Ordo Mail Privacy Policy

Effective date: 1 November 2026

Ordo Mail is a mail app for the Mac made by Alejandro Garcia, Balkenweg 23, 4460 Gelterkinden, Switzerland ("we", "us"). This policy explains what happens to your data when you use Ordo Mail and its optional Auto Sort subscription.

Contact for all privacy questions and requests: support@ordomail.app

The short version #

• Your mail travels between your Mac and your mail provider. We do not run a mail server, and we never receive your mail passwords.
• The free mail app sends us nothing.
• If you turn on Auto Sort and agree, a short extract of each new inbox email is sent through our server to an AI service so it can pick a label. We do not store the extract, and every request asks the AI service not to keep it and not to use it to train AI models (details in section 2).
• So that an email is never sorted or charged twice on your Mac, iPhone and iPad, our server keeps a short record for each sorted email: a scrambled key, the label it got, whether you ticked it off or set a reminder, and the name of the device that sorted it. Never the email itself (section 3).
• If you turn on Needs You notifications on an iPhone or iPad, our server keeps that device's push address so your Mac can have it told, through Apple's push service, that an email needs you. The notification carries no sender, subject or text; your iPhone or iPad reads those from your mail provider itself (section 3).
• We do not sell your data, show ads or track you.
• There is no Ordo Mail account. We do not know your name or your email address unless you write to us.

1. Data that stays on your Mac #

Ordo Mail stores the following only on your Mac, inside the app's own sandboxed folder:

• the list of emails it has fetched and sorted (sender, subject, date, label and the reason for the label);
• a cache of messages you opened, so they open quickly and offline;
• drafts you are writing and messages waiting to be sent (in the Outbox or for Send Later), with their attachments; drafts are also saved in your account's Drafts mailbox;
• your labels, settings and corrections;
• what the app has learned about each sender (for example how often you read or answer them);
• whether and when you agreed to Auto Sort sending email extracts.

Your mail passwords are stored in the macOS Keychain on your Mac. They are sent only to your mail provider's servers (for example imap.gmail.com and smtp.gmail.com for Gmail; imap.mail.me.com and smtp.mail.me.com for iCloud Mail; for any other provider, the servers shown when you connect the account) over an encrypted connection, to sign in.

Finding your mail servers. When you connect an address whose domain the app does not know, it asks the domain name system for the domain's mail servers, and asks for the domain's published mail settings at autoconfig.<your domain> and at Mozilla's public provider list (autoconfig.thunderbird.net). Only the domain, such as "example.com", is sent; your address and password are not.

We cannot see any of this data.

To notice new mail at once, Ordo Mail on your Mac keeps one connection per account open to your mail provider's server (IMAP IDLE). New-mail notifications on your Mac are local notifications. Nothing is sent to us for either.

On iPhone and iPad. The same applies there: mail, passwords (in the device's Keychain) and everything listed above stay on the device. iOS does not let an app keep a mail connection open in the background, so an iPhone or iPad cannot notice new mail by itself. If you turn on Settings > Notifications > Needs You there, your Mac, while it runs Auto Sort, reports to our server which new emails need you, and our server asks Apple's push service to notify your iPhones and iPads (section 3). When the notification arrives, the iPhone or iPad fetches the email's sender and subject from your mail provider, with the password stored on it, and shows them. Nothing of the email passes through our server or Apple's push service.

So that Spotlight and Siri can find your mail, Ordo Mail adds your newest emails (up to 2,000; the sender, the subject and the start of the text) to the Spotlight index on your Mac. This index stays on your Mac and is removed with Erase All Data. Sample mail is never added.

Where the app offers suggestions made by Apple's on-device model, these are computed on your Mac. Nothing is sent to us or to the AI service for them.

Sample mail. "Try with sample mail" shows fictional emails that are built into the app. In this mode the app makes no network connection, uses no passwords and keeps nothing after you quit.

2. Data sent to the AI service when you use Auto Sort #

Auto Sort is optional. Nothing described in this section is sent until you have agreed to it on the permission screen in the app. You can withdraw your agreement at any time in Settings; from that moment nothing more is sent.

What is sent for each email that is sorted

• the sender's name and email address;
• how many other people the email was addressed to (never their addresses);
• whether your mail provider confirmed that the email comes from the sender's domain, the domains the email's links lead to (for example example.com), never the full links, and the domain replies would go to when it is not the sender's own;
• the subject, and the first 1,000 characters of the text, both with long numbers such as sign-in codes replaced and link parameters removed;
• your label names, descriptions and up to 6 example subjects per label, and the same for label ideas you have not dismissed (name, description and up to 4 example subjects from your own mail);
• up to 12 short examples of earlier emails you marked as needing or not needing you (sender and subject, together at most 60 characters);
• a one-line summary of your history with that sender (for example how often you reply).

