Verdant Privacy Policy
Verdant ("Verdant", "we") is a free, open source desktop email client for Windows and Linux, developed and operated by CNS Studios. It lets you read, send and organize the mail in your Gmail account and in other IMAP mail accounts from one application on your own computer. This policy explains what data Verdant handles, why, and what control you have.
The short version
- Verdant runs on your computer and talks directly to your mail provider. There is no Verdant account and no Verdant server that receives your mail, contacts, passwords or tokens.
- CNS Studios does not collect, sell, rent or share your personal data or your Google user data.
- Your mail is never used for advertising, profiling, analytics or to train AI or machine learning models.
Who we are
Verdant is developed by CNS Studios. Source code: github.com/cns-studios/Verdant-Desktop. Contact: [email protected].
Data Verdant handles
When you connect an account, Verdant handles the following data. All of it stays on your device unless noted otherwise.
- Account details: your email address, display name and profile picture as returned by your provider, used to show which account is connected.
- Mail content: messages, drafts, threads, labels and attachments, including sender, recipients, subject, body and attachment files. These are downloaded from your provider and kept in a local database so the app can show and search them.
- Sign-in credentials: for Gmail, an OAuth access token and refresh token. For other providers, the IMAP/SMTP password or app password you enter. These are stored encrypted on your device.
- Settings: your preferences, such as language, theme and categories you create to sort your inbox.
- Local log file: a small log on your device that helps with troubleshooting. It is never sent to us automatically.
Google user data and Gmail access
If you connect a Gmail account, Verdant asks you to sign in with Google and to grant one permission (OAuth scope):
-
https://www.googleapis.com/auth/gmail.modify: lets Verdant read your messages, labels and attachments, send mail and save drafts, and change messages on your behalf (mark them read or unread, star, archive, label, move to Trash and restore). Verdant does not use this permission to permanently delete mail.
Verdant requests this permission only to provide the email client features you use inside the app. It does not request access to other Google services, such as Drive, Calendar or Contacts.
Verdant's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing email features of Verdant that you see and use.
- We do not transfer Google user data to anyone, except where needed to provide those features at your request (for example, sending a message through Gmail), to comply with law, or as part of a merger or sale with your consent.
- We do not use Google user data for serving advertisements, including retargeting or interest-based advertising.
- We do not allow humans to read Google user data. Because the data never reaches us, no one at CNS Studios can read it.
- We do not use Google user data to develop, improve or train generalized AI or machine learning models.
Where your data is stored and who receives it
Mail, settings and credentials are stored on your computer, in Verdant's application data folder. Credentials are encrypted with AES-256-GCM; the encryption key is kept in your operating system's secure storage (the system keychain or secret service) when one is available. Verdant does not upload your data to CNS Studios.
Verdant makes network requests only to the following services:
- Google (accounts.google.com, oauth2.googleapis.com, gmail.googleapis.com): to sign you in and to read and send your Gmail. Google's handling of this data is described in the Google Privacy Policy.
- Your mail provider's IMAP and SMTP servers, if you add a non-Gmail account.
- GitHub (api.github.com): to check whether a new version of Verdant is available. This request does not include your mail or account details.
- Discord, only if you turn on the optional Discord status feature: a short status text is passed to the Discord app running on your computer. It does not contain mail content, and the feature is off by default.
We do not use advertising, analytics or tracking services in the app.
Retention and deletion
Verdant keeps your data on your device only for as long as the account stays connected. You can:
- Remove an account in Verdant's settings, which deletes its locally stored mail and credentials.
- Uninstall Verdant and delete its application data folder to remove everything it stored.
- Revoke Gmail access at any time at myaccount.google.com/permissions. Verdant will then no longer be able to access your account.
Because we do not hold your data, we cannot access, correct or delete it for you. You control it directly in the app and in your mail account. If you have questions about your rights, email us.
Security
Connections to Google and to mail providers use encrypted (TLS) connections. Credentials are encrypted on disk. Anyone with access to your unlocked computer account may be able to access your local data, so we recommend using a device password and full-disk encryption. Verdant's source code is public so that anyone can review how it works.
Children
Verdant is not directed at children under 13, and we do not knowingly collect data from them.
This website
The Verdant website (verdant.cns.ad) does not use cookies, advertising or analytics. It stores your language and theme choice in your browser's local storage, and loads fonts from Google Fonts. Our server may keep standard technical logs (such as IP address and requested page) for security and operation.
Changes to this policy
If we change this policy, we will publish the new version on this page and update the date above. If a change affects how Google user data is handled, we will make that clear in the app or in the release notes.
Contact
Questions about this policy: [email protected]