images stay blocked until you load them.
- Setup: the servers that account setup asks.
- Unsubscribe: nothing is sent without your click.
- lodge: maild on a lodge host, and the agent tools.
- Agent tools: what Porter reads, and its token.
- Problem records: problems go to the local journal only.