Attachments are never sent. The rest of a long email is never sent. The answer that comes back is a label and a few probabilities.

What is sent for a label review

From time to time Auto Sort reviews your labels and proposes improvements, which you can accept or dismiss. It starts by itself, at most twice per subscription month. For a label review the app sends one summary:

• your label names and descriptions and how many emails each holds;
• your up to 250 most frequent senders (first 40 characters of the sender name), how many emails each sent, which labels they received and up to three subjects each (first 60 characters);
• up to 40 emails you labelled by hand (sender, first 60 characters of the subject, the label you chose).

Email bodies are not sent for a label review. To count how many emails a proposed label would catch, the app sorts up to 150 emails that currently carry the Review label again, in the way described above.

Who receives this data

Every request asks Vercel AI Gateway for zero data retention. Vercel states that the gateway does not retain prompts or outputs and that, with this setting, requests are routed only to providers that have a zero-retention agreement with Vercel and do not use the data to train models. TypeSafe AI's stated terms are that it does not keep prompts longer than needed to produce the answer, except where the law requires it. OpenAI's zero-retention terms allow limited retention where needed for safety and abuse monitoring. These companies handle the data under their agreements with us and are required to protect it at least as well as this policy describes.

3. Data our server keeps #

To check that a request comes from a genuine copy of the app and to apply the limits, our server keeps:

• an identifier in scrambled form (a one-way SHA-256 hash). For subscribers and trial users it is made from the App Store transaction identifier of your subscription; for the free emails it is made from the identifier the App Store issues for your copy of the app. Neither contains your name, your email address or your Apple Account, and we cannot turn the hash back into the identifier;
• counters under that hash: how many emails were sorted and how many label reviews were run in the current period, and a short-lived count of requests per minute that prevents misuse;
• sort records, when you use Auto Sort: one per email that Auto Sort sorted or that you filed by hand, shared by your devices so that each email is sorted, and paid for, only once and carries the same label everywhere. A record holds a key made from your mail account and the email's Message-ID with a one-way SHA-256 hash (it contains neither, and we cannot turn it back), the identifier of the label the email got (for labels you created, an identifier made from the label's name), whether you chose it by hand, whether it was already written into your mailbox, the scores Auto Sort gave it (how likely it needs action, how important it is, how soon), whether you ticked it off in Needs You and whether it needed you, the time of a reminder you set for it, the name of the device that sorted it as your device calls itself, for example "Lea's MacBook Air", and the time. It never holds the sender, the subject or any text of the email;
• push registrations, when you turn on Needs You notifications on an iPhone or iPad: for each such device, the push token Apple's push service gave it, a random identifier the app made when it was installed, whether it is a test or App Store build, and the time it registered. Stored under the scrambled identifier, at most 10 devices. Turning the switch off deletes that device's registration at once;
• notifications sent: for each email announced to your devices, the key of its sort record (the one-way hash described above), so that it is announced only once. Kept for 3 days. A notification itself holds the text "1 email needs you" and, so the device can find the email, a scrambled tag of the mail account (a one-way hash of the address, never the address), the email's number in the inbox and the inbox's version number. It never holds the sender, the subject or any text of the email;
• one technical record per request, without any email content: time, type of request, the first 8 characters of the hash, the plan (free emails, trial or subscriber), whether the purchase proof came from the App Store or from Apple's test environment, result code and a fixed error word where a request failed, duration, size of the request in AI tokens, and the app version. These records are kept for up to 30 days to prevent abuse and fix faults.

Our hosting provider processes your IP address to deliver each request, as every web server does. We do not write IP addresses into our own records and do not use them to locate or identify you.

Sort records are deleted automatically 120 days after their last change, and all of them 121 days after your devices last sent one. Push registrations are deleted 121 days after a device last registered (the app registers again each time it starts while the switch is on), or at once when you turn the switch off. Subscription and trial counters are deleted automatically 70 days after their last use, so at the latest within 90 days after the period they belong to has ended. The free emails counter is kept for as long as the app is offered, so that the free emails cannot be used again, and is deleted earlier if you ask us.

Our server does not store the content of your emails, your email address, the names or descriptions of your labels or your mail passwords.

