Privacy Policy
dude.email is an email app you install and run on your own Windows PC. It is built so that your mail stays on your computer: we designed our servers so that they cannot read it. This policy explains what we collect, what we do not, and the choices you have. dude.email is operated by Elbert Vandemark ("we", "us").
The short version
- Your email, contacts and attachments are stored only on your own PC, encrypted with a key tied to your PC's security chip (TPM).
- Our servers never store your mail and cannot read the traffic they pass between your PC and your other devices. It is end-to-end encrypted.
- We do not show ads, sell or share your data, build profiles, or use your mail to train AI models.
- Anything that sends data somewhere else, such as backups or an AI assistant, is off until you turn it on.
What stays on your PC
When you connect a mail account (for example Yahoo, Gmail, Outlook or any IMAP provider), the dude.email app on your PC connects directly to that provider. Your messages, attachments, search index, settings and the sign-in tokens for your mail accounts are kept in an encrypted file on your PC. The app processes your mail there, and only to provide features for you:
- search, sorting into categories such as people, newsletters and notifications, and threading;
- security checks, such as verifying sender authentication, warning about look-alike senders and misleading links, cleaning email formatting before display, and blocking remote images and trackers;
- computing a fingerprint (SHA-256 hash) of attachments.
We do not receive any of this.
What our servers receive
Our servers let your browser or phone reach the app on your PC, and let you sign in. To do that they keep:
- Your dude.email account: a random account number, the display name you choose, and your passkey's public key. There is no password. We never receive your passkey itself or your fingerprint or face data.
- Your paired PCs and devices: their public keys, and information from each PC's security chip (TPM) used to confirm it is genuine hardware. This includes the chip manufacturer's certificate, which identifies that chip.
- Encrypted data your PCs share: if you use more than one PC, they exchange settings as end-to-end encrypted data that we cannot read.
- Connection logs: IP addresses, times, and the pages or connections requested, kept for security and troubleshooting for up to 30 days.
The encrypted traffic between your PC and your devices passes through our servers but is not stored, and we cannot read it. Backups of our account database are kept for up to 14 days.
Features you can turn on
- Using your mail from your phone or another browser: messages travel end-to-end encrypted between your PC and that device.
- Backups: encrypted copies go to storage you choose and own (such as OneDrive, Google Drive, Dropbox or your home network storage). They are encrypted on your PC first, and only you hold the key.
- AI assistant: off by default. If you turn it on, the content you select is sent to the model you choose: one running on your own PC, or a provider you pick under your own agreement with them. The app shows you what will be sent.
- Check on VirusTotal: when you choose it for an attachment, only the attachment's fingerprint is looked up on virustotal.com, in your own browser. The file is not uploaded.
Your mail providers
When you connect an account, you sign in with that provider (for example Yahoo, Google or Microsoft), and their own privacy policies apply to the mail they hold. dude.email asks only for the access it needs. You can disconnect an account at any time in the app, which deletes its stored mail, search index and sign-in tokens from your PC. You can also revoke dude.email's access in your provider's account settings.
What we never do
We do not sell or rent personal information, share it for advertising, use advertising or analytics trackers, build marketing profiles, or use your mail or data to train AI models.
Your rights
Wherever you live, you can ask us to tell you what we hold about you, correct it, give you a copy, or delete your dude.email account and the data our servers keep about it. Email us at the address below. Because your mail is stored on your own PC, you control it directly: removing an account or uninstalling the app deletes it there. If you are in the EU or UK, you can also complain to your local data protection authority. If you are in California, note that we do not sell or share personal information.
Security
Mail is encrypted on your PC with a key bound to its security chip. Sign-in uses passkeys. Connections use TLS 1.3, and the traffic between your PC and your devices is end-to-end encrypted. App releases are signed. No system is perfectly secure, but dude.email is built so that a breach of our servers would not expose your mail.
Children
dude.email is not directed at children under 13 (or under 16 in the EU and UK), and we do not knowingly collect their personal information.
Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app before they take effect.
Contact
Questions or requests: privacy@dude.email