Winfield Mail Privacy Policy

Effective date: 15 October 2026

This policy covers Winfield Mail ("Winfield"), an email app for macOS made by Sidequest Syndicate Ltd ("we", "us"). It explains what information Winfield handles, where it goes, and the choices you have.

The short version: Winfield is a mail app that runs on your Mac. Your mail, contacts, passwords and settings stay on your Mac and with your own email provider. We do not run a mail server, we never receive your email, and Winfield has no analytics, advertising or tracking. The only information that ever reaches us is a feedback report you choose to send, and you can see exactly what is in it before it goes.

1. Your email stays on your Mac

When you add an account, Winfield connects directly from your Mac to your email provider (for example Google, Microsoft, iCloud, Fastmail, Proton Mail Bridge or another IMAP and SMTP server). Nothing passes through a server run by us.

To work as a mail app, Winfield reads, stores and changes data in your mailbox:

• Messages and attachments: downloaded to a local cache so you can read, search and organise mail, including offline.
• Folders, labels and message flags: read and updated when you archive, delete, move, star or mark mail as read.
• Sending mail: messages you write are sent through your provider's SMTP server.
• Features that work on your mail locally: search, rules, the Screener, Expiring mail, snooze, reply reminders, tracker blocking, phishing warnings and Spotlight indexing all run on your Mac. Their settings and history are stored on your Mac.

Where this data is kept:

• The mail cache and app data are in ~/Library/Application Support/Winfield Mail on your Mac.
• Passwords and sign-in tokens are stored in the macOS Keychain.
• Spotlight entries (if you leave "Show mail in Spotlight" on) are kept by macOS on your Mac.
• App logs are kept in ~/Library/Logs/Winfield Mail on your Mac. They stay there unless you choose to attach them to a feedback report (see section 4).

Your email provider has its own privacy policy, which applies to the mail it stores for you.

2. Google account data (Gmail)

If you add a Google account, Winfield asks Google for permission to access your Gmail account using the https://mail.google.com/ scope. This scope is needed because Winfield is a full email client that reads, sends, organises and deletes mail over IMAP and SMTP, the same way Apple Mail or Outlook does.

How Winfield accesses Google user data: after you sign in with Google and grant permission, Winfield receives a token from Google, stores it in the macOS Keychain on your Mac, and uses it to connect directly from your Mac to Gmail's IMAP and SMTP servers. Winfield also reads your Gmail profile to learn the email address of the account you signed in to.

How Winfield uses Google user data: only to provide the email features you see in the app: showing, searching and organising your mail, sending messages you write, and running the rules and other features you set up. Winfield does not use Gmail data for advertising, does not sell it, and does not use it to build user profiles.

How Winfield stores Google user data: in the local cache and Keychain on your Mac, as described in section 1. Gmail data is never sent to Sidequest Syndicate or to any server of ours, and we cannot see it.

Sharing Google user data: Winfield does not transfer Gmail data to anyone. The only exception is where you direct it yourself, for example by sending or forwarding a message, or using "Send To" to pass a message to another app on your Mac.

People do not read your Gmail data. No one at Sidequest Syndicate can access it. Feedback reports (section 4) never include message content, subjects or email addresses.

No AI training. Winfield does not use Gmail data to develop, improve or train generalised artificial intelligence or machine learning models. If you turn on the optional Apple Intelligence search feature, your mail is processed by the model built into macOS on your Mac, and is not sent to us.

Limited Use disclosure: Winfield's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access: removing a Google account in Winfield (Settings › Accounts) deletes its cached mail, its Spotlight entries and its saved token from your Mac. You can also revoke Winfield's access at any time from your Google Account at myaccount.google.com/permissions.

