Privacy Policy: Obsidian Mail apps

Effective October 4, 2026. This policy covers the Obsidian Mail apps made by Larström Technologies: Obsidian Mail for Android, Obsidian Mail for iPhone and Obsidian Mail Client for Windows (together, “the app”). It explains what the app does with your information.

The short version

Your mail, calendar, contacts and tasks go only between your device and the mail services you add (your mail provider, such as Outlook.com, Microsoft 365, Gmail, your company's Exchange or Obsidian server, or another IMAP provider).
Larström Technologies does not receive, read, store or sell your mail or any other personal information. We have no account system: you do not sign up with us.
The app has no ads, no analytics, no crash reporting and no tracking.
What the app keeps on your device is encrypted.

What the app keeps on your device

To show your mail quickly and work offline, the app keeps a copy on your device of the messages, attachments, folders, calendar events, contacts and tasks it downloads from your accounts, plus your settings, your junk filter's training and its allow and block lists. This copy is encrypted (AES-256, using SQLCipher) with a key that is itself protected by your device: the Android Keystore, the iPhone Keychain, or Windows' own data protection for your Windows account.

Your account passwords and sign-in tokens are kept in the same protected store, never in the app's ordinary files.

On Android and iPhone this data is excluded from cloud and computer backups, so it stays on the phone. The app writes a short diagnostic log on the device (connection results and errors, never message contents or passwords); it leaves the device only if you choose to share it.

Where the app connects, and why

The app connects only to these places:

Your mail services, to sync and send your mail, calendar, contacts and tasks (IMAP, SMTP, Exchange ActiveSync, or Microsoft Graph for Outlook.com and Microsoft 365 calendars, contacts and tasks once you connect them). The app signs in with the password or app password you give it, or through Microsoft's own sign-in page in your browser; the app never sees your Microsoft password.
Microsoft's account lookup (Autodiscover at outlook.office365.com), only while you add an account: the address you type is sent there to find out whether it is a Microsoft 365 or Exchange mailbox, the way Outlook does.
Pictures in messages, only when you choose to show them for a message or sender. The app then fetches those pictures from the sender's servers, which can tell the sender your network address and that you opened the message. Tracking pixels are blocked even then. Links you tap open in your browser, without known tracking tags.
Update checks: the Android version you install from obsidiansuite.net and the Windows app check obsidiansuite.net for a newer, signed version (Android when it starts and about twice a day, Windows every few hours). Our web server sees the request, like any website visit: your network address and the app's version. We use this only to serve the update. Copies installed from Google Play or the App Store are updated by the store instead.
Windows only: the Windows app looks up the published brand logos (BIMI) of verified senders through DNS, and downloads the public list of breached websites from Have I Been Pwned for its “Your Accounts” view; your addresses are not sent. If you use secure links, the message you choose to send that way is encrypted and uploaded to your organization's Obsidian Suite portal, where its recipients open it.

Mail you send goes to the people you address it to, through your own mail service.

Permissions

Internet and network state: to reach your mail services.
Notifications: to tell you about new mail. You can turn them off in the app or in your device's settings.
Background refresh: to check for new mail while the app is closed (Android every 15 minutes or so; on iPhone when iOS allows).
Install updates (only the Android version from obsidiansuite.net): to hand a downloaded, verified update to Android's installer, which asks you first.

The app does not use your location, camera, microphone, phone contacts or device calendar.

We do not sell, rent or share your personal information, and we do not use it for advertising. Your mail services receive what they need to deliver and store your mail, under their own privacy policies.

Removing your data

Removing an account in the app deletes its mail, folders, calendar, contacts and tasks from the device, together with its password and sign-in. Uninstalling the app deletes everything it kept. Nothing is kept by Larström Technologies, so there is nothing for us to delete. Your mail on your mail service is not affected either way.

Children

The app is a general mail client and is not directed at children under 13.

Security

Connections to mail services use TLS. A server whose certificate your device does not trust (for example a company server with its own certificate) is used only after you compare and accept its fingerprint. Updates are checked against a digital signature before they are installed.

Changes to this policy

If we change this policy, we will update this page and its effective date. If a change affects what the app sends anywhere, we will also say so in the app's release notes.

Contact

Larström Technologies. Questions about this policy or your privacy: larstrom.com/#contact.