StarMail privacy policy
Last updated: 26 October 2026
StarMail is a Windows desktop app that displays your Gmail accounts read-only. This policy explains what data it accesses and what it does with it.
Data the app accesses
When you sign in with Google, StarMail requests only these scopes:
https://www.googleapis.com/auth/gmail.readonly— to read your messages, labels and attachments so they can be displayed.openidandemail— to identify which Google account is signed in.
The app never sends, modifies or deletes mail.
Where your data is stored
- All mail stays on your own PC. It is cached locally so it can be shown quickly.
- The cache is encrypted at rest with authenticated encryption. The encryption keys are protected by Windows DPAPI, which ties them to your Windows user account.
- OAuth refresh tokens are stored locally, encrypted with Windows DPAPI.
Sharing
StarMail has no servers and contains no analytics, advertising or tracking. Your data travels only between your PC and Google's own APIs. It is not sold, shared with or transferred to any third party, and it is not used for advertising or to train AI models.
Google API Services User Data Policy
StarMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Deleting your data and revoking access
- Signing out of an account in StarMail revokes the app's access at Google and deletes that account's local cache.
- You can also revoke access at any time at myaccount.google.com/permissions.
Children
StarMail is not directed at children under 13.
Changes
If this policy changes, the new version will be posted on this page with an updated date.