Privacy / the honest version
Your mailbox stays yours.
Jaymail is an interface for existing mailboxes. Native connections go directly from your device to the configured mail server. If Databarn hosts your mailbox, Databarn operates that server and processes the data needed to provide your mail service. Independent providers operate their own mailboxes. We do not sell your data or use it for advertising or tracking. The different app and service roles are explained below.
App policy: September 26, 2026 · v1.9. Public website analytics notice updated September 6, 2026.
At a glance
- Your mailbox login gives you access to your mailbox; no separate Jaymail access code is required.
- Databarn-hosted mailbox data is associated with your account and processed to provide the service.
- Web sign-in, optional gateway connections and native apps have different data paths.
- The native iOS and Android apps connect from your device directly to your chosen Stalwart server.
- No advertising or tracking of your mail. The public site has separate cookie-free usage measurements.
- Mailbarn is not required and is not currently offered as a mailbox option.
Hosted mailboxes and independent providers
If you use a mailbox hosted by Databarn, including the mail.wedare.net service used by Jaymail’s device-pairing flow, we process your email address, messages and attachments, drafts, and calendars or address books stored with that service. These records are linked to your mailbox and used to provide the service, not for advertising or tracking. A direct device connection does not mean the mail-server operator cannot process your mail.
When you connect an independent provider, that provider stores and operates the mailbox under its own privacy terms. The hosted Jaymail Web gateway has the separate transit role described below.
Invitations and the waitlist
If you request an invitation or join a waitlist, we use the email address and signup details you provide to handle that request. The former separate Jaymail access-code gate is no longer required. A welcome link signs you into existing provisioned mailboxes; it does not create an unrelated mailbox or transfer one away from its provider. Contact us to access or remove invitation and waitlist data we hold.
Jaymail for Web
The web interface runs on infrastructure operated by Databarn. For the current hosted sign-in, your browser sends your mailbox password or app password directly to the mail server over HTTPS and obtains OAuth tokens. The web app keeps refresh tokens in an authenticated, encrypted, HttpOnly browser cookie; browser JavaScript uses an access token to connect to the mail server. When Databarn operates that mail server, the hosted-mail processing described above still applies.
Where a provider connection uses a gateway, the hosted app connects through a narrow Jaymail gateway. The gateway receives the credential needed for that connection and relays mail, calendar, contact and submission responses in transit. It is not a separate mailbox store and is designed not to persist message bodies, headers, recipients or attachments in application logs. Disconnecting an account clears its saved web connection. The mailbox stays with its provider.
Jaymail for iOS
The native iOS app connects directly from your device to your configured JMAP server. Passwords, app passwords and OAuth tokens are kept in the iOS Keychain with device-only protection. Account addresses and server settings are also stored in the app’s local database. Cached mail and search data, cached calendar data, settings, offline actions and privacy counters are kept locally. Local mail files use iOS Data Protection; notification preview credentials are in a separate Keychain group shared with the notification extension. Some local summaries are shared with Jaymail widgets or indexed for on-device system search.
Removing an account in Jaymail Settings deletes its local account record, cached database content and primary saved credential, and requests removal of its push registration. This does not delete the provider mailbox or its contents. Contact Databarn for deletion of a Databarn-hosted mailbox and associated service records; independent providers manage their own mailbox deletion. Deleting the app removes its ordinary local app storage, but iOS Keychain items can remain after uninstallation. App removal alone does not revoke a server-side app password or delete server-held mail. You can revoke a paired device’s app password in the mail service’s security settings.
On supported devices, optional email summaries use Apple’s on-device Foundation Models. Jaymail does not upload message content to an external AI service for this feature. QR scanning processes the device-link code on the phone; camera images are not uploaded. A pairing code contains credentials for the selected existing mailboxes, so treat it as private.
Jaymail for Android
The native Android app connects directly from your device to your configured Stalwart server over JMAP. Saved login credentials are encrypted with a key held in Android Keystore. Account addresses, server settings and account identifiers are also stored in the app’s local database; they are not encrypted by that credential key. Cached mail, search data, calendars, settings, snoozed messages and reminders are stored locally and protected by Android’s file-based encryption. App backup and device transfer are disabled.
You can link existing mailboxes by scanning a pairing code from Jaymail Web or explicitly pasting its pairing link. Scanning and parsing happen on the phone; camera images are not uploaded. The code contains app-password credentials for the selected mailboxes, so keep both the code and the copied link private. The app checks the listed mailboxes with Databarn’s mail.wedare.net service before adding them. This does not create a new mailbox.
Removing an account deletes its local account record, cached database content and saved credential. Deleting the app removes its local app data. Neither action deletes the hosted mailbox or revokes its server-side app password. You can revoke a paired device’s app password in the mail service’s security settings, or contact Databarn to request deletion of a Databarn-hosted mailbox. Independent providers manage their own mailbox deletion. Snooze wake-ups and reminders are generated locally on the device. Optional incoming-mail notifications have the separate data path described below.
