Privacy Policy
Last updated:
This policy covers the Tundra Mail desktop app ("Tundra" or "the app") and the website at tundra-mail.com ("the website"). Its publisher is Ihor Hulida, an individual based in England, United Kingdom, who uses the name Igor Gulida ("we", "us").
AI agents drafted this Privacy Policy under the direction of Ihor Hulida, the founder and product manager. This describes how the document was written; the publisher remains responsible for the personal data he handles and for meeting applicable legal obligations.
The short version
- Tundra is a desktop mail and calendar app. It is free for personal use.
- Tundra runs on your computer. Your mail, calendar, contacts, notes and settings are stored in a database on your computer.
- We run no Tundra server and there is no Tundra account. We never receive your mail, your calendar, your contacts, your passwords or your sign-in tokens, and we have no way to read, copy or recover them.
- The app talks directly to the services you connect: Google, Microsoft, your own mail and calendar servers, and any AI provider you add.
- AI is optional and stays off until you turn it on in Settings. When you use it, Tundra sends the content a task needs to the provider you chose, and that provider's own terms and privacy policy apply.
- The app has no analytics, no advertising and no crash reporter. The website code includes no analytics or advertising scripts. Cloudflare processes technical data to serve and protect the website.
- Because your data lives only on your computer, keeping it safe and backed up is up to you.
1. Who we are and how to reach us
Tundra Mail is published by Ihor Hulida, known as Igor Gulida, an individual based in England, United Kingdom. For anything about privacy, write to info@tundra-mail.com.
For the few pieces of personal data we do receive (described in section 13), we are the controller under the EU and UK General Data Protection Regulation (GDPR and UK GDPR).
The app processes your mail, calendar and contacts on your own computer and connects directly to the services you choose. We do not receive a copy of that data unless you choose to send it to us, for example in a support message.
2. How Tundra works
Tundra is installed on your own computer (macOS, Windows or Linux). When you add an account, Tundra connects from your computer directly to that account's provider:
- Gmail and Google Calendar, through Google sign-in (OAuth).
- Outlook and Microsoft 365, through Microsoft sign-in (OAuth).
- Other mail services through IMAP and SMTP, and calendars through CalDAV.
Sign-in happens in your web browser, on the provider's own page. The provider sends the result back to a temporary listener on your own computer. No Tundra server takes part at any point.
3. What the app stores, and where
Almost everything Tundra saves stays in one profile folder on your computer. The app window's built-in web engine also keeps a small store and cache of its own (for example your recent searches) in your system's app-data folders, listed on the Delete your data page. The profile folder holds:
| System | Profile folder |
|---|---|
| macOS | ~/.tundra-mail |
| Windows | %LOCALAPPDATA%\Tundra Mail |
| Linux | ~/.local/share/tundra-mail (or $XDG_DATA_HOME/tundra-mail) |
On Windows and Linux, an older install that already has a .tundra-mail folder in your home folder keeps using it.
The profile folder holds:
- A SQLite database (
data.db) with your messages, attachment details and text read from attachments, drafts, calendars and events, contacts, labels and folders, notes, snippets, rules, reminders, contexts, the Journal of changes, settings, and any results AI features produced for you. - Caches, such as downloaded attachments, draft attachments and images from messages.
- Local log files (
logsfolder). Logs can include account addresses, message subjects and error details. They are never sent anywhere. - Backups the app makes for you: a copy of the database taken before an app update changes its format, and snapshots of your settings, rules, signatures and snippets taken before an import or when you save one. Files you export are saved where you choose.
- A workspace folder (
agent-workspace) used by the assistant and by command-line agents you start in Tundra, holding installed skills and temporary excerpts of mail they were given.
Passwords, sign-in tokens and AI API keys are stored in your operating system's secure credential store (Keychain on macOS, Credential Manager on Windows, the Secret Service keyring such as GNOME Keyring or KWallet on Linux), under the name tundra-mail. They are not stored in the database.
The database is not encrypted by Tundra. It is protected by your computer's user account and any disk encryption you use, such as FileVault or BitLocker.
4. Google user data
This section describes what Tundra does with data it receives from Google APIs when you connect a Gmail or Google Workspace account.
Tundra is an installed desktop app, free for personal use. It has no publisher-operated mailbox backend: Google sign-in, token exchange and mail, calendar and contacts requests run directly between your computer and Google. The website and support-email services do not receive this Google API data as part of the app's operation. Business licensing is separate, as described on the Pricing page; we do not sell Google user data or use it for advertising.
