Privacy Policy

Effective date: August 23, 2026

Mail MCP is a user-directed mail integration that connects authorized mail accounts to compatible MCP clients. This policy explains how Mail MCP handles account and Google user data.

Information we collect

• Mail MCP account information: username, password hash, account status, and creation time.
• Connected mailbox configuration: email address, mail username, server addresses, ports, and security settings.
• For Gmail connections: the Google email address and an OAuth refresh token. Mail MCP requests the https://mail.google.com/ scope to read and send mail through Gmail IMAP and SMTP using XOAUTH2.
• Operational security data normally produced by the web server, such as request time, route, status code, and network address.

How information is used

Data is used only to authenticate users, maintain their connected mail accounts, retrieve mail they request, and send messages they explicitly request. Google user data is not used for advertising, credit decisions, surveillance, profiling, or sale.

Storage and retention

Mailbox passwords and Google refresh tokens are encrypted at rest. Account configuration and authorization records remain stored while the account or connection remains active. Mail MCP does not indefinitely cache or persistently copy email messages or attachments into its database; requested mail is accessed live from the provider. Short-lived access tokens may be held in memory only while completing a request.

Sharing and disclosure

Mail data is returned only to the authenticated user's authorized MCP client and is transmitted to the relevant mail provider when performing a requested operation. It is not sold or shared with advertisers or data brokers. Information may be disclosed when required by law or when reasonably necessary to protect the service against abuse or security threats.

Google API Limited Use

Mail MCP's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Security

The service uses HTTPS in transit, encrypted mailbox credentials and Google refresh tokens at rest, password hashing, OAuth authorization, and per-user access controls. No internet service can guarantee absolute security.

User choices and deletion

Users can revoke Mail MCP access from their Google Account permissions. To request removal of a Mail MCP account, connected mailbox configuration, or stored authorization tokens, contact the service administrator. Revoking Google access prevents future Gmail access but does not by itself delete the local Mail MCP account.

Changes

This policy may be updated when service practices change. Material changes affecting Google user data will be disclosed and, where required, users will be asked to consent before the new use begins.