3. Connections Winfield makes to other services

Apart from your email provider, Winfield only connects to other services in these cases:

• Signing in with Google or Microsoft. Winfield uses Google's and Microsoft's sign-in pages, which are subject to their own privacy policies.
• Sender photos (off by default). If you turn on "Look up photos online" in Settings › Privacy, Winfield looks up pictures for the people who email you. It sends a hashed form of the sender's address to Gravatar, and the sender's domain name to Google's DNS service (to find a brand logo), DuckDuckGo and Google (for site icons). Those services can learn which addresses and domains you correspond with, which is why this is off unless you turn it on. Photos from your own Contacts are used without going online, if you allow Contacts access.
• Remote images. Winfield blocks remote images and tracking pixels by default. If you choose to load images for a message or a sender, they are downloaded from the sender's servers, which can then see that the message was opened, along with your IP address.
• Unsubscribing. When you choose to unsubscribe from a mailing list, Winfield contacts the address or web page the sender provided, as you confirm.
• Links you open go to your web browser as normal.

Winfield contains no analytics, advertising or crash-reporting SDKs, and sets no cookies.

4. Feedback reports you choose to send

Help › Send Feedback lets you send us a report. Nothing is sent unless you click Send, and the window shows the exact contents first. Each part except your message can be switched off. A report can include:

• your message, and a reply email address if you add one;
• the Winfield version and build, macOS version and Mac model;
• the kinds of accounts you use (for example "Gmail" or "IMAP"), but not the account addresses;
• recent lines from Winfield's diagnostic log, which are written so that they never contain message content, subjects, names or email addresses.

Why we use it: to fix problems and improve Winfield, and to reply to you if you asked us to.

Where it goes: reports are received by a small service we run on Cloudflare, stored in Cloudflare's storage, and emailed to the developer. We do not keep your IP address with the report. Cloudflare processes network traffic on our behalf and may handle your IP address briefly to deliver the request.

How long we keep it: for up to 12 months, then it is deleted. You can ask us to delete a report sooner (section 8).

5. TestFlight and the App Store

If you get Winfield through Apple's TestFlight or the Mac App Store, Apple handles the download, and may share some information with us under Apple's own privacy policy. For TestFlight, that can include your name and email address as a tester, crash reports and any feedback you send through TestFlight, if you choose to share them. We use this only to run the beta and fix problems, and you can stop testing at any time in the TestFlight app.

6. What we do not do

• We do not sell or share your personal information.
• We do not use your data for advertising or profiling.
• We do not track you across apps or websites.
• We do not have access to your email, contacts, passwords or account tokens.

7. Legal basis (UK and EEA)

Sidequest Syndicate Ltd is the data controller for feedback reports and TestFlight information. We process feedback reports because you chose to send them (consent), and to improve the app (our legitimate interest in fixing problems). Your mail never reaches us, so we do not process it.

Cloudflare acts as our processor. It may process data outside the UK and EEA; where it does, the transfer is covered by Cloudflare's data processing terms, including the standard contractual clauses and the UK addendum.

8. Your rights

Depending on where you live (including under UK and EU GDPR and the California Consumer Privacy Act), you can ask us to access, correct or delete personal information we hold about you, object to or restrict how we use it, or withdraw consent. Because we hold so little, this usually means a feedback report or TestFlight information. Email us at winfield@sidequestsyndicate.dev and we will reply within one month. We will not treat you differently for using these rights.

You can also complain to your data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

To remove everything Winfield stores on your Mac, remove your accounts in Settings › Accounts, then delete the app and the ~/Library/Application Support/Winfield Mail and ~/Library/Logs/Winfield Mail folders.

9. Security

Your mail is protected by your Mac's own security, and connections to email providers use TLS. Passwords and tokens are kept in the macOS Keychain. Feedback reports are sent over HTTPS and access to stored reports is limited to the developer. If a breach affected information we hold, we would tell you and the relevant authorities as the law requires.

10. Children

Winfield is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has sent us a feedback report, contact us and we will delete it.

11. Open source

Winfield is open source under the MIT licence, so you can check what it does in its source code. The code is published at github.com/sidequestsyndicate/winfield-mail from version 1.0.

12. Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change affects how your data is handled in a significant way, for example if Winfield starts sending any new information off your Mac, we will tell you in the app before it takes effect.

13. Contact

Sidequest Syndicate Ltd [Registered address — to add] Company number: [to add]

Email: winfield@sidequestsyndicate.dev