Privacy

We collect nothing.

cmail has no server, no accounts, no analytics and no telemetry. Your token and settings stay on your computer.

Where your data goes

The command-line tool

Stored locally

Settings and your Cloudflare token are kept in one config file with mode 600. Secrets are redacted in config show and --verbose output.

Services contacted

api.cloudflare.com with your token. GoDaddy only if REGISTRAR=godaddy. The installer script comes from raw.githubusercontent.com; without --local it downloads the release binary and its checksum from GitHub Releases (github.com). Homebrew installs also download from GitHub.

Browser links

Setup may open Cloudflare, Gmail or Google Account pages in your browser. Use --no-browser to print the links instead.

The forwarded mail itself is handled by Cloudflare and your inbox provider under their own privacy policies. cmail never sees your messages.

This website

No cookies, analytics, fonts or third-party scripts. Every file is served from this site.
One browser storage key. The setup guide saves which steps you ticked under cmail:setup-progress:v2, as true/false values only. It stays in your browser. Reset progress deletes it.
No forms. The site never asks for tokens, passwords or email addresses.
Hosting. The site is served by GitHub Pages, which may log visits under GitHub’s privacy statement.

Questions

Open an issue on GitHub. The source is public, so you can check every network call yourself in src/cloudflare.rs.