What Tundra asks Google for, and why
| Permission (scope) | What it lets Tundra do | Why Tundra needs it |
|---|---|---|
https://www.googleapis.com/auth/userinfo.email | See your Google account's email address | To know which account you connected and show it in the app |
https://www.googleapis.com/auth/userinfo.profile | See your name and basic profile | To show your name on the account and on mail you send |
https://mail.google.com/ | Read, compose, send and permanently delete your Gmail | Tundra is a full mail client. It downloads your mail so you can read and search it, sends the mail you write, saves your drafts, and applies what you do (archive, labels, read and unread, star, spam, move to trash, and permanent delete when you empty the trash or choose to delete forever) |
https://www.googleapis.com/auth/gmail.settings.basic | Manage basic Gmail settings | To show and change your vacation auto-reply when you ask |
https://www.googleapis.com/auth/calendar | See, create, change and delete your Google calendars and events | To show your calendars and to create, edit, move and delete events, and send replies to invitations, when you ask |
https://www.googleapis.com/auth/contacts | See and change your Google contacts | To suggest recipients from your saved contacts, and to delete a contact when you ask |
How Tundra uses Google user data
Tundra uses Google user data only to provide the mail, calendar and contacts features you see in the app, on your own computer. That includes showing, searching and organising your mail and events, sending the mail you write, and running the rules and reminders you set up.
If you turn on AI features (section 7), Tundra sends the parts of your Google data that a task needs (for example, the message you asked to summarise or reply to) to the AI provider you configured, so it can return the result to you inside the app. This happens only after you turn AI on and add a provider. In the default Balanced mode some light features then run on their own (for example thread summaries, learning your writing style from mail you send, and checking your You owe list). Heavier ones run only if you switch them on. You can switch each one off in Settings → AI & Automations.
What Tundra does not do with Google user data
- We do not receive your Google API data through the app. It is stored on your computer. If you enable cloud AI or other connected tools, the content those features need can be sent directly to the services you choose, as described below.
- Nobody at Tundra reads your Google data. The only exception would be a specific message you choose to send us yourself, for example to report a bug, and then only that message.
- Google user data is not sold, and it is not used or transferred for advertising, including personalised or retargeted ads.
- Google user data is not used to determine creditworthiness or for lending.
- Tundra does not use, transfer or retain Google user data, including data obtained through Google Workspace APIs, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not train any models. Tundra sends Google data to an AI provider only to carry out the task you asked for, and never for training. When you choose a cloud AI provider, check that provider's data-use terms, because they decide what happens to the content you send them. If you do not want Google data to leave your computer, use a local model.
- Google user data is not transferred to anyone other than the providers you configure yourself, as described in this policy, except where the law requires it.
Limited Use
Tundra Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
Your own Google Cloud project
Tundra also lets you sign in to Gmail through a Google Cloud project you own. In that case, Google treats you as the developer of that connection. Everything else in this policy still applies to how the app handles the data.
5. Microsoft user data
When you connect an Outlook.com or Microsoft 365 account, Tundra asks Microsoft for these permissions:
| Permission | What it lets Tundra do | Why Tundra needs it |
|---|---|---|
openid, profile, email | Sign you in and see your name and email address | To know which account you connected and show it |
offline_access | Keep access while you are not actively signing in | So Tundra can keep syncing your mail without asking you to sign in every hour |
User.Read | Read your basic profile | To show your name and account details |
Mail.ReadWrite | Read, create, change and delete your mail | To download, show and search your mail, save drafts, and apply what you do (archive, move, flag, read and unread, delete) |
Mail.Send | Send mail as you | To send the mail you write |
Calendars.ReadWrite | Read and change your calendars | To show your calendars and create, edit and delete events and answer invitations when you ask |
Contacts.ReadWrite | Read and change your Outlook contacts | To suggest recipients from your saved contacts |
Tundra uses Microsoft data in the same way as Google data: only to provide the features you see in the app, only on your computer, and only sent onward to an AI provider you configured, after you turn AI on (see section 7 for the features that then run on their own). We never receive it. It is not sold or used for advertising.
6. Other mail and calendar servers
For IMAP, SMTP and CalDAV accounts, Tundra connects directly to the servers you enter, with the username and password (or app password) you provide. The password is kept in your operating system's credential store.
When you add an IMAP account, Tundra tries to find the server settings for you:
- It asks your email provider's own configuration address (
autoconfig.<your domain>and<your domain>/.well-known/autoconfig). These requests include your email address, as the format requires. - It asks Thunderbird's public database of mail providers at
autoconfig.thunderbird.net. This request includes only your email domain (for exampleexample.com). - It looks up your domain's mail (MX) records in DNS. If your mail is hosted by another company, Tundra also asks that company's configuration address, with your email address.
- It also tries common server names at your domain, and it checks your domain for a calendar (CalDAV) address.
7. AI features (bring your own model)
AI features are optional. They do nothing until you turn AI on, during first-run setup or in Settings, and choose a provider.
You choose where AI requests go:
- A cloud provider you have an account with, using your own API key, for example OpenAI, Anthropic, Google Gemini, Mistral or OpenRouter, or any other compatible address you enter.
