Security & privacy

Your mail is only ever yours. Mailhopper is built to keep it that way, from the credential vault to the servers your data runs on.

How your credentials are stored

When you connect an account, Mailhopper needs its app password or OAuth token to reach your mailbox. That secret is encrypted with AES-256-GCM before it ever touches disk.

The key that decrypts it lives only on Mailhopper's server, never in the database and never in the app's code. So even with a copy of the database, the stored secret is unreadable: it is kept as ciphertext, a nonce, and an authentication tag, in a table the rest of the app can't read.

Encrypted on every connection

Mailhopper reaches your providers over IMAP and SMTP with TLS only and no plaintext fallback, so your mail is protected on the wire every time it moves between Mailhopper and your mailbox. The app itself is served over HTTPS.

Walled off to your account

Every record in Mailhopper is tied to your signed-in session by database-level rules, so one account can never read another's mail. Your credentials are locked down further still, in the isolated vault the data layer doesn't touch.

Hardened against abuse

Where your data lives

Mailhopper runs entirely in the EU: your data is stored in Frankfurt and the app runs in Nuremberg, both in Germany. It's built to line up with GDPR, and Standard Contractual Clauses cover any transfer abroad.

What we never do with your mail

Remote images blocked by default

HTML mail often loads images from a remote server, which can tell the sender when and where you opened a message. Mailhopper blocks remote images by default and lets you load them per message, or mark a sender you trust so their images load on their own. Junk mail never loads images automatically.

Sender logos, shown privately

Where a message comes from a verified sender, Mailhopper shows that sender's real logo in place of the letter avatar. The logo is fetched and cached on Mailhopper's servers, never by your device, so opening the message tells the sender nothing, the same stance as blocking remote images above.

A logo appears only for incoming mail that passes sender authentication (DMARC), so a forged "From" address can't borrow a brand's mark to look legitimate. Anything unverified, or with no logo to show, falls back to a plain colored letter.

Audited dependencies

Mailhopper's third-party dependencies are audited for known vulnerabilities and kept up to date, so the code you rely on stays clear of components with published security issues.

You stay in control

Disconnecting a Gmail account automatically revokes Mailhopper's access at Google, so no grant is left behind. Removing any account deletes Mailhopper's local copy only; your mailbox is never touched. You can close your whole account at any time under Settings → Delete account.

At a glance