Privacy Policy
- Your email and calendar go straight between your device and Google. They never pass through our servers.
- No AI reads your mail. No ads. No analytics or crash-reporting tools. We never sell or share your data.
- To tell your device that new mail has arrived, our notification relay receives your email address, a Google ID token, your device's push token and a random installation ID. It stores your address only in scrambled (hashed) form and uses all of this only to route notifications.
Who runs Moss
Moss is a Gmail and Google Calendar app for iPhone and Mac, operated by Pug Health LLC ("we", "us"). You can reach us at support@mossmail.app.
Your mail and calendar stay between you and Google
When you sign in with Google, Moss asks for permission to read, send, organize and delete your Gmail messages, and to view your calendars and manage their events. Moss uses this access only to show and manage your own mail and calendar in the app.
Your messages, attachments, drafts, labels and calendar events are downloaded from Google directly to your device and stored there. Changes you make go directly from your device to Google. Mail bodies and calendar data never reach our servers. The keys that let Moss reach your Google account are kept in your device's secure Keychain and are sent only to Google.
What our notification relay receives
Gmail can't wake your device directly when new mail arrives, so we run a small relay that passes Google's "your mailbox changed" signal to Apple, which then wakes Moss. Moss then fetches the new mail directly from Google. The relay never receives the mail itself.
When notifications are on, Moss sends the relay:
- your email address (lowercased), to confirm it's you;
- a Google ID token, used once to confirm you own that address. It doesn't give access to your mail;
- your device's Apple push notification (APNs) token;
- a random installation ID that isn't tied to anything else on your device.
What the relay keeps: a scrambled (SHA-256 hashed) form of your email address instead of the address itself, your device's push token, the random installation ID and the latest Gmail change number, which is how it knows something new arrived. It never receives or stores message content, subjects or senders. A hash of a known address can still be matched to that address, so we treat this record as linked to you.
This information is used only to route new-mail notifications to your devices. It's never used for tracking, advertising or anything else. Notifications carry no mail content. Signing out removes your device from the relay, and unused registrations expire after 90 days. You can also ask us to remove your relay record at any time (see below).
The relay runs on Cloudflare. Apple delivers the wake-up signals.
Contacts
Contacts access is optional. If you allow it, Moss uses the contacts on your device to show sender photos and names and to suggest addresses as you type. Your contacts stay on your device and are never uploaded.
What we don't do
- We don't use AI or machine learning on your email, and we don't use your data to train AI models.
- We don't show ads or use your data for advertising.
- We don't include analytics or crash-reporting tools, and we don't track you across apps or websites.
- We don't sell, rent or share your information.
- Moss blocks remote images in email by default, so senders can't use hidden tracking pixels to see when you open their mail.
Google API Services User Data Policy
Moss's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we use Gmail and Google Calendar data only to provide the features you see in Moss. We don't transfer it to others except as needed to provide those features, to comply with the law, or with your consent. We don't use it for advertising, we don't sell it, and we don't use it to develop or train AI or machine-learning models. People don't read it unless you give permission for a specific message (for example, in a support request), it's needed for security or to comply with the law, or it has been combined into aggregate, de-identified form for internal operations.
Revoking access and deleting your data
- Revoke Google access: go to your Google Account → Security → Your connections to third-party apps & services, choose Moss and remove access. You can also go directly to myaccount.google.com/connections.
- Delete data on your device: signing out of Moss (Settings → Sign out of Gmail) removes your mail, account data and cached files from the device. Deleting the app removes what it stored.
- Delete your relay record: signing out unregisters your device from the relay. To have any remaining relay record purged, email support@mossmail.app from the address you use with Moss.
- Your rights: depending on where you live (for example, in the EU, UK or California), you may have rights to access, correct and delete your personal information. Email us and we'll honor them for everyone.
Security
Everything Moss sends travels over encrypted connections (HTTPS). Sign-in keys stay in the device Keychain, and you can lock Moss with Face ID, Touch ID or your passcode.
Children
Moss is not directed to children under 13, and we don't knowingly collect information from them.
Changes
If we change this policy, we'll update the effective date above and, for meaningful changes, let you know in the app.
Contact
Pug Health LLC, operator of Moss · support@mossmail.app