Privacy policy

Your mail stays on your Mac.

Pigeon is a mail app for the Mac. It fetches your mail straight from Google or Microsoft and keeps it on your Mac. There is no Pigeon server in between, so we never receive, store or read your email.

Last updated 28 September 2026

Who we are

Pigeon (“Pigeon”, “we”, “us”) is made by Henry Kirkness. This policy covers the Pigeon app for macOS and the website at sentviapigeon.com. If you have a question about it, or want to use any of your rights below, write to henry@kirkness.com.

The short version

  • Your email, contacts, attachments and search index are stored on your Mac and nowhere else.
  • The sign-in tokens that let Pigeon reach your mailbox are stored on your Mac too. We never see them.
  • We don't sell your data, show you ads, or use your mail to train AI models.
  • We only receive what a purchase and a licence need: your name, email address, licence key and the name of your Mac.

Google user data

When you connect a Gmail or Google Workspace account, you give Pigeon permission to read, change and send mail in it (the gmail.modify scope). Pigeon uses that permission only for features you use in the app:

  • downloading your messages, labels and attachments so you can read and search them on your Mac;
  • marking messages read or unread, adding and removing labels, and moving messages to the bin;
  • sending, replying to and forwarding mail, and saving drafts, when you press send or save;
  • reading your Gmail signature so it can be added to mail you write in Pigeon.

The data goes directly from Google to your Mac over an encrypted connection. It is stored there, in Pigeon's own folders, and is never sent to us or to anyone else by Pigeon. No person at Pigeon can read it, and we have no copy of it.

Pigeon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data to serve advertising, we do not sell it, we do not use it to develop, improve or train generalised AI or machine learning models, and we do not allow humans to read it.

Microsoft 365 data

When you connect a Microsoft 365 or Outlook account, you give Pigeon permission to read and change your mail, send mail as you, and read your basic profile (name and address). Pigeon uses these permissions for the same features listed for Google above. The data goes directly from Microsoft to your Mac and is handled the same way: stored only on your Mac, never sent to us, never read by anyone at Pigeon.

What stays on your Mac

  • your messages, attachments you open or save, labels and folders, and the search index built from them;
  • the sign-in tokens for each connected mailbox;
  • signatures, saved searches, tone-of-voice notes and your settings;
  • photos from your Mac's Contacts, if you allow access, used only to show a sender's picture in the message list.

This data is protected by your Mac's own security, such as your login password and FileVault. It stays until you remove it (see Deleting your data).

When Pigeon talks to anything else

Apart from Google and Microsoft, Pigeon connects to other services only in these cases:

  • Licences. When you start a trial, enter a licence key or Pigeon checks that key, it contacts our payment provider, Polar, and sends the key, an activation ID and your Mac's name (so you can see which Macs use the key). No mail is sent.
  • Updates. Pigeon checks sentviapigeon.com for new versions. That request includes your IP address and the app and macOS versions, as any web request does. We don't log it against you.
  • Usage and crash reports. Pigeon sends anonymous reports to PostHog, hosted in the EU: that the app opened, that a search or a send happened, the app and macOS versions, and the technical details of a crash. They aren't linked to your name, your address or your licence, and never include the content of any mail, a subject, a contact or what you searched for. Switch it off in Settings ▸ General.
  • Images in messages. Remote images are blocked by default because they can tell a sender you opened their email. If you choose to load images for a message, they are fetched from the sender's servers. Pictures in your own signature are fetched so Pigeon can show them to you.
  • Unsubscribing. If you use Unsubscribe, Pigeon contacts the address or web page the sender gave for it, or sends them an email from your account, as you choose.
  • Claude. If you install Pigeon's plugin for Claude, Claude can search and read your mail through a server that runs on your Mac. It only sees the messages it looks up to answer something you asked. What Claude does with that is covered by your agreement with Anthropic, not by Pigeon. Claude can draft mail but cannot send it. Pigeon never uploads your mailbox to Anthropic or anyone else.

Buying Pigeon

Polar is the merchant of record for Pigeon, so Polar handles checkout, payment, tax and receipts under its own privacy policy. We receive your name, email address, what you bought and your licence key, so we can give you support and manage your licence. We never see your card details.

This website

  • We use Vercel Web Analytics to count page views. It doesn't use cookies and doesn't identify you across sites.
  • We also use PostHog, hosted in the EU, to count page views, measure how fast pages load and see which errors visitors hit. It sets no cookies and stores nothing in your browser, and it doesn't record sessions. It respects your browser's Do Not Track setting.
  • If you join the launch list, your email address is stored with our email provider, Resend, so we can tell you when Pigeon is available. Every email has a link to leave the list.
  • Fonts are served from this site, so visiting it sends nothing to Google.

Sharing

We don't sell or rent personal data. We share it only with the services named above, to do what this policy describes, or if the law requires us to.

Deleting your data

Everything Pigeon stores about your mail is on your Mac, so you can delete it yourself:

  • Quit Pigeon and delete the ~/Library/Application Support/Pigeon and ~/.config/pigeon folders. That removes your mail index, attachments, settings and sign-in tokens.
  • You can also remove Pigeon's access at any time from your Google account or your Microsoft account. Pigeon will then stop fetching mail.
  • To have your purchase and licence records deleted, write to henry@kirkness.com. We may need to keep some records for tax and accounting.

Your rights

If you are in the UK, the European Economic Area or somewhere with similar laws, you can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to how we use it, or ask us to limit its use. We use your purchase details to fulfil our contract with you, and your launch-list address because you asked us to. Write to henry@kirkness.com and we'll reply within a month. You can also complain to your data protection authority. In the UK that is the Information Commissioner's Office.

Security

All connections to Google, Microsoft and Polar are encrypted. Sign-in uses the providers' own sign-in pages with PKCE, so Pigeon never sees your password. Tokens are stored in files only your Mac user account can read. Pigeon blocks remote content and scripts in email by default.

Children

Pigeon is not intended for children under 13, and we don't knowingly collect their data.

Changes

If we change this policy we'll update the date at the top. If a change affects how Pigeon handles your mail, we'll say so in the app's release notes before it applies.