Effective September 6, 2026 · Local Mail version

Privacy Policy

This policy describes Respawn Mail, the Mail widget and its local Windows module in Respawn Companion, provided by Respawn Icons.

Information accessed and purpose

The information is used only for account connection, mailbox display, search, refresh, notifications, reading, read/unread changes, user-selected Trash actions, and opening a message in Gmail. Respawn Mail does not request Calendar, Drive, or Contacts access.

Permissions and mailbox changes

Sign-in requests openid, userinfo.email, and userinfo.profile for account identity. The gmail.modify permission is required to read and search mail, mark it read or unread, and move it to Trash. Google's permission also includes sending, but Respawn Mail has no compose or send feature and its local service rejects send and draft requests. It does not request full-mail access or permanently delete messages while bypassing Trash. Opening a message marks it as read; other supported changes follow your actions.

Local processing and storage

The installed Windows module exchanges the authorization code and refreshes tokens directly with Google. OAuth uses your system browser, PKCE, a one-use state value, and a temporary loopback callback. Gmail requests go directly from the module to Google over HTTPS.

Account identity and OAuth tokens are stored only on your computer in a vault encrypted with Windows Data Protection API for your Windows user. Tokens are not returned to the widget. Message bodies, search results, and supported inline attachments are processed in memory and are not intentionally saved as a persistent mailbox by this application.

The module listens on 127.0.0.1, not your network interfaces. Widget access requires an Allow action on your computer and a local session credential. The widget stores this credential and display preferences locally. Sessions expire or can be disconnected in Companion.

External images and links

Sender-hosted images are off by default. The optional Always show email images setting enables direct HTTPS requests to image hosts. Those hosts may learn your IP address and that the message was opened. Scripts, forms, and other active email content remain blocked. Links you choose open in your default browser, where the destination's policies apply. A user-selected copy action writes the selected content to the Windows clipboard; clipboard history or synchronization may retain it.

Sharing and public website

In this local version, Respawn Icons has no Mail backend that receives Google tokens, message contents, searches, or attachments. The module communicates with Google; optional image requests communicate with the sender's image hosts. Google user data is not sold, used for advertising or profiling, or used to train generalized AI or machine-learning models. Respawn Icons does not provide staff access to your mailbox through the application.

This public information website is hosted on Cloudflare, which processes ordinary website requests, including network information needed to serve the page and protect its infrastructure. Visiting this site is separate from Mail's local OAuth and Gmail processing. Contacting support sends the information you choose to include; do not send passwords, tokens, or private messages.

Retention, removal, and your choices

Disconnecting an account removes its active local account record and credentials. It does not delete messages in Gmail or revoke every copy of a grant at Google. You can revoke the app through Google Account connections. Moving mail to Trash changes the message in Gmail; manage its restoration and retention there.

Stopping the Mail module stops background mailbox access. Local credentials remain available for your next launch until you disconnect. Local caches are discarded when the module exits. Device backups, clipboard history, and copies you make are controlled separately by you and your operating system.

Security

Safeguards include system-browser OAuth, PKCE, encrypted Windows-user storage, authenticated loopback requests with exact Host and Origin checks, no token or message logging by the module, bounded requests, and restricted email rendering. No software can guarantee protection against every attack, including malware running as your Windows user.

Google API Services User Data Policy

Respawn Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Changes and contact

Material policy changes will be posted here with a revised date. For questions or privacy requests, contact support@respawnicons.com.