- Your OpenAI ChatGPT account, if you choose to sign in with it.
- A model server on your own computer, such as LM Studio or Ollama. In that case requests stay on your computer.
When you use an AI feature, Tundra sends the provider the content the task needs. Depending on the task, that can include message text, subjects, names and email addresses, calendar entries, contacts, notes and attachments. Once AI is on, some features run by themselves on new mail or in the background. In the default Balanced mode that includes thread summaries, learning your writing style and checking your You owe list. Others, such as AI rules, run only when you set them up. You can switch each feature off in Settings → AI & Automations.
The AI provider you choose receives this content under its own terms and privacy policy, which you accepted when you opened your account with it. That provider decides how long it keeps the content and whether it uses it to improve its services. We have no agreement with these providers about your data, and we do not receive what you send them or what they send back. Read your provider's terms before you connect it. If you do not want any content to leave your computer, use a local model.
AI output can be wrong. By default the assistant asks for your approval before it changes or sends anything. If you switch on automatic approval or set up AI rules, Tundra can take some actions without asking each time. You are responsible for what is sent and changed from your accounts (see the Terms of Use).
Other optional tools, only if you set them up:
- Web search, through your own Tavily or Google Programmable Search key. The search terms go to that service.
- Reading a web page, when an AI task needs it. The request goes to that page's website or, if you added a Tavily key, to Tavily, which fetches the page for you.
- MCP servers (tools you connect to the AI assistant). They receive the requests you allow, and they run under their own terms.
- Skills installed from GitHub. Tundra downloads them from the GitHub repository you name.
- Dictation. On macOS you can choose Apple's on-device speech recognition, so audio stays on your computer. Otherwise the recording goes to a speech-to-text model at one of your AI providers, or at a transcription server you set up.
- Command-line AI agents you start in Tundra's Terminal (for example Claude Code or Codex). They can read and act on your mail through a connection that stays on your computer, and they send what they read to their own providers under those providers' terms.
8. Other connections the app makes
Apart from your accounts and your AI provider, the app makes these connections. None of them includes your mail, your calendar or any identifier we assign to you. Like any internet request, each one shows the receiving server your IP address.
| What | Where | When |
|---|---|---|
| Update check | GitHub (api.github.com) | When the app starts, then every 4 hours. An update downloads and installs only when you click. |
| Update download | GitHub | Only when you click to update. The download is checked against a signature before it is installed. |
| Public AI model price list | models.dev | When the app starts, then about once an hour, even with AI off. It is a plain download. |
| Gmail sign-in status | A small file on GitHub (raw.githubusercontent.com) | When you open the list of account types to add, or when Settings shows a Gmail account that needs reconnecting (at most once every 10 minutes). |
| Images and other remote content in messages | The sender's image server | When you open or hover a message with remote images, unless you block them. |
| Connection check | A DNS lookup of the name dns.google, through your own network's resolver | Every 10 seconds on Windows and Linux, and after your Mac wakes. No connection is made to Google and nothing is sent. |
| One-click unsubscribe | The mailing list's server | Only when you click Unsubscribe. |
| Calendar subscriptions | The address you entered | When you subscribe and when it refreshes. |
| Links | Your web browser | Only when you click a link. |
Images in messages deserve a note. When an image loads from the sender's server, the sender can learn that the message was opened or previewed, and your IP address. Tundra tries to skip images that look like tracking pixels, but it cannot catch them all, and some can load the first time you open a message. Messages can also load other remote content, such as fonts and backgrounds, when images are allowed. To stop remote images completely, switch on Settings → Mail → Block all remote images. You can still load images for one message or one sender.
9. What we do not do
- We do not run servers that store or process your mail, calendar or contacts.
- We do not collect analytics, usage statistics or crash reports from the app.
- We do not show advertising, and we do not sell or share personal data.
- We do not add tracking pixels, read receipts or a "Sent with Tundra" line to the mail you send.
10. Who receives your data
The app sends your data only to:
- the mail, calendar and contacts providers you connect (Google, Microsoft, or your own servers),
- the AI providers, web search services, MCP servers and transcription servers you configure, and the command-line agents you run,
- the other destinations listed in section 8.
Each of these receives data under its own terms and privacy policy. We do not control them and are not responsible for how they handle data.
We do not receive your app data, so we cannot disclose it to anyone, including to authorities.
11. Security
Tundra uses encrypted connections (HTTPS and TLS) to talk to providers, unless you set up a server that does not support encryption, keeps passwords and tokens in your operating system's credential store, signs its releases and checks the signature of every update before it is installed.
Your data is as safe as your computer. Anyone who can sign in to your computer account, or who gets a copy of your profile folder, can read your mail. Use a strong password on your computer, turn on disk encryption, keep your system updated, and keep backups you control.
