Privacy Policy — mesSage

Last updated: July 22, 2026

mesSage is a desktop email client developed by DuWayne Caviness. This policy explains exactly what data the app accesses, how it is used, how it is protected, and how it is deleted.

1. Data Storage

All data — including email credentials, OAuth tokens, email content, and settings — is stored locally on your device. mesSage does not operate any servers and does not transmit your data to the developer or any third party, except as explicitly described in this policy.

2. Google Gmail Data — What We Access

mesSage connects to your Gmail account using Google's OAuth 2.0 authorization. The app requests the following scopes:

gmail.modify — allows the app to read, compose, send, archive, label, star, and move emails on your behalf.
gmail.settings.basic — allows the app to create and manage Gmail filters on your behalf, used exclusively for the "Block Sender" feature which routes mail from blocked addresses to Spam.

The specific Gmail data accessed includes: email messages and threads (subject, sender, recipients, body, attachments), email metadata (read/unread status, labels, flags), Gmail labels and filters, and your primary Gmail address.

3. Google Gmail Data — How We Use It

Gmail data is used solely to provide the core functionality of the mesSage email client: displaying, composing, sending, searching, organizing, and managing your email directly within the app on your device. No Gmail data is used for advertising, analytics, profiling, or any purpose unrelated to email management.

4. Google Gmail Data — Sharing and Transfer

Gmail data is not sold, shared, or transferred to any third party except in the following limited cases:

Gmail's own API: Email actions (send, archive, label, etc.) are performed by calling Gmail's official API on your behalf. This is the standard mechanism by which the email client functions.
Optional AI assistant (Claude): If you choose to use the AI assistant feature and configure it to use Claude (Anthropic), email content you explicitly submit to the AI assistant is sent to Anthropic's API to generate a response. This transfer occurs only when you actively invoke the AI assistant; it does not happen automatically or in the background. See Section 8 for full details.

No Gmail data is transferred to data brokers, advertisers, analytics providers, or any other third party.

5. Google Gmail Data — Protection

Your Gmail data is protected as follows:

OAuth tokens are stored in your device's local app data directory, accessible only to the app and your user account.
All API communication with Google's servers uses HTTPS (TLS encryption) enforced by the operating system.
No developer access: The developer of mesSage has no servers, no backend, and no ability to access your Gmail data. All data flows directly between your device and Google's servers.
No cloud sync: Your data is never uploaded to any cloud storage operated by this app.

6. Google Gmail Data — Retention and Deletion

Gmail data is retained locally on your device for as long as your account is connected in mesSage. Specifically:

OAuth tokens are stored until you sign out or disconnect the Gmail account in the app, at which point they are immediately deleted from your device.
Locally cached email data (stored in a SQLite database on your device for offline access and faster loading) is deleted when you sign out or uninstall the app.
To delete all data: Sign out of your account in mesSage (Settings → Account → Sign Out), or uninstall the application. Either action removes all locally stored tokens and cached email data.

mesSage does not retain any copies of your Gmail data on any server. There is no server-side data to request deletion of.

7. Microsoft Outlook Data

mesSage connects to Outlook and Hotmail accounts via Microsoft's OAuth 2.0 authorization and the Microsoft Graph API. Email data is fetched directly from Microsoft's servers to your device. The same access, use, protection, and deletion principles described above for Gmail apply equally to Outlook data. No Outlook data is stored or transmitted elsewhere by the developer.

8. IMAP / SMTP Accounts

For accounts connected via IMAP/SMTP (Yahoo Mail, Fastmail, iCloud, and others), your email address and app password are stored locally in your device's secure credential storage (Windows Credential Manager). Email content is fetched directly from the provider's servers to your device and is not transmitted to the developer.

9. AI Assistant — Optional Feature

mesSage includes an optional AI assistant. AI features are entirely opt-in and require you to configure your own API key or local model. Two options are available:

Claude (Anthropic): If configured, email content you explicitly submit to the AI assistant is sent to Anthropic's API to generate a response. This data transfer occurs only when you actively use the AI assistant. mesSage does not automatically or passively send email data to Anthropic. Please review Anthropic's Privacy Policy for details on how they handle API data.
Ollama (local model): All AI processing happens entirely on your device. No data leaves your machine.

AI training restriction: mesSage does not use your email data, or any Google user data, to train, improve, or develop any AI or machine learning model. When email content is sent to Anthropic's API via the Claude integration, it is used solely to generate a response to your request and is subject to Anthropic's API data handling policies, which prohibit using API inputs to train their models without consent.

Google API Limited Use Compliance Statement: mesSage's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Raw or derived user data received from Google Workspace APIs is not used to develop, improve, or train AI or machine learning models, and is not transferred to any third-party service for the purpose of AI or machine learning model training.

10. Offline Cache

mesSage may cache email metadata and message content in a local SQLite database on your device to enable offline access and faster loading. This cache is stored in your device's app data directory, is not accessible to the developer, and is deleted when you sign out or uninstall the app.

11. No Analytics or Advertising

mesSage does not collect analytics, telemetry, crash reports, or any usage data. It contains no advertising. The developer has no visibility into how you use the app.

12. Auto-Updates

mesSage checks GitHub Releases for software updates. This request includes your IP address as part of the standard HTTPS connection, but no personal data is sent. Update packages are cryptographically signed and verified before installation.

13. Children's Privacy

mesSage is not directed at children under 13. We do not knowingly collect data from children.

14. Changes to This Policy

If this policy changes materially, the updated version will be posted at this URL with a new "Last updated" date.

15. Contact

Questions? Contact: admin@cavinessproducts.com