Privacy policy
27 October 2026
Mailbolt is an email client. It connects to a mailbox you already have, at Google, Microsoft, or another IMAP provider. This policy explains what the app accesses and where that information stays.
Who we are
Mailbolt is published at mailbolt.app. Privacy questions go to privacy@mailbolt.app.
Google account data
If you sign in with Google, Mailbolt asks for the address and name on that Google account, and for permission to read, compose, send, and delete mail in that mailbox. The permission requested is https://mail.google.com/, together with the email and profile scopes needed to identify the account.
Mailbolt uses that access only to show your mail and to send mail you write. Google user data is not sold, is not used for advertising, is not used to decide creditworthiness, and is not used to train generalized artificial-intelligence models.
Mailbolt transfers Google user data only to provide the app: to Google, so the mailbox can be read and mail can be sent, and onto the device where you installed Mailbolt. A transfer also happens if you ask for it, if it is required for security, or if the law requires it.
Other mailboxes
For Microsoft 365 and Outlook, Mailbolt asks for permission to read and send mail through that account. For iCloud, Yahoo, AOL, and other IMAP mailboxes, you provide the server address and a password or app password. Those secrets are used only to sign in to that mailbox.
Where data is stored
On the desktop app, messages are cached in a database on your computer so the inbox can open without downloading everything again. Passwords and OAuth refresh tokens are stored in the operating-system credential store, not in that database. Access tokens are requested when Mailbolt connects and are not kept in the database.
Message HTML is sanitized before it is shown, and it is displayed apart from the rest of the app. Images loaded from the internet stay hidden until you allow them for that sender or message.
Mailbolt does not run your mailbox. The provider keeps the original mail. Removing an account from Mailbolt deletes the cached messages from that computer and removes the saved sign-in secret from the credential store.
How long it is kept
The local cache remains until you remove the account or delete the app. You can withdraw Google’s permission at any time from your Google Account permissions. After that, Mailbolt can no longer sign in to that mailbox.
Contact
Write to privacy@mailbolt.app to ask what Mailbolt holds for you or to ask for a correction.