Your privacy matters.

Effective: 3 November 2026 · Updated: consolidated notices.

Your privacy matters.

YourF stores your account, synchronized mail, calendar and notes to run your workspace. Mailbox credentials are encrypted; passwords and connection tokens are hashed or encrypted. Mail is encrypted in transit, not end-to-end.

We store your chosen address, name, country, optional phone number, recovery email, encrypted mailbox credentials, and your mail, calendar and notes to operate your account. Passwords are hashed; transport uses HTTPS and secure mail protocols.

YourF processes your name, email, account ID, contacts, mail, messages, photos, videos, audio, files, calendar events, notes, boards, chess content and account login activity. To provide messaging and meetings, we process conversations and attachments, including voice messages, meeting details and media, and recordings you create. We store contacts for your address book, board content for shared workspaces, and chess games and moves to run games. When you allow native notifications, we store a device token, also called a device push token, to deliver them.

YourF stores mail in its mail engine and account, synced mail, calendar and notes data in PostgreSQL. Mail is encrypted in transit, not end-to-end.

Registration and first/last sign-in summaries remain until deletion. Login history shows accepted sign-ins and identified password or two-step failures for 90 days.

Cloudflare Turnstile checks sign-in and signup requests to prevent abuse. Google, Apple or Microsoft receives your sign-in request only when you choose that provider. Session cookies are necessary for sign in. We do not sell your messages or use advertising analytics on this page. Recovery emails are used for account verification and password reset. You can permanently delete your account and mailbox in Settings.

Trashed notes and completed, cancelled or dismissed send replay records expire after 30 days.

Export includes managed-mailbox folders, calendar, contacts and notes, excluding external mailboxes, remote-only data, collaboration content, credentials and note attachments. Downloads expire 24 hours after completion.

AI is off by default. Native notifications use Apple APNs or Google FCM. Mail sender and subject previews are off by default; chat text previews are on by default. Each has a separate setting.

Connecting ChatGPT requires your explicit OAuth consent. Only the account and resources covered by the permissions you approve are accessible. Mail, calendar, meeting and news tool results are sent to OpenAI when you use the connection and are subject to your OpenAI account’s data controls. Google-connected mail is excluded from this connection. YourF does not share mailbox passwords with OpenAI, sell mail or use advertising analytics.

Connection tokens expire and can be revoked in Settings. Prepared action plans expire after fifteen minutes; expired plan contents are removed by hourly housekeeping after two days. Support form requests are retained in the operator’s private contact inbox to answer your request. Disconnecting external mail preserves the provider’s original mailbox. Deleting YourF permanently removes your owned mailbox and application data.

Data and processors

YourF sends data to the outside services below only for the reasons listed. Services marked optional stay off until you turn them on, and a sign-in or mailbox connection happens only when you start it. This list covers outside services that receive data from the product; it does not describe the servers that run YourF itself.

