Privacy Policy

Vithos is a keyboard-first, local-first mail client for Gmail, operated by Mehdi Chioukh, an independent software developer based in France ("Vithos", "we", "us"). For anything in this policy, write to hi@vithos.app.

This policy covers the vithos.app website (including the waitlist) and the Vithos desktop app. The short version: your email lives on your device, our servers hold as little as possible, and we never sell your data or use it for advertising.

When you use vithos.app, we process:

• Waitlist email. If you join the waitlist, we store your email address and use it to send a confirmation and occasional product updates. Emails are delivered through a third-party email delivery provider, and every message includes a way to unsubscribe. You can ask us to delete your address at any time.
• IP address. Processed transiently to rate-limit waitlist signups and prevent abuse. It is not linked to your email address.
• Analytics. We use third-party analytics services to understand how the site is used: pages viewed, approximate location, browser and device type. We use this to improve the site, not to build advertising profiles.

Vithos is local-first by design. The content of your email (message bodies, attachments, your search index) is stored in a database on your device, and reading, browsing, and search all happen there.

To keep your inbox in sync, our servers process and store:

• Your account details: the email address of each Google account you link, and your Vithos account record.
• The OAuth tokens that authorize Gmail access, used only to run sync on your behalf.
• Sync metadata: message and thread identifiers, label state, and sync cursors needed to coordinate incremental sync with Gmail.

Sync runs on third-party cloud infrastructure, and account and sync records are stored in our database. Server logs are structured and content-free: they carry request timings and hashed identifiers, never the contents of your mail.

Vithos connects to Gmail through Google's official API, with your explicit consent via Google OAuth. We access your Gmail data solely to provide the features you ask for: displaying and searching your mail, archiving, labeling, drafting, and sending on your instruction.

Vithos's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not sell Google user data.
• We do not use Google user data for advertising, and we do not transfer it to advertisers or data brokers.
• We do not use Google user data to train artificial intelligence or machine learning models.
• No human reads your email, except with your explicit permission (for example, a support request where you share a message), when required for security or abuse investigation, or to comply with applicable law.

You can revoke Vithos's access to your Google account at any time from your Google account permissions. Doing so stops sync immediately.

The app measures its own performance (start-up time, search latency, sync duration, crashes) and sends those measurements to our analytics provider in batches. These events carry timings, counts, app version, platform, and an anonymous install identifier. They never include message content, subject lines, email addresses, or search queries. Content does not leave your machine.

Paid plans are handled by a third-party payment provider acting as our merchant of record. It processes your payment details and billing address under its own privacy policy; we never see or store your card details. We receive only what we need to operate your subscription: your plan, its status, and billing period.

We rely on a small set of third-party service providers to run Vithos: hosting and infrastructure, databases, email delivery, analytics, monitoring, and payments. Each processes personal data only on our instructions and only for the purpose it serves, and we share with each only what that purpose requires. Details of our current providers are available on request at hi@vithos.app.

Some providers process data outside the European Economic Area. Where they do, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Waitlist addresses are kept until you unsubscribe or ask for deletion. Account and sync records are kept while your account is active and deleted when you delete your account. Server logs and analytics are kept for short, rolling windows. Local data on your device is yours: deleting the app deletes its database.

Under the GDPR you can request access to, correction of, or deletion of your personal data, ask for a copy in a portable format, object to or restrict certain processing, and withdraw consent at any time. Write to hi@vithos.app and we will respond within a month. You also have the right to lodge a complaint with your supervisory authority; in France, that is the CNIL.

Vithos is not directed at children under 15, and we do not knowingly collect personal data from them.

If we change this policy in a way that matters, we will update this page and, for significant changes affecting app users, tell you in the app or by email. The date at the top always reflects the latest version.