Skip to content

Privacy

What is collected, what is not, and who else sees anything.

This is a description of what the software does, written next to the code that does it. Where a claim below is something the system enforces rather than something we promise, it says so.

4 of 8 categories collectedNothing used for trackingNo cookies on this site

What we will not do

  1. 01

    We do not read your mail.

    Your clients fetch mail directly from the mail server using a token that is valid for one mailbox and ten minutes. Our API is not in that path and does not proxy it. This is a structural property, checked on every build, not a policy we promise to keep.

  2. 02

    An administrator at your company cannot read your mailbox without you being told.

    Administering a company is not the same as reading its mail. Access requires an explicit grant, which is recorded and emails you when it is created. It cannot be configured off.

  3. 03

    If we ever have to open your mailbox to fix something, you get an email.

    Emergency operator access requires a written reason, creates an ordinary expiring grant, and emails the mailbox owner directly. The reason we typed appears in your own audit log.

  4. 04

    Push notifications never contain your mail.

    The payload carries a sender and a subject. The type that describes it declares that a body field cannot exist, so adding one would be a visible change rather than a quiet one.

  5. 05

    You can take everything and leave.

    Export produces mbox, iCalendar and vCard files that open in Thunderbird, Apple Mail and every migration tool. Nothing in the archive is in a CanopyMail format and nothing about it needs us to read it.

  6. 06

    We do not sell anything to anyone, and there is nothing to sell.

    There is no advertising, no profiling and no usage analytics. We charge for storage and sending volume, which is the whole business model.

What is collected

Listed in the categories Apple’s privacy label uses, including the ones we do not collect — a disclosure that omits the negatives reads as an incomplete answer rather than a clear one.

  • Contact info

    Collected

    Your email addresses, your display name, and the addresses you correspond with.

    To run a mailbox. There is no version of email that does not involve these.

    Leaves our systems
    No
    Linked to you
    Yes

  • User content

    Collected

    Your messages, attachments, calendar events and contacts, stored on the mail server your company runs or we host for it.

    To deliver, store and show you your mail.

    Leaves our systems
    No
    Linked to you
    Yes

  • Identifiers

    Collected

    An account identifier, and a push notification token if you turn on notifications.

    To tell your device that mail arrived. The push notification carries the sender and the subject and never the message.

    Leaves our systems
    Yes — see below
    Linked to you
    Yes

  • Diagnostics

    Collected

    Crash reports and error logs, with message content removed.

    To fix the app. Logs are kept for 30 days.

    Leaves our systems
    No
    Linked to you
    No

  • Usage data

    Not collected

    Nothing. We do not record which messages you open, what you search for, or how long you spend reading.

    There is no advertising business here to feed with it.

  • Location

    Not collected

    Nothing. The apps do not request location permission.

    Mail does not need to know where you are.

  • Contacts on your device

    Not collected

    Nothing. The apps do not request access to your phone’s address book.

    Your correspondents are already in your mailbox; uploading your phone’s contacts would be taking other people’s data to do something we can already do.

  • Purchases, financial info, health, sensitive info, browsing history

    Not collected

    Nothing.

    None of it is needed to run a mailbox.

None of it is used for tracking, and none of it is combined with data from anywhere else. There is no advertising business here to feed.

Who else sees anything

  • Apple Push Notification service

    Sees
    A device token, the sender’s name and the subject line, when you have notifications on.
    Does not see
    Message bodies or attachments. The payload type has no field for them.
    Avoidable
    Turn notifications off and nothing is sent to Apple at all.

  • Firebase Cloud Messaging (Android)

    Sees
    The same: a device token, a sender and a subject.
    Does not see
    Message bodies or attachments.
    Avoidable
    Turn notifications off.

  • MessagePipe (account notices, where a deployment uses it)

    Sees
    The notices we send you about your account - an invitation, someone being given access to your mailbox, emergency access, a suspension, an import or an export - with your address, the subject and the full text, including any sign-in link the notice carries.
    Does not see
    Your mail. Notices are written by CanopyMail and nothing from your mailbox is in them.
    Avoidable
    Not by you. A deployment sends notices either through its own mail server or through MessagePipe; when it uses its own server, MessagePipe sees nothing.

  • The mail servers you send to and receive from

    Sees
    Whatever email has always involved: your address, their address, and the message.
    Does not see
    Nothing we could withhold. This is how email works.
    Avoidable
    Not avoidable, and no mail provider can change it.

How long things are kept

How long each kind of data is kept
WhatHow long
Your mailUntil you delete it. Deleted mail leaves the servers within 30 days.
Your account after you close itClosed immediately, removed within 30 days, restorable until then.
Audit log entriesKept for the retention period your company sets, and never editable or deletable by us.
Diagnostic logs30 days.
An export you asked forSeven days, then deleted. It is a complete copy of a mailbox and should not sit around.

Closing your account

There is a button for it in Settings, in the app, on every platform. It closes your account across every company you hold a mailbox at, and your mail is removed within 30 days.

Take an export first if you want to keep it. You do not need anyone’s permission and your administrator is not told that you asked.

Getting in touch

All three are monitored by a person.