Privacy Policy

Last updated: November 10, 2026

MailBub is a keyboard-first reader for Gmail, run by Devela Enterprises LLC ("we"). It's in early development. This policy explains what MailBub does with your Google data and your other information when you use it at mailbub.com.

The short version

MailBub reads your Gmail to show it to you, and keeps a copy so the app stays fast.
MailBub only sends email when you press Send or answer an invitation.
Read tracking is optional. When it's on, MailBub adds a small image to email you send, to show you when it's opened.
Your Google data isn't sold, isn't used for advertising and isn't used to train AI models.
Disconnect an account and MailBub deletes its mail straight away. Nothing in Gmail is deleted.

Google data MailBub accesses, and why

When you connect a Gmail account, Google asks you to approve this access:

Your basic Google profile (openid, email, profile): your Google account ID, email address, name and profile picture.
Full access to your Gmail (https://mail.google.com/).
Two Gmail settings permissions (gmail.settings.basic and gmail.settings.sharing).
Google Calendar, only if you turn it on for an account (calendar.events and calendar.calendarlist.readonly). MailBub asks for these when you choose Turn on calendar, for that account alone, and you can turn calendar off again in Settings. Today they're for answering invitations, and for looking up an invitation's event when you open it. The list of your calendars is asked for at the same time so that a calendar view later won't need you to reconnect again, and MailBub doesn't read it yet.

MailBub uses this access to:

sign you in
read your mail, labels and attachments, so it can show them to you
check Gmail for changes, so MailBub stays in step
send the changes you make in MailBub, such as archiving an email, snoozing it, marking it read, moving it to Trash or reporting it as spam, back to Gmail. Snoozing adds a MailBub/Snoozed label in Gmail, and MailBub keeps when each snoozed email is due back
send the replies you write, from your own Gmail account, when you press Send
answer an invitation when you choose Yes, Maybe or No. With calendar on for that account, and when Gmail confirmed the invitation came from its organizer, MailBub finds the event in your Google Calendar and sets your answer there, and Google tells the organizer. MailBub never changes an event you organize. When calendar is off, the invitation can't be confirmed, or the event isn't on your calendar, MailBub can send the organizer an email reply from your Gmail account instead, which their calendar reads, but only when you choose that. One answer only ever goes one of these ways, and you have 10 seconds to undo it first
when you open an invitation in an account with calendar on, look for its event in that account's Google Calendar, to show whether it's there and what you said. MailBub only does this for invitations Gmail confirmed came from the organizer, and not as mail arrives
for email you send with read tracking on, put a copy without the tracking image in your Sent mail and permanently delete the copy that went out, so your own views of Sent don't count as opens. MailBub deletes it only once the copy without the image is in Sent in the same conversation. If Gmail won't allow the delete, the copy that went out goes to Gmail's Trash instead
read your Gmail send-as settings, which are the addresses you can send from and their signatures, so a reply goes out from the right address with your signature
add or remove a Gmail filter when you block or unblock a sender, and read your Gmail filters so the list of blocked senders stays right

This access is wider than MailBub needs today. MailBub never sends email unless you press Send or answer an invitation, only changes your calendar to set your own answer to an invitation, doesn't permanently delete your mail, and only changes your Gmail settings to add or remove a filter when you block or unblock a sender. It removes two things for good: a draft you discard, only after you've had 10 seconds to undo it, and the copy of a tracked email that went out, only once the copy without the image has taken its place in Sent. Moving an email to Trash puts it in Gmail's Trash, which Gmail empties by itself. We plan to narrow this access before MailBub opens up to more people, and you'd need to reconnect your accounts once when that happens.

