Privacy Policy

Draft: we wrote this policy to describe how Braid actually works. A lawyer has not reviewed it yet, and it is not legal advice. If something here is unclear or seems wrong, email support@braidmail.app.

The short version

• Braid is a Mac app. Braid stores its downloaded mail database only on your Mac. There are no Braid servers that receive or store your mail; your Gmail mailbox remains with Google.
• Braid talks to Google directly from your Mac to sync and send your Gmail.
• The app does not automatically send your mail, Google tokens or API keys to the developer. If you choose to send a support message or problem report, we receive the information you include.
• Braid has no analytics, no tracking and no telemetry.
• AI features are optional and off until you add your own key for Jev or Anthropic. Then Braid sends limited parts of your mail straight from your Mac to that provider. Exactly what is sent is listed below.
• We don’t sell your data, show ads, or use your Google data to train AI models.

Who we are

Braid (“Braid”, “we”, “us”) is a keyboard-first email app for Mac. It is built and run by Josh Sapirstein, an individual developer. The website is braidmail.app, and the source code is public at github.com/jsap7/braid.

Contact:

• Support, privacy questions and requests: support@braidmail.app

What this policy covers

This policy covers:

• the Braid app for macOS, including builds we publish on GitHub and its automatic updates, and
• the website braidmail.app.

It doesn’t cover Google, Jev (TypeSafe), Anthropic, or the websites of people who email you. Those have their own policies. If you build Braid yourself from source or run a modified version, the code still works as described here, but we have no control over changes others make.

How Braid works

Braid is a “local-first” app. When you sign in with Google, Braid downloads your mail from Gmail onto your Mac, keeps it in a local database, and sends your actions (archive, label, send, and so on) back to Gmail. Every request goes directly from your Mac to the service involved. There is no Braid server in the middle. Local-first does not mean that all processing stays on-device: optional AI features are off unless you add your own Jev or Anthropic key, and then send the limited email content described below directly from your Mac to those providers.

Signing in with Google

You sign in with Google in your web browser. Braid uses Google’s standard sign-in for desktop apps (OAuth with PKCE and a redirect back to your own Mac). Braid never sees your Google password.

By default, Braid signs in with its own Google OAuth client. In Settings, you can choose to use your own Google Cloud client instead. If you do, that client’s ID and secret are kept in your Mac’s Keychain and are sent only to Google.

After you sign in, Google gives Braid a refresh token. Braid stores it in the macOS Keychain on your Mac. Short-lived access tokens are kept only in memory.

The permissions Braid asks for, and why

Permission (scope)	What Braid uses it for
https://mail.google.com/	Read and sync messages, threads, labels and attachments; archive, mark read, star, label, move to Trash or Spam; send mail; manage drafts; search older mail; and read your account address, send-as identities and signatures. The full scope is also needed for IMAP IDLE new-mail alerts using XOAUTH2, and Delete forever and Empty Trash/Spam. IMAP only signals mailbox changes; Braid fetches the messages through the Gmail API.
https://www.googleapis.com/auth/gmail.settings.basic	Block sender and Unblock. Braid creates a Gmail filter for the sender’s address that sends future mail to Spam (or Trash, if Gmail won’t let a filter use Spam), and deletes that filter when you unblock. Braid does not change other Gmail settings.

Braid reads your address from Gmail’s users.getProfile and uses your send-as displayName for a new account’s name, falling back to the part of your address before the @ when no name is available. New sign-ins request only the two scopes above, without OpenID, email or profile scopes.

Existing accounts keep their refresh tokens and earlier permissions; Braid does not revoke them when its requested scope list changes. An older account granted only gmail.modify can continue to use core mail features and check for mail on a timer, but cannot use IMAP IDLE or permanent deletion without the full mail permission. If you don’t grant gmail.settings.basic, Block sender asks you to sign in again before it can work.

What Google data Braid accesses, and how it uses it

With the permissions above, Braid accesses:

• Messages and threads: headers (sender, recipients, subject, date), message bodies, snippets, labels and attachments.
• Labels: your Gmail labels. Braid may create labels when you ask it to, plus a hidden label (“Braid/Muted”) so a conversation you mute stays muted when you use Braid on another Mac. Braid can also add a bucket’s label to mail if you turn that on for a bucket.
• Drafts: drafts you write in Braid are saved to Gmail Drafts, and drafts from your other devices are pulled into Braid.
• Settings: your send-as addresses (with their display names, reply-to addresses and signatures), and the filters Braid creates for blocked senders.
• Your email address for each account you add.

Braid uses this data only to provide the mail features you see and use in the app: showing, searching, sorting, sending, organizing and notifying you about your mail. When you first add an account, Braid downloads recent mail (about the last 90 days, up to about 2,000 messages) and then keeps it up to date. Older mail is fetched from Gmail when you search for it or open it.