12. Your controls, keeping and deleting your data
You control what Tundra does with your data from inside the app:
- Add and remove accounts in Settings → Accounts.
- Turn AI features on or off, one by one, in Settings → AI & Automations, and add or remove AI providers in Settings → Models.
- Block remote images in Settings → Mail.
- See what changed in your mail, and undo where possible, in the Journal.
Your data stays on your computer until you delete it. We cannot delete it for you, and we cannot restore it if it is lost.
- To remove one account, remove it in Settings → Accounts. Tundra deletes that account's mail, calendar events, contacts and drafts from the database, and its credentials from your credential store. Your Journal, assistant conversations, the assistant's saved memory, notes and snippets stay. Cached images and attachment files, and older backups in the profile folder, may still hold copies.
- To remove everything, quit Tundra, delete the profile folder (section 3) and delete the
tundra-mailentries from your credential store, then uninstall the app. - Removing Tundra from your computer does not cancel its access at Google or Microsoft. To do that, visit your Google Account third-party access page or your Microsoft account app permissions page (for work or school accounts, My Apps, or ask your administrator).
- Data you sent to an AI provider or other service is held by that service. Ask that provider to delete it.
Step-by-step instructions for each system are on the Delete your data page.
13. Data we do receive
When you email us
If you write to info@tundra-mail.com, we receive your email address, your name if you include it, and whatever you write. We use it to answer you and, if you ask about work use, to agree terms with you.
The legal basis is our legitimate interest in handling messages sent to us (GDPR Article 6(1)(f)) or, where you ask about a licence, steps before entering into a contract (Article 6(1)(b)). We keep correspondence while dealing with your request. After that, we keep it only if needed to manage an ongoing licence, meet a legal obligation or establish, exercise or defend a legal claim. We delete it when none of those reasons applies. You can ask us to delete correspondence at any time; we will explain if a lawful reason prevents deletion.
Cloudflare Email Routing is configured to forward messages sent to info@tundra-mail.com to a Gmail inbox monitored by the founder. Google stores that correspondence in Gmail. These services handle messages under Cloudflare's privacy policy and Google's privacy policy.
Do not send us your passwords, sign-in tokens or copies of your mail database. We do not need them to help you.
When you visit the website
The website code sets no cookies, uses no local storage and includes no analytics or advertising scripts.
The website is served through Cloudflare Pages. Cloudflare processes technical request data, such as your IP address, request time, requested page and browser information, to deliver and protect the site. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f)). Cloudflare may use security cookies when it needs to check or protect a connection; these are separate from the website code.
We do not run a separate website analytics or request-logging service. Cloudflare keeps technical data for the service, security and legal purposes described in its privacy policy. Its retention depends on the type of data and those purposes; there is no single retention period for every Cloudflare service.
Some parts of the website load content from other services, which then see your IP address:
- The release list and download buttons use GitHub (
api.github.comandgithub.com), which hosts Tundra's releases. GitHub's privacy statement applies. - Fonts are served from this website.
14. Your rights
If GDPR or UK GDPR applies to you, you have the right to ask us for access to the personal data we hold about you, to have it corrected or deleted, to restrict or object to our use of it, and to receive a copy in a portable format. Write to info@tundra-mail.com. We answer within one month.
These rights apply to the data we hold, which is only the correspondence and website data described in section 13. We hold none of your app data, so for that data you exercise control directly on your computer, and with Google, Microsoft or your AI provider for data they hold.
You also have the right to complain to a data protection authority, in particular in the country where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk).
If you live in California or another US state with a privacy law, the same applies: we do not sell or share personal information, and you can ask us what we hold about you and ask us to delete it.
15. International transfers
We do not transfer your app data anywhere, because we never receive it. When you connect Google, Microsoft or an AI provider, your computer sends data to that provider, which may process it in other countries under its own terms.
Cloudflare and Google operate internationally and may process website technical data and support correspondence outside the United Kingdom, including in the United States. Both providers state that they participate in the UK Extension to the EU–US Data Privacy Framework for covered transfers to their certified US entities. They also describe contractual safeguards for transfers where applicable. Details of those arrangements and how to obtain more information are in Cloudflare's privacy policy and Google's data transfer frameworks.
16. Children
Tundra is not directed at children under 16, and we do not knowingly receive personal data from children. The app itself collects nothing for us, from anyone.
17. Changes to this policy
If this policy changes, we will publish the new version at tundra-mail.com/privacy with a new date. If a change affects how the app handles Google or Microsoft data, we will say so in the release notes before the release that makes the change, and the app will ask for your consent where the law or Google's and Microsoft's rules require it.
18. Contact
Ihor Hulida (known as Igor Gulida), England, United Kingdom. Email: info@tundra-mail.com.