What MailBub stores

Your mail. For each email MailBub syncs: the sender's name and address, any reply-to address, the recipients, including any Bcc addresses Gmail has, the subject, date, a short preview, the message's plain text, Gmail labels such as Inbox and Unread, your recent changes so you can undo them, attachment names, types and sizes, and technical details such as message IDs, mailing list headers and sender verification results. This covers recent mail and all the mail you've sent, which MailBub reads by itself when you connect an account, so it can suggest people you've written to. It can cover the rest of your mailbox history too, if you choose to load it. Some older mail may be stored without its text.
Conversation summaries. The subject, preview and participants of each conversation.
Formatted email. The formatted (HTML) version of an email is stored for 30 days after it was sent, so recent mail opens straight away. For older mail, MailBub reads it from Gmail when you open the email, or when you're close to opening it, and keeps it for 7 days, up to 50 MB for each account. After that it's deleted here and stays in Gmail.
Email you're writing. What you type, who it's going to and which address it's from, from the moment you start typing until it's sent or discarded. If Gmail turns an email down, it stays here with the reason so you can fix it or discard it. A copy of each draft is also kept in your Gmail Drafts, where you can finish it from anywhere. Files you attach and pictures you put in an email stay on MailBub's server only until the email is sent or discarded, and a picture you take out of an email is deleted a day later. Pictures are saved again when you add them, which removes the place a photo was taken and other details stored inside the file. Once an email is sent, the copy kept is the one in your mail like any other.
Your sending addresses. Each address you can send from in Gmail, with its name, reply-to address and signature.
People you've emailed. The names and addresses in your mail, with how often you've written to each other, to suggest who an email goes to.
Read tracking. For each email you send with read tracking on: a random code for its image, which conversation and Sent email it belongs to, and how many people it went to. Until the copy without the image is in your Sent mail, that copy is held too. Each time the image loads, MailBub records the time, the browser or mail app details sent with the request, the site it was loaded from but not the page, what kind of request it was, and the network it came from, cut short so it can't single out one device. From those it works out whether the email was opened, through which mail service, and on what kind of device when the reader's mail app says so. It notes replies from the people the email went to, and bounces. It doesn't record anyone's location.
Blocked senders. Each address you block and the ID of its Gmail filter. If you made a filter in Gmail that sends one address straight to Trash, MailBub lists that too. The block itself is a filter in your Gmail account.
Invitations. For each calendar invitation in your mail: its title, times, place, video link, organizer, the names, email addresses and answers of up to 50 guests and how many answered each way, its description as plain text, its next few dates if it repeats, whether Gmail confirmed it came from the organizer, and each answer you give and how it went. With calendar on, once you've opened it, also the event's ID and link in your Google Calendar and your answer there. The invitation file itself stays in Gmail. MailBub reads the file from Gmail to make this record. If Gmail doesn't answer, it tries again later. A file that's no longer in Gmail, or that MailBub can't read, is noted as such and not read again.
Not stored: attachments in your mail, except the invitation details above. Files stay in Gmail. When you open one, or an email displays one, MailBub reads it from Gmail and passes it to your browser without keeping it. When you forward one, MailBub reads it from Gmail as the email is saved to your Gmail Drafts or sent, and keeps no copy.
Searches. What you search for goes to Google to run the search, and isn't stored. Results that aren't already stored are shown to you and not kept, and neither are their attachments.
Sender pictures. Saved logos and photos, and a record of each domain or address hash looked up, including those where nothing was found. These aren't tied to your account.
Your account details. The name, email address, profile picture and Google account ID of you and each account you connect, and each account's sync status and settings, such as which mail it alerts you about.
Google access tokens. The tokens that let MailBub reach Gmail for you.
Session details. Your IP address, browser details and sign-in session.
Logs. Server logs that record requests, including IP addresses, and how syncing went. MailBub's own logs are built to hold account IDs and counts, not email content.

MailBub keeps your Spam and Trash like the rest of your mail, so you can read and rescue what's in them. Gmail deletes mail in both after 30 days, and MailBub removes its copy the next time it syncs. MailBub doesn't keep drafts you start in Gmail.

Where it's stored

MailBub's server and database are hosted by DigitalOcean. Mail is stored in the database. While MailBub is in early development, its developer also runs a copy on their own computer, which holds the developer's own mail.

Read tracking's images are served from mailbub.net, by the same server. The request details recorded there hold no mail, and the copy of MailBub that holds your mail collects them every 30 seconds.

How long it's kept

While an account is connected, MailBub keeps its mail. An email is removed when it's gone from Gmail, never because of its age.
Invitations follow their email: deleted with it, when it's gone from Gmail, and with the rest of the account's mail below.
When you disconnect an account, MailBub deletes that account's mail, invitations, unsent emails, sending addresses, contact suggestions, list of blocked senders and tokens straight away. Files attached to those unsent emails follow within two days. Copies of drafts stay in your Gmail Drafts, and filters for senders you blocked stay in your Gmail, where you can remove them in Gmail's settings.
If MailBub loses access to your Google account, for example because you removed it at Google, syncing stops. Reconnect within 30 days and nothing else changes. After 30 days, MailBub deletes that account's stored mail, invitations, unsent emails, contact suggestions and list of blocked senders. Files attached to those unsent emails follow within two days. The account's details and its old tokens, which no longer work, stay until you disconnect the account or delete your MailBub account.
When you delete your MailBub account, your profile, every connected account and all their mail are deleted straight away.
Read tracking. The request details recorded when an image loads are kept for 7 days after MailBub collects them, and never more than 30 days, both on the server that records them and in your copy of MailBub. What MailBub makes of them, such as when the email was opened and with what kind of mail app, is kept with the email it belongs to, and deleted with it, including when you disconnect the account.
Sender pictures and their lookup records aren't tied to an account, so they stay after you disconnect or delete one, until they've gone unused for 90 days.

Deleted data can stay in server or database backups until those backups expire. Your own browser may also keep pages and attachments you've opened in its history and cache.

How to disconnect, delete or revoke access

Disconnect one account. In the sidebar, open the menu beside the account and choose Disconnect.
Delete everything. Go to Settings, then Profile, and choose Delete account. Use this if you only have one account connected, since MailBub won't disconnect your last one.
Turn calendar off for one account. Go to Settings, then Accounts, and choose Turn off beside Calendar. MailBub stops using that account's calendar and forgets what it noted from it. Google's permission stays until you remove MailBub at Google, below, which disconnects the whole account.
Revoke access at Google. Go to your Google Account's linked apps page, choose MailBub and remove its access. This works even if you can't reach MailBub, and the 30-day rule above then applies.
Ask us. Email support@mailbub.com and we'll delete your data for you.

