Porch Mail
Buy Porch Mail
TrustWhat leaves your computer, and where it goes

Your mail, and nobody in between.

Porch Mail isn’t open source, so you can’t read the code. This page says exactly what it sends and where, in enough detail to check with a network monitor. A test in our build fails if the app gains a destination that isn’t listed here.

§01 · Data flow

Everything runs on your computer.

The app is two parts: the window you use, and a background service (the daemon) that does the syncing. They talk to each other on 127.0.0.1, which never leaves the machine. Only the daemon goes out to the network.

§02 · Every host

Every name the app ever contacts.

Check it with Little Snitch on macOS or OpenSnitch on Linux. Anything not on this list is something you typed in yourself, or an image you asked to load.

Your mail provider

Only for the accounts you add.

  • imap.gmail.comGoogle

    Reads your Gmail over IMAP, if you add a Gmail account.

  • smtp.gmail.comGoogle

    Sends mail you write from a Gmail account.

  • outlook.office365.comMicrosoft

    Reads your Outlook mail over IMAP, if you add an Outlook account.

  • smtp.office365.comMicrosoft

    Sends mail you write from an Outlook account.

  • api.fastmail.comFastmail

    Reads and sends your Fastmail mail over JMAP, if you add a Fastmail account.

  • smtp.fastmail.comFastmail

    Sends mail from a Fastmail account set up through configuration rather than in the app.

  • imap.migadu.comMigadu

    Reads mail for a Migadu account set up through configuration.

  • smtp.migadu.comMigadu

    Sends mail from a Migadu account set up through configuration.

Signing in

Gmail and Outlook sign in through your browser (OAuth). The password never reaches Porch Mail.

  • accounts.google.comGoogle · in your browser

    The Google sign-in page, opened in your browser when you add a Gmail account.

  • oauth2.googleapis.comGoogle

    Turns that sign-in into a token, and renews the token when it runs out.

  • login.microsoftonline.comMicrosoft

    The Microsoft sign-in page in your browser, then the token and its renewal.

AI, if you turn it on

Off by default. Nothing goes to these unless you choose one.

  • api.anthropic.comAnthropic

    Only if you choose Anthropic in Settings → AI and add your own key.

  • api.openai.comOpenAI

    Only if you choose an OpenAI-compatible model in Settings → AI and leave the address at its default.

Updates

Once a day, unless you turn it off in Settings → Updates. The request carries nothing about you: GitHub sees your IP address, as any website does.

  • github.comGitHub (Microsoft)

    Once a day, the newest release's description and its signature; when there's a new version, the download too. GitHub sends the files from its download host (release-assets.githubusercontent.com). Nothing about you is sent, and Settings → Updates turns it off. What's new opens the release notes there, in your browser.

Buying a licence

In your browser only. The licence key is checked on your computer: no activation, no check-ins.

  • porch.zeiq.devPorch Mail · in your browser

    Our website, opened in your browser when you click Buy or “Email it to me again” in Settings → Licence. The app itself never contacts it: licence keys are checked on your computer.

Hosts you choose

These can’t be listed by name, because you pick them.

  • Your IMAP, SMTP and ManageSieve server

    Any other mail account you add. The app connects only to the host and port you enter.

  • Your JMAP server

    The session URL you enter for a JMAP account. It must use https.

  • Your own model

    The address you enter for Ollama or an OpenAI-compatible model. Ollama runs on this computer (127.0.0.1) unless you point it elsewhere.

  • Image hosts in an email

    Only when you load a message's images, or for a sender whose images you always load. The daemon fetches them; the email's page never does.

Images are fetched by the daemon from your own IP address, so the image’s host can see that address. The daemon refuses private and local network addresses, sends no cookies and no referrer, and only accepts real image files.

§03 · AI

Off until you turn it on. Then, exactly this.