4. Data you send us directly #

If you email us for support, we receive your email address and whatever you write. We keep support mail for up to 24 months and use it only to answer you.

Our website (ordomail.app) uses no cookies, no analytics and no content from other sites. Its hosting provider processes your IP address to deliver the pages.

5. What we do not do #

• No advertising, no analytics tools in the app, no tracking across apps or websites.
• No selling or renting of personal data.
• No use of your email content to train AI models, by us or, under the settings we use, by our providers.
• No fully automated decisions with legal or similarly significant effects. Ordo Mail only labels and files mail according to the rules you set, and you can change every decision.

6. Remote images in emails #

Ordo Mail does not load remote images or run scripts in emails. If you choose to load images for an email, your Mac fetches them directly from the sender's servers, which then see your IP address and that the email was opened.

7. Legal bases (EEA, United Kingdom, Switzerland) #

• Providing Auto Sort, the free emails, the trial and the subscription: performance of our contract with you (GDPR Art. 6(1)(b)).
• Sending email extracts to the AI service: your consent, given in the app before the first extract is sent (GDPR Art. 6(1)(a)). You can withdraw it at any time in Settings.
• Sort records shared by your devices: performance of our contract with you, as part of Auto Sort (GDPR Art. 6(1)(b)).
• Push registrations and notifications: performance of our contract with you, at your request when you turn on Needs You notifications (GDPR Art. 6(1)(b)).
• Abuse prevention, allowance counters and technical records: our legitimate interest in keeping the service secure and affordable (GDPR Art. 6(1)(f)).
• Tax and accounting records: legal obligation (GDPR Art. 6(1)(c)).

Emails can contain personal data of other people (the senders) and sometimes sensitive information. You decide which mailboxes to connect and whether to use Auto Sort. Please do not use Auto Sort on mailboxes where you are not allowed to pass content to a processing service, for example under an employer's or a professional secrecy rule.

8. Transfers to other countries #

Our server and the AI service are operated in the United States and possibly in other countries listed by Vercel for its providers. For these transfers we rely on the European Commission's Standard Contractual Clauses, with the Swiss and UK additions, which are part of our agreement with Vercel. You can ask us for a copy.

9. Your rights #

Depending on where you live, you can ask us to tell you what data we hold about you, give you a copy, correct it, delete it, restrict or object to its use, and you can withdraw consent. Because we have no account for you, the only data we can look up is the counters and sort records stored under the scrambled form of your App Store identifier (section 3).

To use these rights, write to support@ordomail.app. We answer within 30 days. You can also complain to your data protection authority: in the EU the authority of the country where you live, in the United Kingdom the Information Commissioner's Office, in Switzerland the Federal Data Protection and Information Commissioner.

California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA.

10. How to revoke consent and delete your data #

• Stop sending email extracts: open Settings in Ordo Mail and turn off the permission for Auto Sort. Nothing more is sent. You can also cancel the subscription (see below); the mail app keeps working.
• Stop notifications on an iPhone or iPad: turn off Settings > Notifications > Needs You in Ordo Mail on that device. Our server deletes its push registration at once.
• On your Mac: removing an account in Settings deletes that account's password from the Keychain and its mail records from the app. To remove everything the app keeps, choose Settings > General > Erase All Data; it removes every account, password, label and mail record and returns the app to its first start. Deleting the app afterwards removes the rest of its folder.
• On our server: email support@ordomail.app and include the Support ID shown in the app under Settings > Auto Sort, which lets us find your counters and sort records. We delete them within 30 days; technical records expire by themselves within 30 days. Without a request they are deleted on the schedule in section 3.
• In your mailbox: labels and folders that Ordo Mail created in your mailbox belong to your mailbox and stay until you remove them there.
• Subscription: cancelling is done in your App Store account settings (https://apps.apple.com/account/subscriptions).

11. Children #

Ordo Mail is not directed at children under 16, and we do not knowingly process data of children.

12. Security #

All connections use TLS encryption. Passwords are held in the macOS Keychain. The app runs in Apple's App Sandbox. Our server accepts only requests that carry a valid proof signed by Apple, and it holds no long-lived key for the AI service. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

13. Changes #

If we change this policy in a way that matters, we will show a notice in the app before the change takes effect, and ask for your consent again where the law requires it. The current version is always at https://ordomail.app/privacy.

Gmail is a trademark of Google LLC. iCloud, Mac and macOS are trademarks of Apple Inc. Ordo Mail is an independent app and is not affiliated with, sponsored by or endorsed by Google or Apple.

Back to the top