Legal

HMB Mail Privacy Policy

Last updated November 3, 2026

This policy covers HMB Mail, a desktop app made by HMB Software LLC (“we,” “us”). HMB Mail shows the mail, calendars, contacts and notes in accounts you already have, such as Gmail, Microsoft 365, iCloud or any IMAP server.

The short version

HMB Mail runs on your computer. There is no HMB Mail server that your data passes through. We never receive, see, store or sell your mail, calendar, contacts or notes.

What the app accesses

When you add an account, HMB Mail signs in to that provider and reads and changes your mail, calendars, contacts and notes there. It does only what you ask it to: show messages, send, reply, file, delete, add events, edit contacts and write notes. Notes are saved as messages in a Notes folder in your mailbox.

For a Google account it asks for these permissions, always together:

  • Gmail (https://mail.google.com/): to read, send, organize and delete your mail, and to keep your notes in your mailbox.
  • Google Calendar (https://www.googleapis.com/auth/calendar): to list your calendars and show, add and edit events.
  • Google Contacts (https://www.googleapis.com/auth/carddav): to show and edit your contacts.

Where your data is kept

  • Your provider stays the home of your data. Changes you make in HMB Mail are sent to it.
  • Your computer keeps a local copy so the app is fast and works offline. It is stored in your user folder.
  • Your system keychain holds passwords and sign-in tokens. They are never written to files, logs or the local copy.

The app keeps a log on your computer to help fix problems. It records errors, not the contents of your messages.

Remote content

Scripts in messages are removed and never run. Remote images, including tracking pixels, load only when you choose to show them for a message. If you turn on sender logos (BIMI) in settings, the app fetches a logo from the sender’s domain.

AI features (optional, off by default)

HMB Mail can use an AI service that you set up in settings. You choose it: one running on your own computer (such as Ollama or LM Studio at localhost), or an online one (such as OpenAI or OpenRouter). Until you set one up, no message content goes to any AI service.

  • Sorting new mail. If you turn it on for an account, then for each message that arrives after that the app sends the AI service the account’s folder names, the message’s From, Reply-To, To, Cc, Subject, Date and List-Id lines, and up to the first 2,000 characters of its text. If you have summaries on, it also asks for a one-line summary, which is kept in the local copy.
  • Add to calendar. When you press it on a message, the app sends that message’s same header lines and text excerpt, plus today’s date and your time zone, so the AI can find the event.

Attachments and remote content are never sent. The AI service’s API key is kept in your keychain.

If the AI service runs on your own computer (localhost), nothing leaves your computer. If it is online, the text goes to that company, and its own privacy policy and terms decide how it is kept and whether it is used to train models. HMB Software never receives this data and never uses it to train models.

Google user data

HMB Mail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

  • Google user data is used only to provide the mail, calendar, contacts and notes features you see in the app.
  • It is not sent to HMB Software, not sold, and not used for advertising.
  • It is not used by HMB Software to develop, improve or train AI or machine learning models.
  • It is sent to another service only when you set up an AI feature described above and use it.
  • No person at HMB Software reads it.

Updates

On a Mac, HMB Mail checks chat.hmb-software.com for new versions. That check sends the app’s version, and our server sees your IP address, as with any web request. It sends nothing from your accounts.

Removing your data

Remove an account in HMB Mail’s settings to delete its local copy and its keychain entries. Deleting the app alone does not remove them, so remove your accounts first. The AI service’s API key is not tied to an account; it stays in your keychain under MailClient until you delete it there. You can also revoke HMB Mail’s access to your Google account at any time at myaccount.google.com/permissions. None of this touches the mail held by your provider.

Children

HMB Mail is not directed at children under 13.

Changes

If this policy changes, we’ll update the date above and describe the change here.

Contact

Email hello@hmb-software.com with any questions about this policy.