Subprocessors and retention
ohmail Cloud is operated by TrafficFlow GmbH, Staubstrasse 1, 8038 Zürich, Switzerland (support@ohmail.app). Running it means using other companies. Here is every one of them, what it holds, and where.
ohmail Desktop uses none of this. It has no account and no server of ours: nothing on this page touches you if you never sign up for Cloud, apart from visit statistics on this website, which you can switch off. On macOS, Windows and Linux alike the app is a real mail client, running against your own server rather than ours.
Not all of these are processing on any given day. They are listed regardless, because this page is meant to be complete before it is flattering, and because a subprocessor added quietly on the day it starts processing is exactly the thing this page exists to prevent.
Subprocessors
| Company | What it does for us | Data it can hold | Where |
|---|---|---|---|
| Supabase | The database, and storage for large attachments you send | Your mail, rules, tags, notes, account | Switzerland (Zurich) |
| Neon | The former database, frozen since the move to Supabase on 3 August 2026; to be deleted | A copy of mail, rules, tags, notes and accounts, and of waitlist and invitation addresses, as of the move | EU (Frankfurt) |
| Vercel | Website and API hosting | Requests in transit; connection logs | USA |
| Railway | The sync worker | Your mail, while it is being fetched and filed | EU |
| Anthropic | The AI model | While your AI switch is on: the sender’s address, subject and a short preview of new mail from senders you have allowed that no rule files, and of new senders’ mail while the Screener suggests automatically; which senders you often file to the same place; your words on what belongs in your Ohbox; and the message content you send for a suggestion or a draft | USA |
| Stripe | Payments | Your billing details. Never your mail. | USA / EU |
| Resend | Our own transactional mail to you | Your address and the message we send you | USA / EU |
| Google (Google Ireland Limited, Google LLC) | Visit statistics for this website (Google Analytics): asked first in the EEA and the UK, on by default elsewhere with an opt-out on the site. Never in the apps | Pages opened and sign-up or download presses on this website, referrer, browser and device type, approximate location, an Analytics cookie id. Never your mail | EU / USA |
Anthropic processes under commercial API terms: your mail is never used to train models, and requests are retained only briefly under its standard policy (currently up to 30 days). We have not negotiated a zero-data-retention agreement, and we will say here when we do. Where mail carries a credential — a verification code, a login link, a reset token — the credential is removed before the request is built. Your own client shows you the message in full — it is your own mail — while the model receives a version with the credential removed. Automatic background routing does not send that class of mail to a model at all; a suggestion you ask for reads it with the code gone.
How long things are kept
| What | Kept for |
|---|---|
| Mail, rules, tags, notes | As long as your account exists. Removing a mailbox erases its mail. As your plan’s storage fills, the bodies of your oldest messages are emptied to make room for new mail; the messages stay findable, because their headers, preview and the words search finds them by are kept. A message you delete in ohmail is kept whole, in Trash, so you can restore it. A message deleted on your mail server is hidden here but not erased: its headers, preview and search words stay. Both go when you remove the mailbox or delete your account. |
| Website visit statistics (Google Analytics) | At most 14 months, by the retention setting of our Analytics property |
| The copy in the former database | Frozen on 3 August 2026; kept until that database is deleted |
| Blocked-tracker records: the tracker’s host and the image address taken from your mail | Until you remove the mailbox or delete your account |
| Sign-in links and challenges | Each works for 5 minutes at most, a code that adds a device included; an email-verification link for 24 hours. The hourly pass deletes their records 30 days after they expire, a desktop sign-in request nobody confirmed included, and a passkey challenge’s record from an hour after it expires. |
| Sign-in sessions | A session refreshes while you use it, so using ohmail keeps you signed in. In a browser it stops after 90 days without use at the latest; the desktop and phone apps renew while you use them and stop after 400 days without use. Signing out, or removing a device, ends it immediately. The hourly pass deletes a session’s record 30 days after it is signed out or its device removed. A session that was not signed out, or one a later deletion of your account would still have to reach, stays until 400 days after its sign-in ran out, so that app can still be told the account is gone. The pass clears the IP address a desktop or phone app was added from once its last session’s record is gone; the name it is listed under stays until you delete your account. |
| Sync change log | Entries for deleted items and superseded changes are deleted once they are 30 days behind your least recently synced device or browser (one unseen for 90 days no longer holds them back). The first entry for each item you still have, your own moves back to the inbox and the newest entry stay until you delete your account. |
