EmailOwl is a privacy-first email-triage app for iPhone, Mac and Windows, provided by Chapple Property Services Ltd (“we”, “us”, “EmailOwl”), a company registered in England & Wales, operated by Oliver Chapple. Registered office: 7-8 Crescent Stables, 139 Upper Richmond Road, London, SW15 2TN.
For any privacy question or to exercise your rights, contact us at privacy@emailowl.app. We are the data controller for the personal data described below, except where stated otherwise (see §4 — for the Private plan you act as controller of your own Anthropic API usage).
EmailOwl reads your mail and maintains a prioritised task board. The AI never runs on our servers. It runs in one of two places depending on your plan, and this changes who can see your email content:
On iPhone and Mac, the following are held on your device:
Earlier builds: before the build released on 24 September 2026, key sharing was on by default on iPhone and Mac, and a device with no key could adopt a shared key automatically. If you used an earlier build, check the setting and use “Clear key” if you do not want a copy on our relay.
The Windows companion cannot use Apple Intelligence, so it drafts with the Anthropic API. Your key is held on your PC in Windows' encrypted local storage. Key sharing is off by default; if you turn it on, your Anthropic API key is sent to and stored on our relay, encrypted at rest, so that your other devices and a linked family member can use it for drafting. The relay only stores the key — AI calls are made directly from your computer to Anthropic. When drafting, the Windows companion also sends the email's subject line to Anthropic, and uses no writing-style profile.
You can delete a shared key at any time with “Remove key” (Windows) or “Clear key” (iPhone and Mac) in the drafting settings — this removes the copy on our relay for you and for a linked family member — or by deleting your data (§10). Note that unpairing a computer by itself does not remove a shared key from our relay. Your mailbox credentials are never sent to us in any case.
To sync your board across devices and run the Connected routine, we store the following email-derived personal data:
Purchases and subscriptions are processed by Apple via the App Store; we receive confirmation of your subscription status but not your payment details. While the app is in TestFlight, Apple also collects standard crash and beta-usage data. We use no third-party analytics, advertising or tracking SDKs of any kind. Our relay keeps ordinary server logs (e.g. IP address, timestamps) for security and reliability.
Because the AI runs in your own Anthropic environment, Anthropic's data policies apply to the processing of your email content, and they differ by plan:
| Connected (your Claude Pro/Max) | Private (your API key) | |
|---|---|---|
| Governed by | Anthropic Consumer Terms | Anthropic Commercial / API Terms |
| Used to train models? | Only if you leave training on — see below | No — API data is not used for training |
| Typical retention at Anthropic | Up to 5 years if training on; ~30 days if opted out | Short abuse-monitoring window only (days) |
We are not affiliated with or endorsed by Anthropic. Your use of Claude or the Anthropic API is also governed by Anthropic's own terms and privacy policy.
Replies are drafted in one of two ways. EmailOwl does not provide drafting from any Anthropic account of its own, and never pays for or supplies the AI that writes a draft.
Our relay is not in any drafting path. The email being replied to is fetched by your device directly from Gmail or Microsoft with your device's own sign-in, and a reply you save or send goes from your device straight to your mail provider. The email and the draft never reach our servers.
Whichever route is used, a draft is a suggestion generated by that third party's model. We do not write, review or moderate it, and nothing is sent until you send it — see §10 of the Terms, which sets out that you are the author and sender of anything that leaves your mailbox.
Your board, memory and routine data are stored on our relay server hosted in Germany (EU) by Hetzner Online GmbH. We protect it with access controls and encryption in transit (TLS).
We never sell your personal data and we serve no advertising.
Deleting it yourself. In the app, Settings → Danger zone → Delete my data deletes your stored bucket immediately. At emailowl.app/danger-zone — the page you can use without the app — deleting your account is scheduled 7 days ahead: for those 7 days the account is frozen (no triage runs; your devices show the date) and you can cancel, including by restoring the account onto a device. On the date it is erased for good, including any internal copy we hold for support; nothing can be recovered afterwards, not by us and not from a backup. Resetting parts of your data, or deleting your data while keeping the account, happens as soon as you confirm.
If you have lost both your restore code and access to every mailbox on the account, nothing can tell us which account is yours, so neither we nor anyone else can delete it on request. Cancel your subscription instead: the account is erased 7 days after the subscription ends. An account with no subscription is deleted after 6 months without activity.
When a subscription ends. When Apple or Google report that your subscription has ended, your account enters the same 7-day period — frozen, and cancelled by resubscribing or restoring it onto a device — and is then erased. A bucket that has seen no activity for 6 months is deleted automatically.
Email delivery records. The transactional emails we send (setup links, your restore code, Danger Zone confirmations, schedules and receipts) go through our email delivery provider, which keeps delivery logs — recipient address, time and subject line, never the body — for a limited period under its own retention policy.
Account and transaction records may be kept longer where we are legally required to retain them.