None of these remove anything from Gmail.

When you disconnect an account or delete your MailBub account, MailBub asks Google to end its access. If that request fails, MailBub still deletes your data, so check the linked apps page if you want to be sure.

Who your data is shared with

MailBub doesn't sell your data or share it for advertising. It has no ads, and no third-party analytics or tracking tools. Its own read tracking, described here, is yours to turn on, and only covers email you send.

MailBub relies on these services:

Google provides Gmail and sign-in. MailBub exchanges your data with Google to do its job.
DigitalOcean hosts the server and database, so your stored data sits on its systems.
Cloudflare sits in front of mailbub.com and mailbub.net. Everything you load from the site passes through it on the way to you, including your mail, so it can see that traffic and your IP address. So does every load of a tracking image, with the IP address of whoever loads it. MailBub doesn't use it to store your mail.
Laravel Forge sets up and deploys the server. It can reach the server to do that, but MailBub doesn't send it your mail.

Some other people and companies can also see limited information:

People you email. Email you send goes to the people you choose, from your Gmail account, like any email. A reply includes your signature and the email you're answering unless you remove them. With read tracking on, it also carries a small image from mailbub.net, and MailBub takes tracking images out of the emails you quote.
Email senders. Images and other content in an email load directly from servers the sender chose when you open it, unless MailBub has blocked them as likely trackers. Those servers can see your IP address, your browser and that the email was opened. MailBub catches many trackers, not all of them. In Spam and Trash, nothing loads until you choose Show images.
Sender pictures. To show a picture beside an email, MailBub's server looks up who it's from and, for email you've sent, the first person it went to. For personal addresses such as Gmail, it sends a hash of the address to Gravatar. For other addresses, it sends the domain to Google's favicon service, and may fetch a logo or icon that domain publishes, including from its website. Your browser only loads the saved picture from MailBub, so these services and sites don't see your IP address or when you open an email.
Unsubscribing. When you choose Unsubscribe on an email, MailBub contacts the sender's unsubscribe address for you, or opens it in your browser, and remembers the result on that email.
People at MailBub. Nobody reads your mail unless you've agreed to it for specific messages, it's needed for security (such as investigating a bug or abuse), or the law requires it.
Courts and authorities. We'll disclose data if the law requires it.
A new owner. If MailBub is ever sold or merged, your Google data will only move with your explicit consent first.

If you received a tracked email

Someone who uses MailBub may have sent you an email with read tracking on. It carries a small, invisible image from mailbub.net. When your mail app loads that image, MailBub records the time, the browser or mail app details your app sent, the site it was loaded from but not the page, what kind of request it was, and your network, cut short so it can't single out your device. It doesn't record where you are.

The sender sees whether and when the email may have been opened, and on what kind of device when your mail app says so. The details themselves are kept for up to 7 days after the sender's copy of MailBub collects them, and never more than 30 days. After that, only what was made of them stays.

To stop it, turn off remote images in your mail app, or block mailbub.net. To ask about it, email support@mailbub.com.

AI

MailBub has no AI features today. Your Google data isn't used to create, train or improve AI or machine learning models. If AI features arrive, we'll update this policy and ask for your consent first.

Google's Limited Use requirements

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

How your data is protected

Google access tokens are encrypted in the database.
MailBub doesn't store a password for you. You sign in with Google.
In the app, your mail is only shown to your own signed-in account.
Emails open in a sandbox that stops scripts in them from running.

Be aware that MailBub doesn't encrypt your mail separately inside the database, so it depends on the security of the database and server around it. MailBub is early software and hasn't had an independent security assessment.

New mail alerts

If you allow notifications, your browser shows an alert for new mail with the sender's name and the subject. With read tracking on, it can also show one when an email you sent is opened, with who it went to and its subject. You can change or turn off both for each account in Settings, under Accounts.

While MailBub is open, it makes these alerts in your browser. If you also turn on alerts for a device in Settings, under Accounts, new mail alerts reach it with MailBub closed, through the push service its browser uses: Apple, Google, Mozilla or Microsoft. Each alert is encrypted for your device, so the push service can't read it, though it can see that an alert was sent and when. MailBub keeps that device's push address and keys, and the name you see in Settings, until you turn alerts off there, sign out on it, or 60 days go by without MailBub opening on it. Alerts for opened email are only made while MailBub is open. Your browser or device may keep alerts in its notification history.

Cookies

MailBub uses cookies and browser storage to keep you signed in, protect forms, remember preferences such as light or dark mode, and avoid repeating new mail alerts across tabs. The sign-in cookie can last up to 400 days, or until you sign out. None of these are used for advertising or tracking.

Children

MailBub isn't meant for children. You need to be old enough to have your own Google account.

Changes to this policy

When this policy changes, we'll update the date at the top. If we change how MailBub uses Google data, we'll tell you in the app and ask for your consent first.

Contact

For questions, or to ask what data we hold about you, email support@mailbub.com.