Privacy Policy
Last updated November 7, 2026
Cardinal is a Gmail app for iPhone, iPad and Mac. It reads and sends your mail by talking to Gmail directly from your device. Your mail is stored on your device, not on our servers. We do not sell your data, show ads, or use your mail to train AI models.
This policy covers the Cardinal apps and the small push relay that wakes them up. "We" means the developer of Cardinal. Questions: cardinal@octabyte.dev.
What Cardinal accesses in your Google Account
When you sign in with Google, Cardinal asks for these permissions. Each one is used only for the features listed.
- Read, compose and send email, and manage labels (
gmail.modify), asked at sign-in. Cardinal downloads your threads, messages, attachments and labels so you can read and search them, and sends, replies, archives, labels, trashes, snoozes and drafts mail when you ask it to. - Permanently delete email (
https://mail.google.com/), asked only the first time you choose Delete Forever or Empty Trash. It is used for nothing else. - Manage Gmail filters (
gmail.settings.basic), asked only the first time you block a sender or accept a filing suggestion. Cardinal creates or removes the Gmail filter you asked for. - See your contacts and "Other contacts" (
contacts.readonly,contacts.other.readonly), optional at sign-in. Cardinal reads only names, email addresses and photos, to show senders' pictures. If you decline, Cardinal shows initials.
Where your data is kept
On your device
Messages, attachments, drafts, labels and your Outbox (actions waiting to reach Gmail) are stored in a database on your device. Images in your mail are downloaded by your device and cached for up to 30 days. Your Google sign-in tokens are kept in the device Keychain, available only on that device and never synced through iCloud Keychain. Device backups include the mail database, as other app data is.
In your iCloud account
If iCloud sync is on (Settings in the app, on by default), Cardinal syncs your app preferences, signatures, snippets and default-signature choices across your devices through your private iCloud account. Apple stores this data; we cannot read it. Mail, attachments, contact photos and sign-in tokens never go to iCloud.
On the Cardinal push relay
The relay is a small server that tells your devices when new mail arrives and when a snooze, reminder or scheduled send is due. It never receives or stores the content of your mail, drafts, or your sign-in tokens. It stores only:
- a one-way hash (SHA-256) of your email address, never the address itself;
- your devices' Apple push tokens, platform and last-seen time;
- for each snooze, "remind me if no reply" or scheduled send: the Gmail thread, message or draft identifier it applies to, and when it is due. Identifiers are opaque codes, not content.
To check that a request comes from you, your device sends the relay a short-lived Google access token. The relay asks Google which account the token belongs to, then discards the token. When Gmail reports new mail, Google sends the relay your address and a change number; the relay hashes the address and sends your devices a silent push with no mail content. Your device then fetches the new mail from Gmail itself. Notifications that show a sender or subject are built on your device.
Relay logs record request metadata (route, status, timing) and shortened hashes. They do not contain email addresses, tokens or mail content.
Other connections Cardinal makes
- Google: Gmail API, People API (contact photos) and Google sign-in, directly from your device.
- Senders' servers: images and styles in your mail load from the servers that the sender chose, as in any mail app. Cardinal fetches them without cookies or referrer, skips Spam and Trash, and drops known tracking pixels. You can turn remote images off.
- Brand logos (BIMI): for mail from companies, your device looks up the sender domain's published logo in DNS and downloads it from that domain. You can turn brand logos off.
- Unsubscribe: when you confirm Unsubscribe, Cardinal sends the unsubscribe request the sender's message offers (a web request or an email).
- Apple: push notifications (APNs) and iCloud, as described above.
AI features
Summaries, suggested replies, writing help, date and label suggestions and plain-language search use Apple's on-device model. Cardinal does not send your mail to any AI service, and we do not use your data to train or improve AI models.
What we never do
- We do not sell, rent or share your Google user data with advertisers, data brokers or information resellers.
- We do not use your data for advertising, including personalized or retargeted ads.
- We do not use your data to determine credit-worthiness or for lending.
- No person at Cardinal reads your mail.
- Cardinal contains no analytics, tracking or advertising software.
Google API Services User Data Policy
Cardinal's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements. Cardinal uses Google user data only to provide and improve the user-facing mail features described above.
Service providers
The relay runs on these providers, which process the limited relay data above on our behalf:
- Railway (relay hosting and database)
- Cloudflare (network delivery for the relay and this website)
- Google Cloud Pub/Sub (Gmail's new-mail signal to the relay)
- Apple Push Notification service (delivering pushes to your devices)
We may disclose data if required by law. We do not transfer data to anyone else.
Keeping and deleting your data
- Signing out of an account in Cardinal deletes that account's mail, attachments, cached images and contact photos from the device, removes its sign-in tokens, revokes Cardinal's access at Google, and removes the device from the relay.
- Snoozes, reminders and scheduled sends stay on the relay until they are done or you cancel them in the app. Cancel pending ones before signing out, or ask us to delete them.
- Removing the app deletes its data on that device. iCloud data stays in your iCloud account until you delete it in iCloud settings.
- Revoking access: you can remove Cardinal at any time atmyaccount.google.com/permissions.
- Deletion on request: email cardinal@octabyte.dev from the address of the account and we will delete all relay data for it within 30 days.
Security
All connections use HTTPS. Sign-in uses OAuth with PKCE; Cardinal never sees your Google password. Tokens stay in the device Keychain. The relay stores no mail and no tokens, so there is no mail on our servers to leak.
Children
Cardinal is not directed to children under 13, and we do not knowingly collect their data.
Changes
If this policy changes, we will update this page and its date. We will ask for consent before using data in a way this policy does not describe.