Privacy policy
Last updated 7 October 2026
MailComb is a desktop application, not a service. This policy explains what it accesses, what happens to that data, and — because it comes up a lot with an app that reads your email — exactly which outside companies ever see any of it and why. Where something is genuinely simple ("we never see your mail"), we've tried to just say that plainly rather than bury it in qualifiers.
Who we are
MailComb is a trading name of Graphics & Graphite Ltd, a company registered in England and Wales, of 33 Marriott Road, London, N10 1JJ, United Kingdom. For the purposes of UK GDPR, Graphics & Graphite Ltd is the data controller for the website you're reading now (mailcomb.app) and is the developer of the MailComb application. Because of how the application itself is architected (see below), Graphics & Graphite Ltd does not receive, store, or have access to your email content, the entities/subscriptions/todos MailComb builds from it, or your Anthropic API key.
Contact: support@mailcomb.app
Google API data and Limited Use
MailComb's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice, this is a consequence of how MailComb is built, not a separate promise layered on top: your mail data is never transferred to us at all (see "How MailComb is built" below), so it's never available to be used for any purpose beyond showing it back to you in the app — and in particular, it's never used to train, improve, or build any machine-learning or AI model, by MailComb/Graphics & Graphite Ltd or by anyone else. See "AI-assisted scanning" below for exactly what's sent to Anthropic and Anthropic's own commitment not to train on it.
How MailComb is built, and why that matters here
MailComb has no backend. The application you install runs a small local web server on your own computer purely to render its own interface — nothing it does crosses the network to a MailComb-operated server, because none exists. Everything it finds while reading your mailbox (senders, subscriptions, action items, dormant accounts, todos) is written to a SQLite database file in your operating system's per-user application-data folder. It stays there until you delete it, by removing the account inside the app or by uninstalling MailComb.
What MailComb accesses, and what happens to it
Your Gmail or Outlook mailbox
When you connect an account, MailComb opens your provider's own sign-in screen (Google or Microsoft) and requests read-only access to your mail. MailComb never sees or stores your email password. You can revoke this access at any time from your Google Account's or Microsoft Account's own security settings, independent of MailComb.
Disconnecting or removing a Gmail account inside MailComb also revokes MailComb's access at Google itself, not just on your computer. (If you happen to be offline when you do it, the connection is still removed locally, and you can finish the job from your Google Account's third-party access settings.) For Outlook, disconnecting removes MailComb's saved sign-in from your computer; to also withdraw the permission itself, use your Microsoft account's app-permissions page.
Discovering senders, categorising subscriptions, and finding one-click-unsubscribe links is done by reading message headers (From, category, List-Unsubscribe) — this happens entirely on your device and is never sent to Anthropic or anyone else. It's also the part of MailComb that's free, without a license (on Outlook; connecting Gmail needs a license during early access).
When you press Unsubscribe on a subscription, MailComb sends the standard unsubscribe request directly from your computer to the address the sender put in their own email. That tells the sender your address has unsubscribed; nothing is routed through us.
AI-assisted scanning (action items, dormant accounts, purchases)
These features require a MailComb license. When you run one, MailComb sends the content of the specific email(s) being scanned — not your whole mailbox — to Anthropic's Claude API, using an API key you provide and that is billed directly to your own Anthropic account. MailComb stores that key locally on your device only; it is never transmitted to Graphics & Graphite Ltd or anyone but Anthropic. What Anthropic does with API traffic is governed by Anthropic's own privacy policy and commercial terms, linked above.
Anthropic's published policy states it does not use API inputs or outputs to train its models, unless an account has separately opted in to Anthropic's own Development Partner Program — something MailComb never does on your behalf, and has no ability to do, since it only ever uses the API key and account you provide.
License activation
If you buy a license, activating it sends the license key to Lemon Squeezy, MailComb's payment processor and merchant of record, to confirm it's valid, together with a generic label for that activation (the operating system's name and a random identifier — never your computer's own name), and re-checks it with them from time to time. Payment card details are collected and processed entirely by Lemon Squeezy — Graphics & Graphite Ltd never sees or stores your card details.
