The Fine Print, In Plain English

Privacy

Last updated October 16, 2026

Your mail travels between your email server and your Mac, iPhone or iPad and nowhere else, unless you switch on the AI features and select Claude. If you choose Apple – On Device, your email never leaves your own device and uses only local AI, securely provided by Apple.

No matter what settings you choose, absolutely nothing about you, your email, or how you use Kirby is sold, shared or looked at by us — and unless you turn on AI features, none of it reaches our servers in the first place.

Spotlight

Kirby can put your mail in your device's search index so Spotlight finds it. This is off unless you switch it on in Settings › Privacy, and it is the one setting that moves anything out of Kirby's own custody.

Spotlight's index belongs to macOS or iOS rather than to Kirby, which means other software on the same device can search what's in it. That is the trade, and it's the reason the setting exists instead of this being on by default.

Only the sender, the subject and the preview line are added. Message bodies never are. Turning the setting off deletes everything Kirby put there rather than merely stopping it adding more, and the example mailbox is never indexed at all.

Junk Learning

Kirby learns what junk looks like so it can move it to Junk for you. It learns from what you mark as Junk and Not Junk, from the spam your email provider already caught, and from the mail you keep. What it keeps is a file of counts — how often words, link domains and senders turned up in junk versus good mail — stored in Kirby's own folder on each of your devices.

That file travels between your own devices through your private iCloud database, encrypted with keys from your iCloud Keychain, so teaching your Mac teaches your iPhone. It is never sent to us or to anyone else, and nothing learned from your mail is ever used for anybody else's copy of Kirby.

When Kirby moves a message to Junk itself, it tells your email provider, exactly as if you had clicked Junk, and says in Junk why it did. It never deletes anything, and it never moves mail from someone you've written to, someone in your Contacts, or a conversation you've taken part in. Settings › Privacy › Forget What Kirby Learned About Junk deletes the file on every device and its copy in iCloud.

What Kirby Stores, And Where

Your mail is kept in a database inside Kirby's own folder on each of your devices. That's what makes the app fast and what makes it work offline. Each device fetches its own copy from your email provider — mail is never copied from one device to another. It is not encrypted separately from the rest of your disk — with FileVault on a Mac, which you should use, and always on an iPhone or iPad, it's encrypted along with everything else.

The sign-ins that let Kirby reach your mail — Google and Microsoft tokens and app passwords — are kept in your iCloud Keychain, not in the database and not in a file. That is how a mailbox you connect on one device works on your others without signing in again. If iCloud Keychain is off, they simply stay on the device they were made on.

The list of mailboxes you've connected — each address, its kind, its server settings, name, color, order, signature and sending preferences — is kept in your own private iCloud database, end-to-end encrypted, so your other devices know which mailboxes to show. Apple stores it; I can't read it, and it never passes through anything of mine. No mail is in it. Signed out of iCloud, the list stays on the device and nothing is shared.

Deleting Kirby's container, or disconnecting an account in Settings, removes what it holds. Disconnecting a mailbox removes it, and its mail, from every device signed into your iCloud. Disconnecting also revokes nothing at Google's end — you can withdraw Kirby's access entirely at myaccount.google.com/permissions.

What Kirby Sends, And To Whom

To Google: requests for your mail, and the messages you send. That's the whole list.

To me: nothing, unless you turn on the AI features — see below, because that is the one exception and it deserves its own section. There is no analytics, no telemetry, no crash reporting service, and no license check that phones home with your address. I do not know how many messages you have, who you write to, or whether you use the app at all.

To anyone else: nothing, with one exception you control. Messages that contain images hosted elsewhere are blocked until you choose to load them. Loading them tells that server you opened the message — which is exactly why senders use them, and exactly why Kirby doesn't do it without being asked.

One more, for the version downloaded from outside the App Store: it checks for a newer version of itself, so it can update. That request asks for the list of releases and carries only the app's version number. The App Store version leaves updates to Apple.

Google User Data

Kirby's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Your Gmail data is used only to provide the features you can see in the app: reading, searching, organizing, and sending your mail. It is never used for advertising, never sold, never transferred to anyone, and never read by a human. No machine-learning model is trained on it.

If Kirby Crashes

Kirby writes a note about what it was doing when it stopped, into its own folder on your device, and shows it to you the next time you open the app. It contains the version, your system version, and the addresses the code was executing. It contains no mail, no addresses of anyone, and nothing that identifies you.

It goes nowhere unless you press the button, which opens your own mail app with the text already in it so you can read every word before it's sent. It is deleted after you've been shown it, whether you send it or not.

The AI Features

Kirby can summarize a conversation, answer a question about one, or draft a reply. This is the one part of the app that sends your mail somewhere, and it is off until you turn it on.

When it is on, the message you use it on is sent to Anthropic, the company that makes Claude, by way of a small server of mine that holds the key. That server keeps one number: how many free requests an installation has used. It does not store your mail, your address, or what you asked.

Anthropic does not use it to train their models. They keep it briefly to watch for abuse of their service, then delete it. I am describing somebody else's policy here rather than my own, so check theirs if it matters to you.

Messages you never use AI on are never sent anywhere. Turn the feature off in Settings and nothing leaves your device except to Google, exactly as before.

Your Contacts

If you turn on sender photos, Kirby reads your address book to find a picture for the person who wrote to you, and to make sure it never moves mail from someone in it to Junk. It reads it only; it never changes a contact, and it never sends any part of your address book anywhere.

Most mail clients get these photos from Gravatar or from the sender's website, both of which mean telling a third party who you correspond with. Kirby doesn't do that, which is why people who aren't in your address book get their initials instead.

Payment

If you buy Kirby's premium features in the App Store, the purchase is handled by Apple, and I never see your card details, your address, or your name — only that a purchase happened. If you buy Kirby directly from Tanooki Studios instead, the checkout is run by Stripe, which handles your card and sends me only what a receipt needs. Either way, nothing about your mail is involved.

Children

Kirby isn't aimed at children and collects nothing from anyone, of any age.

Changes

If this policy ever changes in substance, the app will say so rather than quietly updating a page nobody reads. The date at the top is the last time anything here changed.

Asking Me Something

Write to [email protected] and I'll answer it myself, because there is nobody else here to answer it.