Privacy Policy
- Your mail goes straight between your device and Google. Mach talks to Gmail and Google Calendar directly from your iPhone, iPad or Mac. There's no Mach server in between, and the developer has no access to your mailbox.
- No accounts, no tracking, no ads. Mach has no sign-up of its own, no analytics, no advertising and no tracking or crash-reporting SDKs, and it never sells data.
- AI runs on your device unless you add Claude. Apple's on-device model handles search, sorting, quick replies and short summaries. If you add your own Anthropic API key, Claude features send the emails they need to Anthropic.
- Team features are optional. Read statuses, team comments and shared conversations work only if you connect Mach to a Mach Cloud server, and whoever runs that server can see what it stores.
What Mach keeps
To show and manage your email, Mach keeps:
- Your Google account: email address, name and profile photo, and the sign-in tokens that let Mach reach Gmail and Google Calendar.
- Copies of your mail so it opens instantly: folder lists, the conversations you open or that Mach loads ahead (with message bodies), attachments you open, translations, a search index, and your Google Calendar events.
- What Mach works out from your mail: contacts for address suggestions (people you write to and who write to you), packages and tracking numbers from shipping emails, Auto Labels, and AI summaries and drafts.
- Things you set up: signature, snippets, splits, swipe actions, reminders, scheduled sends, recent searches and other settings.
- If you add them: your Anthropic API key, your Mach Cloud address and team token, developer credentials for carriers' tracking services, and an Amazon sign-in for package tracking.
- If you use read statuses: the messages you sent with one, and when they were opened.
Mach doesn't read your contacts or photo library, doesn't collect your location, advertising identifier or device identifiers, and doesn't ask you to create a Mach account.
Where it's stored
- On your device, in Mach's app storage (on a Mac, in your user Library, under Application Support and Caches). Home Screen widgets read a small snapshot (for example, recent inbox conversations, upcoming events and packages) that stays on your device. New-mail notifications show the sender, subject and a preview, on the Lock Screen too if your notification settings allow it.
- In your iCloud account, so your iPhone, iPad and Mac stay in step. Settings sync through iCloud key-value storage, including your account list (addresses and names), signature, snippets, splits, recent searches, which calendars you hide, your Mach Cloud address and Google sign-in client ID, and the packages found in your mail (merchant, item, order and tracking numbers, the email's subject, and recent carrier updates with places). Sign-in tokens and keys sync through iCloud Keychain. Apple encrypts this data, and the developer has no access to it.
- In your Gmail account. Mach organizes your mail in Gmail itself: archiving, labels, read and starred state, drafts and sending all happen in your mailbox. Mach also adds its own labels under
Mach/, such as for reminders and Auto Labels, so your devices agree. By default, Auto Labels moves marketing, news and social mail out of your inbox; you can change that in Settings › Auto Labels & Drafts. - Scheduled sends stay on the device you scheduled them on, and Mach sends them while it's running there.
On iPhone and iPad, Background App Refresh lets Mach check your mail while it's closed (iOS decides when, at most every 15 minutes), with the same features as when it's open (including Auto Labels, the Digest, read statuses and carrier tracking services you've added). You can turn it off for Mach in iOS Settings › General › Background App Refresh.
Your Google data
Signing in
You sign in on Google's own page. Mach never sees your Google password. The tokens Google issues are kept in your Keychain. Mach asks Google for these permissions:
- Gmail (read, compose, send and organize your mail, and manage labels): to show, search and sort your mail, send what you write, and archive, label, trash, star or mark messages when you or your settings ask it to.
- Google Calendar (view your calendars, and view and edit events): to show your calendars beside your mail, and to create, change or delete events and answer invitations when you do. You can leave calendar editing unticked on Google's consent screen and keep a read-only calendar.
- Basic profile (your name, email address and profile photo): to show which account you're using.
With your permission, Mach can also show events from the calendars on your device. It reads them on the device and doesn't change them (Ask AI can include them in what it sends to Claude, below).
How Mach uses it
Mach uses Google data only to provide the features you see in the app: showing, searching and sorting your mail; sending; reminders and scheduled sends; Auto Labels, summaries, replies and drafts; packages from shipping emails; the calendar, Today and widgets. Your Google data is sent only where this policy says: to Anthropic if you turn on Claude features, to a Mach Cloud server if you set one up, and tracking numbers to carriers.
Mach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Google data is used only to provide or improve features you can see in Mach, and never for advertising, including retargeting and personalized or interest-based ads.