Braid acts on your Gmail when you tell it to. That includes archiving, deleting, sending, labeling, blocking and unsubscribing. A few actions run automatically because you set them up: for example, after you unsubscribe from a sender, Braid archives new mail from them; after you mute a conversation, new replies skip your inbox.

Where your data is stored

Braid’s local database and caches are stored only on your Mac. Your Gmail mailbox remains on Google’s servers. If you enable optional AI, the providers receive the limited content listed below and handle it under their own retention policies.

• Mail, the search index, AI results (buckets, priorities, summaries, drafts), contacts suggestions, settings and outgoing attachments: ~/Library/Application Support/com.sap.mail/ (the database file is mail.sqlite3, and it includes a full-text search index).
• Downloaded attachments and sender logos (caches): ~/Library/Caches/com.sap.mail/.
• A few display preferences (such as remote images and sender logos): the app’s web storage in ~/Library/WebKit/com.sap.mail/.
• Secrets, in the macOS Keychain: your Google refresh tokens (Keychain service com.sap.mail.gmail, one item per account) and, if you add them, your Jev key, your Anthropic key and your own Google client (service com.sap.mail).

Braid manages its own storage: by default it keeps the local database within a size limit (1 GB) and may drop older message bodies to stay under it. You can change this in Settings › Storage. A dropped body is downloaded again from Gmail if you open that message.

There is no Braid cloud or developer-operated mail storage. Information you choose to send to support is handled separately as described below.

Who Braid shares data with

Braid only sends data where it needs to in order to do what you asked. Here is every place the app connects to.

Google

• Gmail API (gmail.googleapis.com, www.googleapis.com), Google sign-in (accounts.google.com, oauth2.googleapis.com) and Gmail IMAP (imap.gmail.com, for new-mail alerts only). This is how Braid reads, syncs and changes your mail. Google’s own Privacy Policy applies to your Google account.

Optional AI providers, only if you add your own key

Braid’s AI features are off until you paste an API key in Settings › AI. The key is your own, from your own account with that provider. Requests go directly from your Mac to the provider under your account, and that provider’s terms and privacy policy apply. You pay the provider for usage.

Important: once you add a key, Braid starts sorting automatically in the background. It sends each message it has downloaded (including mail you sent) for sorting, a batch at a time, until it has caught up. New mail is sorted as it arrives.

Jev, by TypeSafe (api.typesafe.ai). Privacy policy: see typesafe.ai.

Feature	When	What is sent
Sorting (bucket, “needs reply”, priority)	Automatically, for each message, once you add a Jev key	The account’s name in Braid (initially its Gmail send-as display name, or the part of your address before the @), the sender’s name and email address, the subject, and the first 1,500 characters of the message text. Also your buckets’ names and descriptions, and for a bucket you set up with examples, the sender and subject of up to five example messages.
New bucket preview	When you create or edit a bucket	For each of your 40 most recent conversations (one received message each): the same fields as above, but only the first 800 characters of the text.

Anthropic (Claude) (api.anthropic.com). Privacy policy: anthropic.com/legal/privacy.

Feature	When	What is sent
Sorting	Automatically, once you add an Anthropic key, when there is no Jev key, or when Jev fails or is unsure	The same as Jev sorting above: account name, sender, subject, the first 1,500 characters of text, and your bucket descriptions and examples.
One-line summary	Automatically, with sorting, if the message doesn’t have one yet	The account name, sender, subject and first 1,500 characters of text.
New bucket preview (without a Jev key)	When you create or edit a bucket	The bucket’s name, description and examples, and for 40 recent conversations: sender, subject and the first 200 characters of text, in one request.
Summarize thread	When you ask	Up to the last 15 messages of the conversation: for each, the sender, date, subject and up to 2,500 characters of text.
Draft with AI	When you ask	Up to the last 10 messages of the conversation (sender, date, subject and up to 3,000 characters each, with quoted earlier replies removed), your email address and display name, any instructions you type, and up to 5 of your recent sent messages (up to 800 characters each) so the draft sounds like you.
⌘K commands Braid can’t understand on its own	When you type a command in the ⌘K bar that Braid’s built-in parser doesn’t recognize	What you typed (up to 500 characters); the current view and search text; for up to 50 selected conversations, their IDs, subjects and senders (never message text); your account names and addresses; your folder and saved-search names; and your local time and time zone. The answer is shown to you as a suggestion. Nothing happens until you confirm it.

Braid sends these providers only what is listed above and only to get you the result you see in the app. Anthropic’s commercial terms say it doesn’t train its models on API inputs and outputs by default. Check each provider’s current terms and policies, because they set how long the provider keeps your data.

