How Mail Shepherd handles your data.

What it reads

From your Inbox, Junk (Spam in Gmail) and Trash, only these headers: sender, Reply-To, subject, sent and received dates, Message-ID, the read and junk flags, your mail provider’s own sender-authentication results (used by Spoof Detection, which is off unless you turn it on) and mailing-list headers (List-Id and List-Unsubscribe). It never downloads message bodies or attachments.

From iCloud Contacts (iCloud accounts) or Fastmail’s contacts (Fastmail accounts) it reads your contacts’ email addresses, only to recognize their mail so it’s never treated as junk. If you choose People I’ve Written To (Sent Mail) as a source, it reads only the To and Cc addresses, subject and reply header of your sent messages, for the same reason.

What it keeps, and where

• Your app passwords: in your Mac’s keychain, on this Mac only, until you remove the account.
• Your contacts and the people you’ve written to: only each address’s domain and a one-way hash of the address, made with a key kept in your keychain. Never names, phone numbers or anything else from the card, and never the address itself. The key is renewed weekly.
• Your lists: Blocked Senders, Blocked Domains and Allowed Domains, and the senders from Mail’s Blocked Sender List if you link it, in Mail Shepherd’s folder on your Mac.
• Empty Trash timers: for an account where you turned on Empty Trash during Sweep, when each blocked or junk message in Trash was found (its message number only).
• The Action Log: every change Mail Shepherd makes, with the message’s sender, subject and dates (never its contents), kept 4 weeks or until you clear it.
• Sweep Logs: what each Sweep did, the newest 500, or until you clear them.

What it sends, and to whom

• To Apple (iCloud accounts): your iCloud address and app-specific password, only to sign in to iCloud Mail and iCloud Contacts, and the commands that read headers and move, mark or delete your mail.
• To Google (Gmail accounts): your Gmail address and Google app password, only to sign in to Gmail, and the same commands.
• To Fastmail (Fastmail accounts): your Fastmail address and app password, only to sign in to Fastmail’s mail and contacts, and the same commands.
• To Yahoo or AOL (their accounts), or to the IMAP server you enter (Other accounts): that account’s address or username and password, only to sign in to it, and the same commands.
• To Take66 Software: nothing, unless you write to us. The support address on Get Support and Email Support File… open an email with your Mail Shepherd and macOS versions and this Mac’s model, chip, memory, free disk space, language, time zone and Low Power Mode filled in; Email Support File… also attaches a support file: the last 7 days of Mail Shepherd’s logs (senders and subjects of mail it changed or kept in Junk, and of the mail it left alone if Verbose was on), your accounts’ addresses and settings, never passwords, message contents or contacts. Nothing is sent unless you send it yourself.
• To anyone else: nothing.

Encryption in transit

Everything Mail Shepherd sends or receives is encrypted on the way. It connects to iCloud Mail over IMAP with TLS (imap.mail.me.com, port 993), to iCloud Contacts and Fastmail’s contacts over HTTPS (contacts.icloud.com, carddav.fastmail.com) and to Gmail, Fastmail, Yahoo, AOL and any other IMAP server you add over IMAP with TLS (port 993 unless you choose another), so your password, your message headers and your contacts can’t be read by anyone on your network. It sends each password only to that account’s own provider or server and never follows a redirect to another site.

What it changes

When you click Sweep, or when an Auto-Sweep you turned on runs, Mail Shepherd marks mail read, junk or not junk and moves it between your Inbox, Junk and Trash, following your lists. It deletes mail only when you ask it to: the messages you choose with Delete Selected or Delete Permanently and, for an account where you turn on Empty Trash during Sweep (off unless you turn it on), the blocked or junk mail a Sweep finds in Trash once the time you chose has passed. Deleted mail is deleted permanently and can’t be recovered. It never sends mail and never changes your contacts. The changes are made on your mail provider’s servers, so they appear on all your devices, and every one is in the Action Log.

Removing everything

• Remove an account in Settings → Accounts: its password leaves your keychain, and its contacts and Empty Trash timers are forgotten.
• Clear each log on the Logs page, and unlink Mail’s Blocked Sender List in Settings.
• Revoke the app-specific password at account.apple.com → Sign-In and Security → App-Specific Passwords, or the Google app password at myaccount.google.com/apppasswords.
• Uninstalling the app doesn’t remove its logs: delete Mail Shepherd’s folder in your Library’s Containers folder to remove them.

More

The formal Mail Shepherd Privacy Policy. Questions: mailshepherd-support@take66.ai.