Godwit Privacy Policy

Summary

Godwit is an open-source desktop email client made by The Godwit Authors. This policy covers the Godwit app, however you got it (the website, Homebrew or the Microsoft Store), and the godwit.email website.

Godwit has no accounts, the app has no telemetry, and no server relays your mail. Your mail, passwords and chats with AI never reach us. The app connects only to the services you set up and the few places listed below.

What stays on your computer

Synced mail, drafts, attachments, the search index, settings and the image cache live in the data directory on this computer: .godwit in your user folder on Windows, ~/Library/Application Support/Godwit on macOS, ~/.config/Godwit on Linux.

Mail passwords, sign-in tokens and model API keys live in the system keychain. They are never written to config files and never appear in logs.

All of this stays on your computer. To remove it, delete your accounts and then the data directory.

Where Godwit connects

Your mail provider: mail is sent and received over IMAP/SMTP, directly, with nothing in between. Outlook accounts sign in with Microsoft, which connects to Microsoft's sign-in service.

Your model services: Godwit sends content to a model only once you add one. That includes what you ask AI to work on (summaries, translation, writing, chats with Wit) and automatic classification: labeling is on by default and gives new Inbox mail to your configured model to label, and notification filtering and verification-code detection also use a model. You can turn automatic labels off in Settings. With a local model such as Ollama, the content never leaves this computer. What a model provider does with it is up to its own policy.

Remote images and sender avatars: loaded automatically by default. Godwit downloads them for you, without cookies or a referrer, and fetches them as new mail arrives, so senders cannot tell when you read a message, but they still see this computer's IP address. For old messages, cache misses or expired entries, and manual loading, requests may still happen while you read, and senders may infer your reading time. Avatars may be requested from the sender's website and from Gravatar, which is queried with a SHA-256 hash of the sender's address, not the address itself. Images in Junk never load by themselves. In Settings › Remote images you can switch to trusted senders only, or ask each time.

Plugins and MCP: a plugin reaches only the hosts it declared and you approved. MCP servers are ones you add: a stdio server runs as a program on your computer with only PATH and the environment variables you set; an http server connects to the address you enter. Each server is approved once, and every write call asks you first.

Local API: off by default. When on, it listens only on this computer, and scripts and AI tools here can reach Godwit through it. The full Local API can read and send mail and change accounts and settings; AI tools connected through godwit mcp can only read mail and create drafts, never send.

Update checks: new version information and installers come from dl.godwit.email; nothing is uploaded. A version installed from the Microsoft Store is updated by the Store; when About opens, Godwit asks the Store's public catalog (displaycatalog.mp.microsoft.com) for the latest version number, without any account information.

The website

godwit.email is a static website served through Cloudflare, which may keep standard access logs, such as IP addresses. The website, not the app, uses Umami to count visits and button clicks, such as which platform was downloaded, without cookies and without recording anything you type or copy; a download through the website is also counted by the server, with the platform, the referring site and the browser, but not your IP address. The app itself contains no analytics or telemetry.

What we do not do

We have no servers that receive your mail, passwords or chats. We do not sell data, show ads, or pass your data to third parties, because we do not have it.

Microsoft Store

If you install Godwit from the Microsoft Store, Microsoft handles download, installation and diagnostic information under its own privacy statement. That data is not passed to Godwit.

Your choices

At any time you can: remove an account; turn off automatic labels; use a local model, or add no model service at all; set Remote images to ask each time; turn the Local API off; remove plugins and MCP servers; delete the data directory.

Children

Godwit is not directed to children, and we do not knowingly collect their information.

Changes and contact

This policy is updated with Godwit, and its history is public at https://github.com/godwit-email/godwit. Material changes are noted in the release notes.

Questions: https://github.com/godwit-email/godwit/issues.