To stop using AI, remove your key in Settings › AI (see “Remove an AI key” below) and stop paying the provider. Results Braid already saved stay in your local database until you remove that account or delete everything.

The people and companies who email you

Some features contact a sender’s own servers. These requests come from your Mac, so the sender’s server can see your IP address and the time of the request.

• Sender logos. To show a small logo next to mail from a company, Braid downloads the icon from the website of the sender’s domain (for example, https://example.com/ and its favicon.ico). It doesn’t do this for personal mail domains such as gmail.com or icloud.com. No cookies or account data are sent, but the website can tell that someone at your IP address was looking up its icon. Results are cached for up to 30 days. You can turn this off in Settings › Privacy › Show sender logos.
• Remote images. Images hosted on the web are blocked by default. Braid only loads them for a message when you click “Load images”, for a sender you have allowed, or for all mail if you turn that on in Settings › Privacy. When images load, the sender can learn that and when you opened the message, plus your IP address. Known tracking pixels stay blocked even then.
• Unsubscribe. When you click Unsubscribe, Braid uses the method the sender provides: it sends a one-click unsubscribe web request to the sender’s address, or it sends an unsubscribe email from your account, or it opens the sender’s unsubscribe page in your browser.
• Links. Links you click in emails open in your default web browser, not in Braid.
• Calendar replies. When you answer an invitation (Yes, Maybe or No), Braid emails your reply to the organizer from your account.

GitHub, for updates

Braid’s official builds check for updates one minute after launch and then once a day, and when you click “Check for updates”. They download a small file (latest.json) from the project’s GitHub Releases page (github.com/jsap7/braid). When there is a new version, Braid downloads it from GitHub in the background and checks its signature. It installs only when you click “Restart to update”. These requests share only what any web request does, such as your IP address and the app’s user agent. GitHub’s privacy statement applies.

Nobody else

Braid does not automatically send your mail to the developer or to any analytics, advertising or tracking service. If you contact support, we receive what you choose to send. We don’t sell or rent your data to anyone.

We may disclose information only if the law requires it. Since we don’t hold your mail, your tokens or your keys, there is almost nothing we could hand over.

Google API Services User Data Policy (Limited Use)

Braid’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, for data Braid gets from your Google account:

1. Use only for features you see. Braid uses Google user data only to provide and improve the user-facing mail features of the app, as described in this policy.
2. No transfers without your consent. Braid transfers Google user data only as necessary for visible features you explicitly authorize, such as sending a message or enabling the optional Jev or Anthropic features described above. A merger, acquisition or sale of the project does not authorize a transfer of Google user data. Any such transfer would require your explicit prior consent; notice alone is not consent.
3. No automatic human access. Braid does not automatically send your mail to the developer. If you explicitly choose to share particular messages or a problem report with support, we use that information only to address your request. Human access to Google user data is otherwise limited to the exceptions allowed by Google’s Limited Use requirements, such as security investigations or applicable law.
4. No selling, no ads, no AI training. Braid doesn’t sell Google user data. It doesn’t use or transfer it to serve ads, including personalized or interest-based ads, or to work out credit-worthiness or for lending. Braid doesn’t use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models, and doesn’t transfer it to anyone for that purpose. When you add your own AI key, Braid sends limited mail content to that provider only to produce the result you asked for in the app (a sort, summary, draft or command).

How long data is kept, and how to delete it

Braid’s local copy stays on your Mac until you delete it or Braid trims its local storage as described above. Local problem reports are deleted after 90 days. We have no server copy of your mailbox. If you choose to contact support, we retain the information you send only for as long as needed to address the request. Google and optional AI providers retain the data they receive under their own policies.

You can remove Braid’s access and its data from inside the app. Each path below is in Settings (⌘,).

Remove one account

In Settings › Accounts, open the ··· menu next to the address and choose Remove account… (or type “Remove account” in the ⌘K command bar). After you confirm, Braid:

• asks Google to revoke its access to that account, so the refresh token and any access token from it stop working, and deletes the token from your Mac’s Keychain;
• stops syncing the account and closes its new-mail (IMAP) connection;
• deletes what it stored for that account from your Mac: its messages and their search index entries, downloaded attachments, labels, conversations, drafts and queued outgoing mail (with their attached files), calendar invites, AI results (buckets, priorities, summaries, reply drafts), its signature, send-as addresses, blocked senders and muted conversations. Contact suggestions are rebuilt from the mail that’s left.

Nothing in your Gmail account is deleted. If Braid can’t reach Google to revoke access (for example, you’re offline), it still deletes the local data and tells you; you can then revoke access yourself at myaccount.google.com/permissions. Preferences that apply to every account stay until you delete everything: your buckets, senders you told Braid to sort into a bucket or marked not important, senders you unsubscribed from, and senders whose images you always load. If it was your only account, Braid returns to its welcome screen.