Optional Android push notifications
New-mail notifications start off. If you enable them in a build configured for push, Firebase Cloud Messaging, operated by Google, processes the installation identifier and device token needed to deliver notifications. Jaymail does not include Google Analytics or Firebase Crashlytics. Our push.wedare.net relay stores the Firebase token, an opaque registration ID for each local account, a hash of its management secret, the push platform, verification status, timestamps, delivery mode, recent opaque delivery state and up to 512 hashed delivery identifiers per registration to prevent duplicate alerts. During setup it temporarily stores a subscription challenge. For filtered notifications, the mail server supplies opaque provider account and message identifiers transiently; only account-scoped hashes of these delivery identifiers are retained. These records are linked to the device token; they are not anonymous data. The relay receives no mailbox address or login credentials from the Android registration flow and does not store sender, subject, message body or attachments.
The Firebase message contains only the opaque registration ID. Jaymail creates a generic notification on your device. If previews are enabled, it may fetch sender, subject and a short message preview directly from your mail server and add them locally; this preview content does not pass through Firebase or the relay. If the lookup fails, the generic notification remains. You can disable previews or incoming-mail notifications in Privacy settings.
Disabling notifications stops local routing, requests Firebase token deletion and requests removal of the JMAP subscription and relay registration. Removing an account requests removal of that account’s registration before deleting its saved mailbox credential. Cleanup may need a network connection; failed relay deletions retain a protected management credential for retry. Unreachable JMAP subscriptions expire. Verified relay registrations have no fixed automatic expiry and remain until successful removal or cleanup of a token Google reports invalid. Uninstalling the app does not guarantee immediate remote deletion.
Optional iOS push relay
If you enable new-mail alerts, push.wedare.net stores an Apple push token and, for each local account, an opaque registration ID, a hash of a client secret, APNs environment, verification status, timestamps, delivery mode, recent opaque delivery state and up to 512 hashed delivery identifiers per registration to prevent duplicate alerts. These records are linked to the device token to deliver notifications; they are not anonymous data. During setup, the relay temporarily stores a push-subscription challenge. For compatibility cleanup it may receive a provider account identifier transiently; that identifier is not retained in the v2 registration record. For filtered notifications, the mail server supplies opaque provider account and message identifiers transiently; only account-scoped hashes of these delivery identifiers are retained. The relay does not use mailbox login credentials or store sender, subject, message body or attachments.
The relay sends a generic alert through Apple Push Notification service. If rich previews are enabled, the notification extension fetches the sender, subject and short preview directly from the configured mail server on your device. That content is added locally, not sent through the relay or in its APNs payload. If enrichment cannot complete, the generic alert remains. You can switch off rich previews or new-mail alerts in Jaymail Settings.
Disabling alerts or removing an account requests deletion of the relay registration and JMAP push subscription. Remote deletion needs a reachable service and can fail; app removal does not guarantee immediate server-side deletion. Verified registrations have no fixed automatic expiry in the current relay implementation; they remain until successful removal or cleanup of a token Apple reports invalid. Contact Databarn if removal does not complete. We do not promise a fixed infrastructure-log retention period here.
Diagnostics, logs and the public site
The web app can send a bounded technical error report to our own server logs: error message, truncated stack, page path without query parameters, browser user agent and time. It does not intentionally include mailbox content, search text or JMAP request URLs, and you can turn reporting off in Jaymail Settings. iOS uses Apple’s distribution diagnostics choices and includes no advertising, analytics or third-party crash-reporting SDK. Handled error site tags are logged locally. The Android app includes no crash-reporting or analytics SDK at all.
This public marketing site makes no third-party runtime requests and sets no cookies. We use self-hosted Umami to understand which public pages are useful and where visits come from. It records page paths, referring sites, approximate location, browser and device information without cookies or advertising profiles. Query strings and URL fragments are excluded. Umami processes the IP address to derive location and a rotating visitor identifier, but does not store the full IP address. Counts are estimates, not identified people. Enable Do Not Track in your browser to stop these website measurements. Separate infrastructure security logs may contain IP addresses and request details. These measurements apply only to jaymail.app, not to your mailbox or the Jaymail apps.
Third-party requests you control
- Brand logos. Enabled by default on iOS and Android. The apps query Cloudflare DNS-over-HTTPS for a sender domain, may fetch its published logo and may use Google’s favicon service as a fallback. Those services receive the requested domain and ordinary network information such as your IP address, not the mailbox owner’s address or message content added by Jaymail. Results are cached per domain for the app session. Settings → Privacy → Show brand logos disables new lookups. A logo is branding, not proof of sender identity.
- Remote images. Message images are blocked by default and load only after you choose to show them or trust a sender. Loading an image contacts its host and can reveal ordinary request information.
- Unsubscribe. A request goes to the sender’s unsubscribe endpoint only when you choose it. The URL can identify your subscription.
- Apple Push Notification service. Used only for iOS alerts you enable.
Your choices and rights
You can disconnect a mailbox or stop using Jaymail without deleting the provider mailbox. You can ask to access, correct or erase personal data we hold, object to or restrict processing, and lodge a complaint with the Dutch Autoriteit Persoonsgegevens. Independent mail providers remain responsible for their own service and retention policies.
Jaymail and the Databarn-hosted services described here are operated by Databarn Amsterdam B.V., Zekeringstraat 35, 1014 BV Amsterdam, Netherlands. Contactinfo@databarn.nlor +31 10 750 7000for support and privacy requests, including deletion of a hosted mailbox. We process service data to provide the services you request and operational security data to protect them.
Changes
We will update this page when the model changes and note the date above. Material changes will be called out before they take effect where reasonably possible.