Last updated: 4 September 2026
The desktop app
S² Mail is a local-first email client. It connects to mail providers you already use (such as Gmail, Microsoft 365, IMAP, and JMAP). Mail bodies, attachments, and credentials are stored on your computer. We do not operate a required proxy that reads or stores your messages in order for the client to work, and you do not need an S² account to use the core product.
Credentials and local data
Account passwords, OAuth tokens, and similar secrets are kept in the application’s secure vault, protected with operating-system facilities where available. Message metadata and content are stored locally, with encryption enabled by default for sensitive material. S² Mail does not hold a master key that would let us decrypt your local data.
Telemetry
Analytics, crash reports, and diagnostics are separate, optional controls. You can turn all of them off. If they are off, the application is designed to send no telemetry. Update checks do not include mail content, credentials, or search history.
This website
The marketing site at https://s2mail.app is a static product website. The hosting provider may collect standard request logs (IP address, user agent, and the page requested) to operate and protect the site. We do not use the website to collect mail, account passwords, or a required user profile.
Third-party providers
When you add Gmail, Microsoft 365, or another mail server, that provider’s own privacy policy applies to the mail stored on their systems. S² Mail is a client; it does not replace those services.
Contact
Privacy questions about S² Mail can be sent via the project repository or the contact details published on s2mail.app as they become available.