Privacy Policy

1. Controller

Command Mail (commandmail.app) is operated by FYN Labs LLC, the controller within the meaning of the GDPR:

FYN Labs LLC 1209 Mountain Road Pl NE # 6408 Albuquerque, NM 87110 United States of America

Email: privacy@fyn-labs.com Phone: +1 (505) 209-7025

2. What Command Mail does

Command Mail is an email inbox. You bring your own addresses by forwarding or routing their mail to Command Mail. You read, sort and answer that mail in the web app, and you can let AI agents you choose work with it through the command line tool or the MCP interface. Nothing is sent on your behalf without your approval.

3. Signing in with Google

If you sign in with Google, Command Mail requests only the scopes openid, email and profile. We receive your name, your verified email address, your profile picture link and a stable Google account identifier. We use them only to create your account, sign you in and show who is signed in.

Command Mail does not request access to Gmail, Google Drive, Google Calendar or any other Google service, and cannot read them. Data received from Google is not sold, not used for advertising and not used to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data we process

Mail you receive naturally contains data of the people who write to you. We process it only to deliver and display it to you and to perform the functions you use.

• Account data: name, email address, sign-in method, password hash if you set a password, settings such as language and theme.
• Mail data: messages that reach your connected addresses, their headers and attachments, messages you write and send, drafts, labels, folders and read state.
• Connection data: the addresses and domains you connect, their intake addresses and DNS verification records.
• Access data: sessions, API tokens and OAuth grants you create for agents and tools, each with its scope and last use.
• Technical data: IP address, time, requested page and browser type in short-lived server logs, needed to deliver and secure the service.

5. Purposes and legal bases

• Providing the service you signed up for: storing, showing, sorting, drafting and sending your mail (Art. 6(1)(b) GDPR).
• Protecting you from spam, fraud and phishing through automated assessment of incoming mail (Art. 6(1)(b) and (f) GDPR).
• Operating the service securely and preventing abuse (Art. 6(1)(f) GDPR).
• Complying with legal obligations (Art. 6(1)(c) GDPR).

6. Service providers

We use the following processors, bound by data processing terms:

• Cloudflare, Inc. (USA): hosting, database, email routing and email sending. Attachments are stored in Cloudflare's EU jurisdiction.
• Google LLC (USA): Google sign-in, only if you choose it.
• TypeSafe (Jev): automated spam, fraud and phishing assessment of incoming mail. Only sender, recipient, subject, up to 4,000 characters of the text and attachment names are sent, after removing obvious secrets such as codes and card numbers. Attachments themselves and links are never opened.
• Apple and Google push services: if you enable notifications, the subject and sender of a new message are delivered to your device. The message body is not included.

7. AI agents you connect

If you connect an AI agent or tool (for example through the command line tool or MCP), it can read and act on your mailbox within the scope you grant. Data the agent retrieves is then processed by that agent's provider under their terms. You can see and revoke every connection in the settings at any time.

8. International transfers

FYN Labs LLC and several providers are located in the United States. Transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses.

9. Retention

Your mail and account data are kept while your account exists. Messages you delete move to the trash and are removed from there after the trash period. When you delete your account or ask us to, we delete your account data, mail and attachments within 30 days, except where the law requires us to keep something longer. Server logs are kept for a short period only.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Write to privacy@fyn-labs.com. You also have the right to lodge a complaint with a data protection supervisory authority.

11. Cookies

Command Mail uses only cookies that are needed to keep you signed in and to remember your language and appearance. There are no tracking or advertising cookies and no third-party analytics.

12. Changes

We update this policy when the service changes. The date at the top shows the current version; material changes are announced in the app.