| Sign-in history: sign-ins, failed attempts and sign-outs, with the IP address and device | 180 days |
| Limits on attempts: hashes of the address typed and of the IP address — keyed for sign-in, plain SHA-256 for sign-up, email verification, desktop sign-in and the waitlist, and for each address our own mail goes to — and counts of second-factor refusals per account | 48 hours; for a device that has signed in, 90 days after it last did |
| Invitations we send: the address each one went to | An unused one is deleted 30 days after it expires; a used one keeps the address until the account it opened is deleted |
| Action history: what an action changed, so it can be undone | 365 days |
| Attachments uploaded ahead of a send | 24 hours, whether the message was sent or not, then deleted by the next hourly pass |
| Stored answers to retried requests, and the guard against sending a message twice | 24 hours, then deleted by the next hourly pass |
| After you delete your account: hashes of its sign-in tokens | Up to 400 days after each token expires, so an app still signed in is told the account is gone |
| After an account is erased because its subscription stayed closed past its retention period: that the warning mailed the week before was delivered (the warning’s kind, the erasure date it named, when it was sent and when delivered), under the account’s random id | 10 years after the erasure, as long as the billing record, so we can show the warning went out before the data was erased |
| Billing records | 10 years, pseudonymised (Swiss CO art. 958f) |
| Backups | The database provider’s, expiring on its own schedule; we have not confirmed how long that is, so no number is published here |
A pass runs every hour and deletes what the table says has expired: stored answers to retried requests and the double-send guard, sign-in records 30 days after they expire, sessions 30 days after they are signed out or 400 days after they ran out, expired passkey challenges, unused invitations, sign-in attempt limits, staged attachments, the token hashes of deleted accounts, and the record of an erasure’s warning 10 years after the erasure. It also ages out sign-in and action history and compacts the sync change log. That record is written by the nightly pass that mails the warning: it notes when the warning was delivered, and no account is erased before its warning has been. Where a row says a record stays until you delete your account, there is no automatic expiry yet, and we would rather write it than publish a period no job enforces.
Deleting your account
Deleting your account removes every user, mailbox, message, body, credential, rule, tag and note from live systems immediately, and from backups when those backups expire. What survives is the billing record, under a random account id with no name attached: Swiss law requires a business to keep its books, and a money trail that can be deleted on request is not a money trail. So does the record of what our staff looked at or changed on the account, under the same id. For up to 400 days after they expire, hashes of the account’s sign-in tokens survive too, so an app still signed in is told the account is gone.
When we erase an account because its subscription stayed closed past its retention period, one more record survives under the same id: that the warning we mailed the week before was delivered, and when, with no address, name, mailbox or mail. It shows the person was warned before the data was erased, and it is deleted 10 years after the erasure. Deleting your account yourself keeps no such record.
One copy is not covered yet: the former database (Neon, in the table above) still holds every account that existed on 3 August 2026, including ones deleted since, and the waitlist and invitation addresses it held then, until that database is deleted.
The copy we hold is what goes. The originals were never ours: they are on your own IMAP server, in the ohmail/… folders ohmail created there, and deleting your account leaves that mailbox exactly as organised as it was.
How to do it: the control is in the app, under your account. It asks for a second factor first — a password alone must not be able to erase an account — and the erasure then runs as a single database transaction behind a step-up-authenticated endpoint. No retention interview, no delay, no email to us required. If you would rather we ran it, support@ohmail.app still works.
Reporting a security problem
Email support@ohmail.app with SECURITY in the subject. That address covers this website, ohmail.app and the ohmail Cloud backend as well as the open-source desktop apps, whose policy is published in that repository. We acknowledge within 5 working days, tell you our assessment and a rough timeline, and credit you if you want the credit. We do not run a bug bounty, and we will not threaten anyone who reports in good faith. Please do not test against other people’s accounts or mailboxes.
If personal data of yours is ever breached, we will notify the competent authority within 72 hours of becoming aware, and you directly where the risk to you is high.
The full policy
This page is the list. The full product privacy policy — legal bases, the mechanism for the two transfers to the USA, the data-subject procedure, and the conditions under which a human at TrafficFlow can reach production data — is still being written. This page is what is true in the meantime rather than a placeholder for it.