- It's transferred to others only as this policy describes, to provide those features; for security; to comply with the law; or as part of a merger or sale of the business, with your prior consent. It's never sold, and never given to advertising platforms, data brokers or other information resellers.
- It's never used to create, train or improve AI or machine-learning models.
- No person reads it. The developer has no access to your mailbox and would see your messages only if you share specific ones yourself, for example in a support request.
AI features
On your device
With Apple Intelligence on, Mach uses Apple's on-device model for natural-language search, Auto Labels, Instant Reply, the details it shows for a message, short summaries, Smart Compose, the Today overview, and the Digest when Claude isn't set up. This runs on your device and doesn't send your data anywhere. Prefer on-device AI (Settings › AI) is on by default.
Translation of emails uses Apple's Translation framework on your device. Dictation uses Apple's speech recognition, on the device where it's supported. Otherwise Apple processes the audio under its own privacy policy.
Claude, with your own Anthropic API key
These features are off until you paste your own Anthropic API key in Settings › AI. Requests go straight from your device to Anthropic, under your own Anthropic account, its privacy policy and its API terms.
| Feature | What is sent | When |
|---|---|---|
| Write with AI | Your instruction and draft, and the conversation you're replying to: up to its last six messages, shortened, with names, addresses, dates and attachment names. For Rewrite in my voice, also a few samples of emails you've sent. | When you use it |
| Draft a reply (Auto Drafts) | The conversation, as above, your name and address, and a few samples of emails you've sent, so the draft sounds like you. | When you ask for a draft |
| Ask AI | Your question, earlier questions and answers in the same chat, your name, address and time zone, the conversation you have open, a list of recent conversations with short excerpts, and what Claude looks up through Mach to answer: search results, whole conversations, calendar events (from Google Calendar or the calendars on your device) and tracked packages. | When you ask |
| Summaries | The conversation, as above. | Bullet summaries when you ask for one. One-line summaries appear when you open a conversation (Auto Summarize, on by default) and go to Claude only when the on-device model can't make them (for example, for a long conversation), isn't available, or Prefer on-device AI is off |
| Instant Reply | The conversation, as above. | When you open a conversation, only when the on-device model can't answer, isn't available, or Prefer on-device AI is off |
| Auto Labels | For each conversation in your inbox that hasn't been sorted yet: sender, recipients, subject, Gmail category, whether it's from a mailing list, and its latest message, shortened. After you add a key, conversations sorted earlier without AI are sent once too, up to 100 at a time. | Automatically as mail arrives, including during background refresh, only when the on-device model can't answer, isn't available, or Prefer on-device AI is off |
| Digest | For up to 40 newsletters, promotions and notifications that were kept out of your inbox: the sender's name, the subject and the start of the text (up to about 900 characters each). | Automatically once a day when the daily digest is put together (including during background refresh), and when you open a digest. With a key, Claude writes the digest even when Prefer on-device AI is on |
Remove your key in Settings › AI to stop all Claude features.
Read statuses and team comments (Mach Cloud)
Mach Cloud is an optional companion server for teams. Mach uses one only after you enter a server address and team token in Settings › Mach Cloud. It isn't set up by default. Whoever runs the server you connect to (you, your team or someone you trust) can see what it stores. Mach Cloud never connects to Gmail and doesn't store your Google sign-in or your mailbox.
With a server set up, Mach sends it your account's email address and name with each request, and the server lists everyone who has used it as a team member. Then:
- Read statuses (on once a server is set up; switch off in Settings › Mach Cloud). Mach adds an invisible 1×1 image to each message you send (it's in every copy, including Bcc copies and the one in your Sent folder) and registers the message with the server: a random code, the subject, the names and addresses of all recipients (To, Cc and Bcc), the Gmail conversation ID and the time sent. When a recipient's mail app loads the image, the server records the time, the app's or browser's identification string (user agent) and a guess at the kind of device. It doesn't store IP addresses. Mach shows you only the opens of your own messages. Your recipients aren't told that a message is tracked, and some mail apps load images automatically, so an open isn't proof that a person read it.
- Team comments (on once a server is set up; switch off Team comments & sharing in Settings). Comments you write are stored with your name and address, any teammates you mention, and the conversation's Message-ID. Anyone who uses the same server can read them. While you have a conversation open, Mach asks the server for its comments every 30 seconds, sending the conversation's Message-ID.
