Privacy Policy

Ostra is an email client. It connects to the mail accounts you choose and shows them in one inbox. This policy explains what Ostra collects, why, and what it does with it.

What we collect

• Your Ostra account. Your name, email address and sign-in details, handled by our authentication provider, Clerk.
• Connected mail accounts. When you connect Gmail, Outlook, an IMAP server or Resend, we store the access tokens or credentials needed to reach that account, and the mail we sync from it: messages, attachments, folders and labels.
• Your settings. Labels, categories, sorting corrections you make, and preferences.
• Waitlist. If you join the waitlist, the email address you enter.

We don't use advertising or third-party analytics, and we don't sell or rent your data.

How we use it

Only to provide Ostra's features to you: showing, searching, sorting and labeling your mail, sending the mail you write, keeping your accounts in sync, and the optional AI features described below.

How we protect it

• Message bodies and account credentials are encrypted at rest with AES-256-GCM, using a separate key for each record.
• All traffic to Ostra uses HTTPS. Connections to Google and Microsoft use OAuth, so Ostra never sees those passwords.
• Our logs record errors and events, never message content.

AI features

To sort mail into categories and to draft or improve replies, Ostra sends the relevant message content to Anthropic's API. Anthropic processes it to return a result and doesn't use it to train its models. Your data is never used to train AI models, ours or anyone else's.

Google user data

Ostra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the features you see in Ostra. It isn't used for advertising, isn't transferred to others except as needed to provide those features (such as the AI processing above), for security, or to comply with the law, and isn't read by people unless you ask us to for support, it's needed for security, or the law requires it.

Who processes data for us

• Clerk for sign-in and account management.
• Anthropic for the AI features.
• Google, Microsoft and your mail providers, to sync and send the mail in the accounts you connect.

Ostra runs on servers in the United States.

Keeping and deleting data

We keep your data while your account is open. Disconnecting a mail account deletes its credentials and synced mail from Ostra. Deleting your Ostra account deletes everything we hold about you. You can also revoke Ostra's access at any time from your Google account or Microsoft account settings.

Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-in users in the app.

Contact

Questions or requests: privacy@ostramail.com.