Who this policy covers
Finch is an open-source desktop email client from Automate Digital. This policy covers email and account data handled by Finch, including Google user data. For support, privacy questions or help removing local data, contact hello@automatedigital.ai. Do not send passwords, tokens or private messages in a support request.
This is separate from our website privacy policy, which covers this website’s forms, cookies and analytics. Visiting these pages uses the website’s analytics; Finch itself does not include app telemetry or an Automate Digital hosted email service.
Account access and how email is used
Finch connects directly from your device to your configured mail provider using IMAP/SMTP or JMAP. It uses account addresses, identities, folders, message headers, bodies, recipients, flags and attachments to display, search and organise mail, prepare drafts and send messages you choose to send. Mail and changes may also be stored by your provider; outgoing messages and attachments go to your provider and intended recipients.
Google sign-in opens your system browser and requests https://mail.google.com/ for mail access through IMAP and SMTP, plus openid email to check the signed-in account’s identity. The mail permission allows reading, composing, sending and permanently deleting email; it is broader than read-only access. Finch uses access and refresh tokens to connect and reconnect to Google.
Google sign-in is currently limited to development test users; public restricted-scope verification is not complete. Microsoft and Yahoo browser OAuth sign-in are not implemented. Availability depends on your provider’s authentication and server requirements.
Local storage and credentials
Finch keeps account configuration, preferences, a local mail metadata/search index, local drafts, staged attachments and send-recovery records in its application data directory. Message content and downloaded or saved attachments can also be held on your device. Drafts saved to your mailbox are also retained by your mail provider. Local data is retained to support continued use and recovery, until removed through the relevant controls or by deleting local files.
Remembered credentials use Electron safeStorage with the operating system’s encryption/keyring when available. Remembering Google OAuth credentials requires that secure storage. Password-based connections can offer an explicitly accepted unencrypted local-storage fallback when secure storage is unavailable; session-only login avoids remembering those credentials. Credential protection does not mean that the whole mailbox, index or every local file is encrypted. Protect your device, backups and user account accordingly.
Remote images and sender avatars
Remote images are enabled by default. When allowed, displaying mail can request images from servers selected by the sender and disclose your IP address, request time and identifiers in the image URL, potentially revealing that a message was opened. Sender avatar lookups use a hash of the sender’s email address with Gravatar and may contact the sender’s domain, Twenty Icons or DuckDuckGo for brand icons. Those services receive network information and the requested hash or domain.
Turn off remote images in Settings to disable automatic remote image and avatar requests. An explicit image-loading action can still permit an image request for unlocked protected content. External links you open and your mail provider are governed by their own policies.
Optional agents and external processing
Agent features are optional and require you to configure or connect an agent runtime. When you use them, prompts, earlier agent conversation context, tagged references and permitted mail-tool results can be passed to that runtime and its selected model service. Results may include addresses, subjects, message bodies and attachment metadata. The Finch mail tools do not provide attachment file contents, but information you put into a prompt may leave your device.
Access depends on the granted account or conversation scope; a session can cover all connected accounts when that scope is selected. Tagged references provide context and do not themselves restrict access. Read permission and permission to create new local drafts are separate. Finch’s mail tools cannot send, delete or archive mail, change credentials or overwrite existing drafts. Review and sending remain actions in Finch.
Finch can save bounded agent conversation history locally using OS-backed encryption when available. Disconnecting a mail account is not a command to erase all agent history. External runtimes may also keep their own logs and conversations. Their processing, retention and training practices depend on their independent policies and your account settings. Review these before granting access to sensitive mail; stopping or revoking a connection does not recall information already shared.
Sharing and Google user data
Automate Digital does not receive your mailbox through a hosted Finch mail backend, and Finch does not sell your Google user data or use it for advertising. Data leaves the device for the provider connections, message delivery, optional image/avatar requests and user-enabled agent processing described above. If you contact support, we receive what you choose to send.
Google user data must be handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Optional external agent processing requires particular care: this policy does not certify those services’ compliance or promise that they never retain data or use it for training. Google verification is not complete.
Disconnecting, revoking access and removing data
Disconnecting an account closes its provider connection and removes its saved connection credentials, account records, local message index, associated local drafts and send journals from Finch’s active stores. It does not delete the provider’s mailbox or automatically revoke Google consent. Revoke Finch separately in Google Account third-party connections, or use your provider’s security controls.
Other retained data can include agent history, settings, migration backups, files you saved or exported, system backups and records held by providers or external agents. Manage those separately. Uninstalling the app does not guarantee deletion of its application data or copies elsewhere. Contact us for help locating local data; we cannot erase copies held solely on your device or by an independent provider.
Policy updates
We will update this page when Finch’s data handling changes. Last updated: 5 November 2026.