Porch Mail has no AI of its own and runs no AI server. If you want suggestions at the Gate (which box a new sender belongs in), you bring a model: Ollama on your own computer, or your own key for Anthropic or an OpenAI-compatible service. A suggestion never decides anything; you do.

We recommend Ollama: the model runs on your computer and nothing leaves it. With a hosted provider, that provider’s own data policy applies: Anthropic, OpenAI.

What the model sees, per sender
Sender
Name and address
Subject
Of their newest email, up to 200 characters
Headers
List-* (List-Unsubscribe and the like), Authentication-Results and Received-SPF, up to 300 characters each
Text
The first 400 characters of the newest email’s plain text

Never attachments, images, the rest of the email, other emails in the thread, or your replies.

Up to 8 senders a request · at most 60 requests an hour · keys kept in your keyring

§04 · What’s stored, and how

What’s encrypted, and what isn’t.

Passwords, app passwords, OAuth tokens, AI keysYour system keyring: Secret Service (GNOME Keyring, KWallet, KeePassXC) on Linux, the login Keychain on macOSEncrypted by the keyring
The mail cache: headers, bodies you’ve opened, the search index, your Gate decisions, settingsA SQLite file in your data folder (~/.local/share/porch-mail)Not encrypted by the app. Protected by your user account and disk encryption.
Images you loadedA cache in ~/.cache/porch-mail/images, kept for 3 daysNot encrypted
A downloaded updateIn ~/.cache/porch-mail/updates until it’s installed, checked against the release’s signatureNot encrypted (it’s the public app)
Decisions synced between your computers (off by default)A hidden folder in your own mailbox, on your mail provider’s serverNot encrypted: anyone who can read your mailbox can read it
  • No server of ours

    Mail goes straight between your computer and your provider. It is never routed through us.

  • No telemetry, no analytics, no crash reports

    The app doesn’t report how you use it, and has no crash reporter. If that changes, it will be opt-in and listed here first.

  • No remote content in your email

    The page an email is shown in may load images only through the app’s proxy, and only when you ask. Trackers are removed and reported per email.

  • Nothing written until you say so

    Accounts start read-only. Nothing changes on your mail server until you turn on mirroring for that account.

  • Only you can send

    Agent and command-line tokens can read, draft and organise. None of them can send mail, change settings or make new tokens.

§05 · Limits

What Porch Mail doesn’t hide.

Some things no mail app can keep private. Here’s where the line is.

  • Your provider has all your mail

    Porch Mail is a mail app, not a mail service. Gmail, Outlook, Fastmail or your own server still store every email and can read it, as they do with any app you use.

  • Email isn’t end-to-end encrypted

    The connection to your provider is encrypted, but the app doesn’t encrypt or sign the email itself (no PGP or S/MIME). Whoever runs the servers your mail passes through can read it.

  • Blocking doesn’t stop delivery

    A blocked sender’s mail still reaches your provider. The app holds it out of sight, and with mirroring on moves it on the server; the sender isn’t told either way.

  • Mirroring shows up everywhere

    With mirroring on, the app files mail into folders on your server, so your phone and webmail see the same moves. That’s the point, and it’s why it starts off.

  • A link you open is a visit

    Link cleaning strips tracking parameters, but opening a link still tells that site you came. Loading images tells their host your IP address.

  • What you send carries your address

    Your provider adds its own headers to mail you send, and some include the IP address you sent it from, as with any mail app.

§06 · Next

What’s done, and what’s coming before launch.

You shouldn’t have to take this page’s word for it. These are the checks other people can run.

  1. 01 · DoneA disclosure policy and security.txt

    Where to report a vulnerability, and how fast we answer.

  2. 02 · With the first releaseBuilds you can check

    A notarized Mac app, signed checksums and a software bill of materials for every release.

  3. 03 · Not yetAn independent audit, published in full

    A white-box review by an outside security firm. The whole report goes on this page.

  4. 04 · Not yetGoogle’s CASA assessment

    Google requires it each year for apps that read Gmail over OAuth.