Privacy Policy
This policy covers the ohmail.app website, operated by TrafficFlow GmbH, Staubstrasse 1, 8038 Zürich, Switzerland (support@ohmail.app).
Visit statistics
This website counts visits with Google Analytics 4, provided by Google Ireland Limited and Google LLC: the pages you open, the sections you see and the buttons and links you press. Google acts as our processor; data sharing with Google and Google signals are off. Data may be transferred to the USA, relying on the Swiss-US and EU-US Data Privacy Framework. Visitors in the EEA and the UK are asked first: until you accept, no Analytics cookie is set, and a browser on a European time zone loads nothing from Google at all. Everyone else is counted by default and can opt out at any time from “Analytics” in the footer. Your choice is stored in your own browser (localStorage), not in a cookie of ours: .
While statistics are on, Google receives the pages you open on this website, which of its sections you see, the buttons and links you press on it (to choose a plan, sign up, download, open a question, switch language or try the demo), the steps of its sign-up form you reach, how far you scroll, where you came from, and your browser, device type and approximate location, along with two Google Analytics cookies that recognise a returning browser. No mail content, no address, no name and nothing you type is sent. Advertising features, ad personalisation and Google signals are off. Visit data is kept no longer than our Analytics retention setting, at most 14 months.
Only this website. The ohmail apps — the web app after you sign in, the desktop app and the phone app — load no analytics and no trackers. Your theme preference is stored in your own browser (localStorage) and is never transmitted.
The live demo
The product demo on this site runs entirely in your browser with fictional sample data. Nothing you click or type in the demo is transmitted anywhere.
Signing up
Creating an ohmail Cloud account sends us the email address, name and password you type, and we store them on servers in Switzerland to operate the account. Passwords are stored only as a scrypt hash — never in a form we can read. We also record the IP address and browser user agent of each sign-in, failed sign-in, sign-out and other security event on an account, and of each new account, and keep them for 180 days to keep accounts secure; the IP address each desktop or phone app was added from is kept until 30 days after the app is signed out or removed — or, if it was not, or a later deletion of the account would still have to reach it, until 400 days after its sign-in ran out — to show you your own devices. Other attempts leave only counters under hashes of the address typed and of the IP address, to rate-limit abuse. Legal basis: performance of the contract, and our legitimate interest in keeping accounts secure.
The “keep me posted” form stores the address and the interest you pick, on the same servers, so we can write to you when there is something to tell you. It is used for nothing else, and asking us to remove it removes it from our live database. An address given before 3 August 2026 also stays in our former database, frozen, until that database is deleted. The form also keeps a hash of the IP address it was sent from for 48 hours, to limit sign-ups per connection.
Hosting and server logs
ohmail.app is served by Vercel Inc. (USA). Like every web server, Vercel processes technical connection data (IP address, request time, user agent) in server logs for delivery and security. Legal basis: our legitimate interest in operating the website securely. We add no logging of our own.
Your rights
Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR, you may request access to, correction of, or deletion of personal data concerning you. If you have an account, the product deletes it and its data itself; otherwise write to us. Contact: support@ohmail.app.
The ohmail product
ohmail Desktop is designed so your mail never touches our servers, and on macOS, Windows and Linux alike that is how it works today: the app is a real mail client that connects to your own IMAP server and organises your mailbox on your machine, with no ohmail server in the loop. It makes one signed check for its own updates, and can optionally sign in to ohmail Cloud; the default local mode talks only to your mail server and that update feed. No telemetry, no analytics. The interface-only demo on this site makes no network calls at all.
Your mailbox stays the original. ohmail Cloud holds a synced copy: everything it stores also exists on your own IMAP server, the organising ohmail does is written back there as real folders, and cancelling leaves that mailbox exactly as it is. Leaving is not a migration.
That copy is a full one — bodies, headers, subjects and senders, not only metadata — on servers in Switzerland, solely to provide the service — sync, push, search, the filing your rules ask for, and the AI features you turn on. It is encrypted at rest and your mailbox credentials are additionally encrypted at the application level, but the mail itself is not: it is not end-to-end encrypted, and a small number of people with production database access could technically read it.
Attachments you send from the web app are handled separately, and the size of the file decides how. A small one travels inside the send request and is never written down. A larger one is uploaded first to private storage on the same infrastructure in Switzerland, and the send then fetches it from there — so those bytes exist at rest for a short window. They are encrypted at rest, no public or anonymous access is granted to that storage, and they are kept for 24 hours whether the message was sent or not, then deleted by the hourly pass that follows. Nothing on your account records them afterwards. On ohmail Desktop in its default local mode this does not apply at all: attachments go from your machine to your own mail server and touch no ohmail server.
Connections between your devices and ohmail use TLS, and so does the connection onward to your own mail provider: implicit TLS on the secure ports (993 and 465), a required STARTTLS upgrade on the submission ports (143 and 587), certificates verified, and TLS 1.2 as the minimum version. A provider that offers no encryption, or whose certificate does not validate, fails to connect rather than being used anyway — ohmail will not send your mailbox password over a connection that never became encrypted. The one exception is a mail server on ohmail’s own machine, which is how the test suite runs and is never a real provider.
Optional AI features send message content to Anthropic under commercial API terms: your mail is never used to train models, and Anthropic retains requests only briefly under its standard policy (currently up to 30 days). We have not negotiated a zero-retention agreement and do not claim one.
Where mail carries a credential — a verification code, a login link, a password-reset token — the credential itself is removed before any AI request is built. That redaction applies only to what leaves for a model, never to what is kept or shown: your own copy of the message is never redacted — you read your own code in full — and on the way to a model it goes a little further: opaque tokens are blanked out of every link in the message, including the ones a marketing click-tracker has wrapped. So there is no version of the message with the credential in it going anywhere. That is a detector, not a proof: it recognises authentication wording in twenty-four languages and blanks code-shaped and token-shaped runs, and the way it fails is by blanking an order number, not by sending a code.
What is not withheld is the subject matter. If you ask ohmail to suggest where a sender belongs, a message about a password reset is read as a message about a password reset — with the token gone. That changed on 8 August 2026, and it is a deliberate narrowing of an earlier promise: this page used to say such mail was kept away from a model entirely. It was, and the effect was that a detector decided on your behalf that a feature you had asked for and paid for would not run, for 293 of one account’s 1,698 waiting senders. AI still runs only where you turn it on, and automatic background routing — the filing that happens without anyone pressing anything — does not send this class of mail to a model at all.
Who processes what, where, and for how long is published in full on the subprocessors and retention page — including how account deletion works. Real mailboxes are connected: there is customer mail on our servers now, and everything on this page describes it. The longer legal document — lawful bases, transfer mechanisms, the formal processor register — is still being written, and this page is what is true in the meantime rather than a placeholder for it.