Privacy policy

mirrorinbox is an app that keeps a copy of your mail, contacts and calendars on your computer, and mirrorinbox.com is the site you download it and its updates from. This page sets out how we collect, use and disclose Personal Information, as the Australian Privacy Act 1988 (Cth) defines it, when you use the app or the site (the Service). We don't use or share your information except as this policy says.

What stays on your computer

Your mail, contacts, calendars and mail settings, the search index mirrorinbox makes of them, its backups, the app's settings and your sign-ins are kept on your computer, in folders you choose, and never sent to us. The sign-ins are kept in your system's own store for them: the keychain on a Mac, the Credential Manager on Windows, or the Secret Service (such as GNOME Keyring) on Linux. Where a system has none, they are kept in a file only you can read.

Google

When you add a Google account, you give the mirrorinbox app on your computer permission to:

• read your Gmail messages and labels, to keep a copy of them;
• change them, when you archive, delete, star, label, move or mark messages in the app, or copy mail into the account;
• send mail you write in the app;
• read Gmail's settings, such as filters, signatures and forwarding, to keep a copy of them;
• read and change your contacts, and read the "other contacts" Gmail keeps of people you've written to;
• read your calendars, and make, change and delete events when you ask it to.

The app uses these permissions only for what you see it do: to keep the copy on your computer, to show it to you, and to make the changes you ask for. It talks to Google directly from your computer: nothing from your Google account passes through our servers. The sign-in page is Google's own, opened in your browser, and what you type there goes only to Google.

We do not sell, share or transfer your Google data, use it for advertising, or use it to train any model, and no person reads it. mirrorinbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft and other mail services

A Microsoft 365 or Outlook.com account is signed in to on Microsoft's own page, and mirrorinbox reads and changes its mail, contacts and calendars as you ask, directly from your computer. Another mail service, such as iCloud, Yahoo or Fastmail, is reached with the address and password (usually an app password) you give the app, which it keeps with your other sign-ins. None of it passes through our servers. What Google, Microsoft and your mail service collect is covered by their own privacy notices. mirrorinbox isn't made by, or connected with, any of them.

Copying between accounts

When you copy one account into another, mirrorinbox reads the mail, contacts and calendars from the first and writes them into the second, from your computer. They go only to the account you choose.

Things you choose to share

• Pictures from the web. Pictures in a message that come from the web are not shown until you ask, because loading them tells the sender's servers that the message was opened, and your IP address.
• Outlook add-ins. An add-in is a page from the company that makes it, which you add yourself. When you open one beside a message, it is shown that message, and its attachments if it asks for them, and what it does with them is covered by that company's privacy policy. It isn't shown other messages.

What we collect

• Log data. Our web server records each request: the page asked for, the time, your IP address and your browser. The logs are deleted automatically as they age.
• What the app sends. Every so often the app asks the site whether there's a new version. On a Mac the request carries the app's version and the version of macOS; it carries nothing about you, your accounts or your mail. Linux and BSD systems that installed mirrorinbox from our repositories ask them for updates in the same way.

There is no account to make with us and no sign-in to the site, and we keep no list of who uses mirrorinbox.

Cookies

The site sets no cookies, and has no analytics, advertising or third-party scripts.

How we use it

Only to provide the downloads and updates, and to keep the Service running and secure. We don't sell it or use it for advertising.

Service providers

Linode hosts the server, and may hold its logs in Australia, the United States and other countries. It may use them only to do this work for us.

How long we keep it

Logs are deleted automatically as they age. We hold nothing else of yours. To remove what's on your computer, remove the account in the app, which deletes its sign-in (and gives a Google sign-in back to Google), and delete its folder. You can also withdraw mirrorinbox's access to a Google account at myaccount.google.com/permissions, or to a Microsoft account at account.microsoft.com.

Security

The site is served only over HTTPS, and the app talks to Google, Microsoft and mail services only over encrypted connections. The Mac's updates and our Linux and BSD repositories are signed, and are checked against their signatures before they install. No way of sending or storing information over the internet is completely secure, though, and we can't guarantee it.

Links to other sites

The Service links to sites we don't run, such as Google's. We aren't responsible for what they do or for their privacy policies.

Children

The Service isn't meant for anyone under 13, and we don't knowingly collect information about children under 13. If we find we have, we'll delete it.

Access and correction

You can ask us at any time for the personal information we hold about you, or to correct or delete it, by emailing us. We'll acknowledge your request promptly. If we refuse, we'll tell you why in writing, unless the law allows us not to, and how you can complain. We don't charge for correcting your information.

Enquiries and complaints

For any question or complaint about this policy, how we handle your personal information, or our compliance with the Australian Privacy Act 1988 (Cth), email admin@mirrorinbox.com. We usually reply in writing within 30 days. You can also contact the Office of the Australian Information Commissioner on 1300 363 992 or at enquiries@oaic.gov.au.

Changes to this policy

We may change this policy from time to time. The current version is always on this page.