Privacy policy
Who we are
Hyphae Mail is operated by hyphae ("we"). Hyphae Mail is a web app that lets you send encrypted messages
through your own Gmail account. The Matrix homeserver it uses, hyphae.social,
is run by the same operator. Contact:
hmail-support@googlegroups.com.
The short version
- Hyphae Mail asks Google for one permission: send email as you. It cannot read, list, search or delete your mail.
- Your message is encrypted in your browser. Gmail, and Google, only ever receive scrambled text.
- Your Google access token stays in your browser tab. We have no server that receives it.
- We do not sell your data, show ads, or use Google data for anything except sending the messages you ask us to send.
Google user data we access
| Google permission | What Hyphae Mail uses it for |
|---|---|
Your account's email address (openid, email) |
To show which Gmail account is connected and to set the From address on messages you send. |
Send email on your behalf (gmail.send) |
To deliver the encrypted messages you compose, from your own address, to the recipients you choose. This is the only Gmail operation Hyphae Mail performs. |
Hyphae Mail does not request access to read, list, search, modify or delete messages, labels, drafts, contacts, calendar, Drive files or any other Google data.
How your Google access token is handled
Google issues a short-lived access token to your browser when you click "Continue with Google". Hyphae Mail holds it in your browser tab's session storage and uses it only to call Google's own services: the Gmail API to send your message, and Google's token-info service to read your account's email address. It is not sent to Hyphae Mail or to any other party, it is not written to disk, and it is discarded when you close the tab or it expires. Hyphae Mail does not request a long-lived refresh token.
What leaves your browser, and where it goes
| Recipient | What they receive |
|---|---|
| Google (Gmail) | Your address, your recipients' email addresses, and the ciphertext subject and body. Google cannot read the plaintext, because the key never goes through Gmail. |
| Matrix homeserver (hyphae.social) | An account name derived from a one-way hash of your Gmail address (it is pseudonymous, not anonymous: anyone who already knows your address can compute it); a password value derived in your browser from your address and your site password, which the homeserver stores only as a hash; your recipients' Matrix IDs; room names (the recipient's Matrix ID); timestamps and IP addresses in server logs; and the encrypted key messages. The message content and decryption key are end-to-end encrypted, so the homeserver operator cannot read them. |
| Recipients | An email containing ciphertext, and, if you gave a Matrix ID for them, an encrypted Matrix message carrying the key. |
| Google Fonts | The app page loads its typefaces from Google Fonts, so Google receives a standard web request (including your IP address) for that. The landing, privacy and terms pages do not. |
What is stored on your device
- Local storage: your Gmail address, your recipient lists (names, email addresses, Matrix IDs), and your Matrix session token and device ID.
- IndexedDB: the Matrix sync cache and your end-to-end encryption keys.
- Session storage: the Google access token, until the tab closes.
Your lists are kept in your browser; we do not keep a copy. Signing out of Hyphae Mail removes the Matrix session and encryption databases from your browser. Clearing the site's data in your browser removes everything else.
Sharing, sale and advertising
We do not sell personal data, use it for advertising, or give it to data brokers. No person at Hyphae Mail reads your messages or your Google data, and we do not use it to train any AI or machine-learning model. The only parties that receive data are Google and the Matrix homeserver, as described above, to carry out the sends you request, and anyone we are legally required to disclose information to.
Google API Services User Data Policy
Hyphae Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing sending feature you asked for, we do not transfer it to others except as necessary to provide that feature or to comply with law, and we do not allow humans to read it.
Retention and deletion
- Google access: you can revoke Hyphae Mail's access at any time at myaccount.google.com/permissions.
- Browser data: stays until you sign out or clear site data.
- Matrix account: the account and its encrypted key messages remain on the homeserver until the account is deleted. To have your account deleted, email us at the address above.
- Sent email: messages already delivered sit in Gmail (yours and your recipients') as ciphertext, under those users' own control.
Security
Each message is encrypted with AES-256-GCM under a fresh key; keys are delivered with Matrix's Megolm end-to-end encryption. No system is perfectly secure. The password for your Hyphae Mail account is derived from your Gmail address and your site password, so choose a long, unique site password, and share it only with people you trust to send as you.
Children
Hyphae Mail is not directed at children under 13, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date above. If a change affects how we use Google user data, we will seek your consent again where Google's policies require it.