We share the minimum necessary with the following, each under their own terms:
| Provider | Purpose | Data involved |
|---|---|---|
| Apple | App distribution, in-app purchases, TestFlight, push (if enabled); drafting with Apple Intelligence on iPhone and Mac (Connected, if you choose it), which runs on-device under Apple's own terms and privacy policy | Subscription status, crash/beta data. Apple Intelligence drafting stays on your device — no email content is sent to Apple's servers |
| Anthropic | The AI triage (your Claude plan or your API key), drafting with the Anthropic API, and learning your writing style (always your own API key, billed to you) | Email content processed in your own Anthropic environment |
| Google / Microsoft | Gmail, Google Workspace, Microsoft 365 and Outlook.com mailbox access you authorise | Mailbox access via OAuth (held on device / in connectors) |
| Hetzner Online GmbH | Relay & database hosting (Germany, EU) | Your stored board, memory, routine data |
| Resend, Inc. (United States) | Sending setup & restore emails | Your email address, setup links |
We do not sell data or share it with advertisers or data brokers.
Mail forwarded in from other providers. If your mail is on another system — a hosted company domain, Yahoo, iCloud, AOL, BT or an older provider — you may forward it into a mailbox we support and register the original address as an alias. You set that forwarding up at your own provider; we do not have access to it and we are not a party to it. Once the mail arrives in a connected mailbox it is handled exactly like the rest of that mailbox.
Your relay data is stored in the EU (Germany). Some subprocessors (e.g. Apple, Anthropic) may process data outside the UK/EU. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
Subject to applicable law, you have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. To exercise any of these — including immediate deletion of your stored bucket — email privacy@emailowl.app. We will respond within the timeframes required by law (generally one month).
Doing it yourself. You do not need to email us: delete your data in the app (Settings → Danger zone → Delete my data, immediate), or delete your account, reset parts of your data, or download a copy at emailowl.app/danger-zone from any browser (§7 explains the 7-day period for account deletion).
UK/EU residents: you may complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk.
California residents (CCPA/CPRA): you have the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share your personal information as those terms are defined, and we do not discriminate against you for exercising your rights.
EmailOwl is not intended for, and may not be used by, anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
Data about children. The family feature is different: it exists so that a parent can have school and club email read in the context of their own children. That means you may enter your children's first names, school years, schools and clubs, and the resulting items may be shared with a second parent you link. Children do not use the app and hold no account. You must have parental responsibility for any child you enter, and you decide what to enter — first names and years are enough for the feature to work; nothing more is required. You can delete family details in the app, unlink the other parent, or ask us to delete everything (§10).
We may update this policy as the app evolves (for example, when we add end-to-end encryption or change subprocessors). We will post the new version here with an updated date and, for material changes, notify you in-app.
What changed in v1.1 (2 September 2026). Added the Windows companion throughout, including that it stores your Anthropic API key on our relay (§2, §3, §6); disclosed drafting with Apple Intelligence on iPhone and Mac and that drafts are third-party AI suggestions you choose to send (§4, §8); named the writing-style profile, family details, alias addresses and the Initial Scan window in what we store (§3); added a legal basis for data about other people, including children (§5); described family linking and data about children (§11); and covered mail forwarded in from other providers (§8).
What changed in v1.2 (24 September 2026). Corrected which drafting route each plan uses: on Connected, iPhone and Mac offer a choice of Apple Intelligence or the Anthropic API; Private and the Windows companion always draft with the Anthropic API (§4). Stated that every Anthropic draft uses your own API key and is billed to you, that our relay is not in any drafting path, and exactly what each drafting route receives (§3, §4, §8). Described the API key accurately: held on each device, with a copy on our relay only if you turn on key sharing, now off by default, and how earlier builds differed (§2, §3, §6). Described how a Connected run fetches EmailOwl's instructions and memory through the EmailOwl Relay connector, and that personal Microsoft mail passes through our relay via the Mail Bridge without being stored, with its read-only token held on our relay (§2, §3). Described how the writing-style profile is learned, and added your display name and the local drafts file to what is stored (§3). Stated that Apple Intelligence is used under Apple's terms and privacy policy, and excluded our liability for its processing of your data to the extent the law permits (§4). Privacy requests now go to privacy@emailowl.app (§1, §10, §13).
What changed in v1.3 (6 October 2026). Added the web Danger Zone (emailowl.app/danger-zone) and the two ways to delete: immediate in the app, scheduled 7 days ahead on the web with a cancellable freeze and no internal copy kept after erasure (§7, §10); an ended subscription now enters the same 7-day period instead of a 6-month hold (§7); disclosed our email delivery provider's logs (§7). Stated that an account whose restore code and every mailbox are lost cannot be identified and is not deleted on request; cancelling the subscription, or 6 months without activity, deletes it (§7).
What changed in v1.1.1 (2 September 2026). Corrected two descriptions against the app's source: the Windows companion's API key reaches our relay only if you turn on family sharing, is encrypted at rest in your bucket and a linked family member's, is only stored by us — the AI calls are made from your computer — and is removed with “Remove key” or account deletion, not by unpairing a computer (§2, §3, §6); and Apple Intelligence drafting runs strictly on Apple's on-device models — no email content goes to Apple's servers, and the earlier reference to Private Cloud Compute was wrong (§4, §8).
Privacy questions, requests or complaints: Chapple Property Services Ltd, privacy@emailowl.app. Anything else: support@emailowl.app. We aim to resolve concerns directly; you also have the right to complain to your data protection authority (see §10).
Read our Terms & Conditions →© 2026 Chapple Property Services Ltd. EmailOwl is not affiliated with or endorsed by Anthropic, Apple, Google or Microsoft. Claude is a trademark of Anthropic.