Automatic connections that carry no personal data
Two things MailComb does by itself, neither of which sends any account, mailbox or license information:
- It periodically requests a tiny empty page from Google (
www.gstatic.com) to tell whether your computer is online, so it can pause syncing instead of showing errors. - On start-up it downloads the Public Suffix List from
publicsuffix.org, a public text file it uses to work out which part of a sender's address is the company's domain, and keeps a copy on your computer.
As with any web request, the server at the other end can see your computer's IP address.
How we protect your data
Security procedures are in place to protect the confidentiality of your data, shaped by how little of it ever leaves your device in the first place:
- Encryption in transit. Every connection MailComb makes — to Google, Microsoft, Anthropic, or Lemon Squeezy — uses HTTPS/TLS, the same encrypted-connection standard used across the web.
- No central server to protect. There is no MailComb-operated server or database. Your mailbox data is never transmitted to Graphics & Graphite Ltd's infrastructure, so there's no central store of user data that could be exposed in a breach on our end.
- Local storage, OS-level access control. Everything MailComb discovers is written to a SQLite database file in your own computer's per-user application-data folder, accessible only to your own user account under your operating system's normal file permissions — the same protection any other locally-installed application's data has. This file is not currently encrypted at rest, so if you share a login on your computer with others, or your device itself isn't encrypted (e.g. via FileVault or BitLocker), treat it with the same care as any other local app data. We're evaluating adding at-rest encryption for this file in a future update.
- Sign-in tokens and your API key, stored locally. Your Anthropic API key and your Gmail sign-in token are stored in the same local, per-user folder as ordinary files protected by your operating system's permissions — not yet in the system Keychain — and never on a MailComb server, because none exists to store them on. Outlook's sign-in token is the exception: it is encrypted using the macOS Keychain (Windows: DPAPI).
- Local access protection. MailComb's own internal components talk to each other only on your computer's loopback address and are not reachable from other devices.
What we don't do
- No analytics, telemetry, or crash-reporting SDKs of any kind.
- No cookies, no IP-based geolocation, and nothing stored in your browser by this website.
- No selling, renting, or sharing of data — there's no MailComb-held data to share.
- No advertising, and nothing here is monetised through your data.
Who your data is shared with
Only the following, and only for the reason stated:
- Google / Microsoft — to read your mailbox, because you connected it.
- Anthropic — the content of an email, only when you run an AI scan on it, using your own API key.
- Lemon Squeezy — your license key, a generic activation label and your payment details, only if you buy a license.
Graphics & Graphite Ltd is not one of these recipients for your mail content — see "How MailComb is built" above.
International transfers
Google, Microsoft, Anthropic, and Lemon Squeezy are all international companies whose infrastructure may process data outside the United Kingdom, including in the United States. Each operates under its own safeguards for cross-border transfer; see their respective privacy policies for details.
Data retention and deletion
Because MailComb stores everything locally, retention is entirely in your hands: remove an account from the Connections page to delete everything discovered from it, or uninstall MailComb to remove all local data at once. Graphics & Graphite Ltd holds no copy to separately delete.
Children
MailComb is not directed at, and should not be used by, anyone under 16.
Your rights
Under UK GDPR you have the right to access, correct, or request erasure of personal data a controller holds about you, among others. Because Graphics & Graphite Ltd does not hold your email content or the data MailComb derives from it, most of these rights are already satisfied by the app's local-only design — there's simply nothing on our side to access or erase. For anything we do hold (for example, correspondence if you email support), contact support@mailcomb.app. You can also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).
Changes to this policy
If this policy changes materially, the "last updated" date at the top will change and, where practical, we'll note what changed. Continued use of MailComb after an update means you accept the current version.
Contact
Graphics & Graphite Ltd, 33 Marriott Road, London, N10 1JJ, United Kingdom.
support@mailcomb.app