Remove an AI key, or the AI results

In Settings › AI, click Remove next to the Jev or Anthropic key and confirm. Braid deletes the key from your Keychain and stops sending mail to that provider. To stop the key working anywhere, also revoke it in your Jev or Anthropic account.

Results Braid already saved stay on your Mac until you click Clear AI data… on the same page. That deletes every saved bucket, priority, “needs reply” flag, summary and reply draft, so your mail goes back to unsorted (conversations you moved to a bucket yourself stay there). If a Jev key is still saved, Braid sorts your mail again.

Delete everything

In Settings › Privacy, click Delete all Braid data… and type DELETE to confirm. Braid then:

1. asks Google to revoke its access to every account;
2. deletes every Keychain item it saved: your Google refresh tokens (com.sap.mail.gmail), your AI keys and your own Google client, if you added one (com.sap.mail);
3. clears its web view storage, restarts, and before opening anything deletes its data folder (~/Library/Application Support/com.sap.mail/: the database with all mail, the search index, AI results, settings, outgoing attachments and problem reports) and its cache folder (~/Library/Caches/com.sap.mail/: downloaded attachments and sender logos);
4. opens at the welcome screen.

Then you can delete the app from your Applications folder. If Braid can’t reach Google, also remove its access at myaccount.google.com/permissions (choose Braid, or your own Google client if you used one).

You can always revoke Braid’s access from Google’s side at myaccount.google.com/permissions, even without the app.

Mail you send, delete, label or archive through Braid changes your Gmail account itself. Deleting Braid’s data doesn’t undo those changes. Data you sent to Jev or Anthropic is kept by them under their own policies.

Problem reports

If you choose Report a problem (⌘⇧B), Braid saves a report on your Mac in ~/Library/Application Support/com.sap.mail/reports/. Nothing is uploaded. A report includes:

• the description you type;
• if you leave “Include a screenshot” checked (it is checked by default), a screenshot of the Braid window as it was when you opened the dialog. This can show whatever was on screen, including your mail;
• if you leave “Include app state” checked: the current view and search text, the subject and ID of the selected conversation (no message text), which accounts were selected, sync status and errors, recent error messages and actions in the app, window size, app version and system details.

The report goes nowhere unless you send it. You might attach it to a GitHub issue (GitHub issues are public, so check the screenshot and text first) or email it to support@braidmail.app. If you send us a report, we use it only to fix the problem and delete it when we no longer need it.

Security

• All connections to Google, Jev, Anthropic and GitHub use encrypted HTTPS/TLS. IMAP uses TLS as well.
• Tokens and keys live in the macOS Keychain. They are never written to logs and are sent only to the service they belong to.
• HTML email is shown in a locked-down frame: no scripts, no forms, no plugins, and no remote content unless you allow it.
• Remote images are blocked by default, and known tracking pixels are always blocked.
• Sender-logo requests are only made to public internet addresses, never to your local network.
• Updates are signed, and Braid checks the signature before installing.
• The code is open source, so anyone can check these claims.

No system is perfectly secure. Your Mac’s own security (your login password, FileVault disk encryption, keeping macOS updated) protects the data Braid stores. To report a security problem, see SECURITY.md on GitHub.

Children

Braid isn’t directed at children. It isn’t meant for anyone under 13, or under 16 where the law sets a higher age. We don’t knowingly collect data from children. In fact, we don’t collect personal data through the app at all.

Users outside the United States

Braid is run from the United States. Its local mail database is stored on your Mac, with no Braid servers receiving your mailbox. Google, optional Jev and Anthropic features, and GitHub may process the information they receive in the United States and other countries under their own policies. If you contact support, we receive the information you send. Depending on where you live, you may have rights to access, correct or delete personal data, or to object to how it’s used. Requests about local data can be handled on your Mac; requests about provider-held data go to those providers. Contact support@braidmail.app with privacy questions or requests.

The website (braidmail.app)

braidmail.app is a static website hosted by Vercel. It has no analytics, no tracking and no cookies, and no forms or accounts. Like any web host, Vercel may keep standard server logs, such as your IP address, browser type and the pages you requested, for security and to keep the site running. Vercel’s privacy policy applies to that. Downloads of the app are served by GitHub.

If you email us, we receive your email address and whatever you write. We use it only to answer you and don’t add you to any mailing list.

Changes to this policy

If Braid changes what it collects or where it sends data, we’ll update this policy and change the date at the top. For significant changes, we’ll also say so in the release notes, and in the app where it makes sense. Each version of this policy is kept in the public history of the Braid repository on GitHub.

Contact

Privacy questions or requests: support@braidmail.app

Josh Sapirstein, developer of Braid