Privacy policy

Halyard Mail is a desktop program. Your mail is stored on your own computer, and there is no Halyard server for it to be stored on instead. This page says exactly what the program touches, what this website records, and what neither of them does.

Last updated 3 October 2026. This covers the private beta.

The short version

• Your email never reaches us. It travels between your computer and whichever mail provider you connected — Google, Microsoft, Yahoo, iCloud, Fastmail or any other IMAP server. The one exception is the web address of each picture in a message, which passes through our image relay so that the sender cannot see you — explained below.
• We run no analytics and no telemetry. The program does not phone home.
• If you choose to add your own AI provider key, the optional Improve Tone button sends the text you are writing to that provider — explained below. Without a key, nothing is sent.
• This website knows your name and email address because you typed them in to get a beta key.
• We do not sell anything to anyone, and there is nothing collected that could be sold.

Which accounts you can connect, and how each signs in

Halyard is not a Google-only client, and the way it holds your credentials depends on what the provider offers:

• Gmail and Google Workspace sign in with Google directly (OAuth). Halyard never sees or stores your Google password — you type it on Google’s own page, and Halyard receives only a token. The permissions that token carries are listed in the next section.
• Microsoft and Outlook.com sign in the same way, on Microsoft’s own page, and Halyard again holds only a token.
• Yahoo, iCloud, Fastmail, GMX, Mail.com and any other IMAP server connect with an app-specific password — a separate password you generate at that provider for this program alone, and can revoke there without changing your real password. Halyard stores it in the Windows Credential Manager, the same place Windows keeps other application credentials, never in its own files and never in plain text.

Whichever you use, the connection is between your computer and that provider. Your mail is not relayed through us and no copy of it is kept anywhere but your own machine.

What the program accesses in your Google account

This section is specific to Google, because Google requires each permission to be named and justified. If you have not connected a Google account, none of it applies to you.

Halyard asks for three permissions when you sign in. Each one is listed here with the reason it is needed:

• Gmail (read, send, and modify) — so the program can show your mail, send replies, and move, label, archive and delete messages. A mail client that cannot write cannot mark a message read.
• Contacts (read only) — so addresses autocomplete as you type and senders show a name rather than an address. Read only: the program never writes to your Google contacts.
• Calendar events — so an invitation in a message can be added to your calendar.

That data is fetched from Google to your computer and stays there. It is not transmitted to us, because there is nowhere for it to be transmitted to.

Where it is kept, and how

• Mail, contacts and calendar entries are stored in a database file on your own machine, encrypted with SQLCipher.
• Sign-in tokens (Google, Microsoft) and app-specific passwords (Yahoo, iCloud, Fastmail and other IMAP accounts) are stored in the Windows Credential Manager, the same place Windows keeps other application credentials. They are never written into our files in readable form.
• The spam and priority filtering runs on your computer. Nothing is uploaded anywhere to be classified.
• Remote images in a message are fetched when the message arrives rather than when you open it, so opening mail does not tell the sender that you read it, or when. They are fetched through our image relay at halyard-email.com, so the sender's server sees the relay's address, never yours. The relay receives only the picture's web address, fetches it, and hands the picture back; it keeps no copy of the picture and no record of the address. (Like the rest of this website, the relay sits behind Cloudflare, which carries the connection.) Pictures are stored on your computer from then on. Images in spam, junk and trash are not fetched automatically, and hidden tracking images are never fetched at all. For older mail whose pictures were not fetched on arrival, Halyard fetches them when you open the message, the same way, through the relay. The sender still never sees your address, but a sender who gives every recipient their own picture links could tell roughly when that older message was opened.
• The optional AI assistant is off unless you add your own Anthropic or Google API key in Settings. With a key, pressing Improve Tone while writing sends the text you selected, or your own words above any quoted message, directly from your computer to that provider under your key, and nothing else. It never runs on its own. That provider's own terms apply to what it receives.

Removing it

Removing an account from Halyard deletes that account's local database and its stored token or password. Uninstalling removes the program; you can delete the remaining data folder yourself, and the setup guide says where it is.

You can also cut Halyard off from the provider's side, which works regardless of what is installed on your computer: revoke its access in your Google or Microsoft account security settings, or delete the app-specific password you generated at Yahoo, iCloud, Fastmail or wherever the account lives. Doing that stops it reading anything further immediately.

What this website records

The beta portal is separate from the program, and it is the only part of this project that stores anything about you on a machine that is not yours:

• When you request a key: your name, your email address, and the serial and dates of the key issued to you. The email address is what stops one person collecting an unlimited number of keys.
• When you send feedback: your email address, your message, and which build you were running.
• Download links are stored as a one-way hash rather than in the clear, so a copy of the database does not hand the reader working links.

That information is used to run the beta and to reply to you. It is not shared with anyone, and it is deleted when the beta ends or when you ask, whichever comes first.

Google API Services User Data Policy

Halyard Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: data obtained through those APIs is used only to provide the mail features described above, is not transferred to anyone except as needed to provide those features, is not used for advertising, and is not read by any human. The only data from a Gmail message that leaves your computer for a server of ours is the web address of each picture in it, passed through the image relay described above so the picture can be shown without revealing you to the sender; the relay keeps no record of it.

Children

This beta is not directed at children under 13, and keys are issued to individual testers by invitation.

Changes, and how to reach us

If this policy changes in a way that affects what is collected, the date at the top changes and testers are told by email. Questions about any of it, including a request to delete what the portal holds about you, go to [email protected].