- Share Conversation. When you share a conversation, a plain-text copy (subject, and each message's sender, date and text) is stored on the server and published at an unlisted link. Anyone with the link can read it and add a comment with a name and, optionally, an email address.
Everyone on a team uses the same token, and the server doesn't check which teammate is asking, so anyone with the token, as well as whoever runs the server, could read what's stored there. Mach Cloud keeps this information until the person who runs the server deletes it. There's currently no way to delete read statuses, comments or shared conversations from inside Mach.
Other services Mach contacts
| Feature | What is sent | To |
|---|---|---|
| Gmail, Google Calendar and sign-in | What's needed to show and manage your mail and calendar, as described above. Your profile photo is loaded from Google. | Google, under its privacy policy |
| Pictures in emails | When Mach shows a message, its pictures load from wherever the sender put them, as in most mail apps. On the Mac this also happens when Mach prepares the conversation under the cursor so it opens instantly. That can tell the sender that, and roughly when, the message was viewed, along with your IP address. There's currently no setting to block remote pictures. | The servers the pictures are on |
| Package status | The tracking number from a shipping email. Mach opens the carrier's public tracking page on your device, in a hidden view, like a visit in a browser: the page's own scripts run, and the view keeps its own cookies from these sites. It checks each package that hasn't been delivered at most every 40 minutes (every 20 minutes when it's out for delivery), and when you open or refresh Packages. A package is first looked up only within 30 days of the email about it. On iPhone and iPad this happens only while Mach is open. It's automatic; there's currently no setting to turn it off. | UPS, FedEx, USPS, DHL or OnTrac |
| Carrier tracking services (optional) | Tracking numbers, with developer credentials you get from the carrier and add in Package Tracking settings. | That carrier |
| Amazon packages (optional) | If you sign in to amazon.com in Package Tracking settings, Mach reads Amazon's tracking pages for your Amazon orders with that sign-in. You sign in on Amazon's own page; Mach never sees or stores your Amazon password. | Amazon |
| Inbox Zero photos | With the photo background (the default), a request for that time of day's featured landscape photo when Mach opens and when the time of day changes. Nothing about you. | Wikimedia Commons |
| Unsubscribe | When you tap Unsubscribe, the sender's own unsubscribe request: a call to their unsubscribe link, or an email to their unsubscribe address from your account. | The sender |
What Mach never does
- It never sells, rents or shares your data for advertising or marketing.
- It never tracks you across apps or websites, and contains no analytics or advertising SDKs.
- It never sends your mail to a server run by the developer. Mail goes between your device and Google, and to Anthropic or a Mach Cloud server only as described above.
- It never uses your Google data to train AI models.
Your choices
- Remove an account in Settings › Accounts. Mach deletes its sign-in tokens, cached mail, learned contacts and search index for that account and asks Google to revoke its access. Other things Mach kept for that account, such as opened attachments, its calendar cache, AI summaries, scheduled sends, read-status records and packages, stay on the device until you delete the app. Removing an account on one device removes it from the account list on your other devices too. You can also remove Mach's access at any time in your Google Account, under third-party connections.
- Keep AI on your device with Prefer on-device AI, and remove your Anthropic API key to stop all Claude features. Auto Summarize, Instant Reply, Smart Compose, Auto Labels and Auto Drafts each have their own switch.
- Turn off read statuses (Settings › Mach Cloud) or Team comments & sharing (Settings), or remove the server in Settings › Mach Cloud.
- Package tracking: disconnect Amazon (which removes its cookies) and remove carrier credentials in Package Tracking settings.
- Clear cached mail, attachments and images in Settings › Storage.
- Erase everything by first removing your accounts, your Anthropic key, the Mach Cloud server and carrier credentials in Mach, then deleting the app on each device. Deleting the app removes its data on that device, but iCloud Keychain items you didn't remove in the app, and Mach's iCloud key-value data (settings and packages), can stay in your iCloud account.
Security
Mach protects your data with Apple's built-in security. Data on your device is protected by the system's encryption (on a Mac, by FileVault when it's on), iCloud data is encrypted by Apple, and sign-in tokens and keys are kept in the Keychain. Connections to Google, Anthropic, carriers and Mach Cloud use encrypted HTTPS. Mach only allows unencrypted connections to servers on your local network, for testing a Mach Cloud server there.
Children
Mach is meant for adults managing their own email and isn't directed at children under 13.
Changes to this policy
If this policy changes, the new version will be posted on this page with a new effective date. A change that affects how your data is used will also be explained in the app before it takes effect.