Privacy policy
Last updated October 2026
OpenMail is a connector that lets AI agents read your email through the Model Context Protocol (MCP). This page explains what OpenMail keeps and what it does not.
What we store
- Your OpenMail login email and a one-way (Argon2id) hash of your password.
- For each mailbox you add: a name, the mailbox address and username, the provider and server settings, and the mailbox password encrypted with AES-256-GCM using a key unique to your account.
- API keys as one-way SHA-256 hashes, with a short prefix, name, and created and last-used times so you can tell them apart.
- Session records for signed-in browsers, which expire after seven days.
What we do not store
- Email messages, attachments, subjects, or contacts. They are fetched from your provider when your agent asks and passed straight back to it.
- Plain-text passwords or API keys. They are never written to logs.
How your data is used
Mailbox credentials are used only to sign in to your provider when you, or an agent holding one of your API keys, make a request. OpenMail does not sell, share, or analyse your data, and does not use it for advertising or for training models.
Your agent
Messages OpenMail returns go to the agent you connected. How that agent and its provider handle them is covered by their own policies.
Security
All traffic uses HTTPS. Access is read-only: OpenMail cannot send, delete, move, or flag mail. Revoke an API key or remove a mailbox from your dashboard at any time, and it stops working immediately.
Deleting your data
Removing a mailbox deletes its stored settings and encrypted password. To delete your whole account, email support@openmail.tools from your login address.
Changes
If this policy changes, the date above changes too. Material changes will be announced on this site.