Cloudflare Turnstile
When it is contacted
On the sign-in, account-creation and support forms, which are protected by a CAPTCHA.
What it receives
Your browser loads the check from Cloudflare, so Cloudflare receives your IP address and the browser signals it uses to tell people from bots. YourF’s server then sends the check’s token to Cloudflare to confirm that it is valid.
Google, Apple and Microsoft sign-in
When it is contacted
Only when you choose to sign in with, or link, one of these accounts.
What it receives
The provider receives the sign-in request and shows you its own consent screen. YourF receives identity tokens that identify your account at that provider, for example an account ID and, if the provider shares them, your name and email address. YourF never links an existing account just because an email address matches.
Gmail and Microsoft mailbox connections
When it is contacted
Only when you connect a Gmail or Microsoft mailbox. This is a separate permission from signing in, and you can disconnect it at any time.
What it receives
The provider receives the authorization and token requests, and then the requests YourF makes on your behalf, such as reading, moving, sending or deleting messages. YourF receives mail access within the permissions you approve. Disconnecting removes the local connection and cache, not your mailbox at the provider. Google data follows the Limited Use section of this page.
AI provider (optional)
When it is contacted
Only after you turn on AI in Settings. Google-connected mail is excluded.
What it receives
Message text and compose instructions, sent to produce summaries, drafting help and classifications. Statement from this server: AI is off by default. When enabled, message text and compose instructions are sent to the configured AI provider to generate results. Google mail is excluded. You can turn AI off at any time.
ChatGPT connection (optional)
When it is contacted
Only after you authorize ChatGPT to use your YourF account, and only for the permissions you approve. Google-connected mail is excluded.
What it receives
Results of the mail, calendar, meeting and news tools that ChatGPT calls while you use the connection. They are then subject to your OpenAI account’s data controls. You can revoke the connection in Settings.
Gravatar
When it is contacted
Only if you turn on Gravatar lookups in Settings. They are off by default.
What it receives
A SHA-256 hash of the email address shown beside an avatar, plus the technical details of a web request. The request comes from the YourF server, so your IP address is not sent.
Twenty Icons
When it is contacted
Only if you turn on sender website icons in Settings. They are off by default.
What it receives
The sender’s domain name (and parent domains if no icon is found), plus the technical details of a web request. The request comes from the YourF server, so your IP address is not sent.
Web push services
When it is contacted
Only if you turn on browser notifications and your browser registers a push subscription.
What it receives
An encrypted notification delivered to the push endpoint run by your browser’s vendor, for example Google, Mozilla or Apple. The vendor can see the endpoint, the size and the timing, but not the content, which is encrypted for your browser. The text is generic, such as “New mail has arrived”, without sender or subject.
Native push services
When it is contacted
When a signed-in iOS or Android app registers a device for enabled notifications and the relevant service is configured.
What it receives
Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM) receives the device token, notification type, opaque identifiers, alert text and sometimes an unread count for mail. Mail sender and subject previews are off by default; chat sender or group name and chat text previews are on by default. You can change these settings separately. Notifications may appear on your lock screen.
Services you choose to reach
When it is contacted
When you connect an external mailbox, allow remote images or use a message’s one-click unsubscribe.
What it receives
Your external mail provider receives the IMAP, SMTP or OAuth requests that YourF makes with the access you supplied. Remote images are blocked by default; if you allow them, your browser loads them directly from the sender’s servers. One-click unsubscribe sends one HTTPS request from the YourF server to the address the sender published, without following redirects.
News sources
When it is contacted
On a schedule, independent of any account.
What it receives
Publishers receive ordinary web requests from the YourF servers. No account information is included.
Breached-password check (Have I Been Pwned)
When it is contacted
When you create an account or change or reset your password. Operators can switch this off.
What it receives
YourF’s server sends the first five hex characters of a SHA-1 hash of the new password to the Have I Been Pwned range API (api.pwnedpasswords.com) and compares the returned list locally, so the service never learns the password or its full hash. The request carries no account, email address or session, and the service sees only the YourF server’s address. It is used to refuse passwords found in known breaches. If the service cannot be reached, the password is accepted under the normal rules.

Your controls

When you connect Gmail

You choose the Google account and approve its access in Google’s authorization window. YourF accesses email headers, message bodies, attachments, folders and read status to provide synchronization, search, reading, organization and sending. A synchronized copy is stored in your private YourF workspace; connection tokens are encrypted. Disconnecting removes the local connection and cached mail while preserving the provider’s mailbox. Google access can also be revoked in your Google Account.

Ordinary deletion moves messages to Trash. A separate “Delete permanently” confirmation removes the selected Gmail message without moving it to Trash; that action cannot be undone.

Limited Use and AI

YourF’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. YourF does not use Google Workspace data to develop, improve or train generalized artificial intelligence or machine learning models.

Google-connected mailboxes are excluded from YourF’s AI classification, AI summaries and ChatGPT mail connection. Reading, searching, sending and organizing Gmail inside YourF remain available. This restriction covers data supplied directly by these integrations; content you independently copy or share elsewhere is governed by that action and destination.

YourF does not sell Google user data, use it for advertising or disclose mailbox passwords to AI providers. Non-Google tool results can be shared with OpenAI only through a separately authorized ChatGPT connection, subject to the permissions you approve.

Your privacy matters.