Your inbox is
your business.

What Dumbwaiter reads

When you connect an account, Dumbwaiter asks Google or Microsoft for permission to read your mail. This includes the sender, subject, time, and message body. Message-body access is needed to find a code or login link.

The requested permissions are read-only. They do not allow Dumbwaiter to send, change, or delete your email. You sign in directly with Google or Microsoft. Dumbwaiter does not ask for your inbox password.

The Chrome extension also uses information from the current page to match recent mail to a login request. This can include the site address, form fields, and sign-in text. Automatic use on websites requires Chrome site-access permission. From extension version 1.3.13, Chrome requests HTTPS website access during installation or update, and automatic checks are on by default. A saved choice to turn them off stays in effect. Earlier versions ask for website access when you turn automatic mode on.

How the local check works

The Mac app connects to Google or Microsoft to read recent messages. It sends a limited batch of message content to the Chrome extension through a connection on your Mac. The extension checks this content for a matching code or link.

This means that the local Chrome extension receives message content, including message bodies. It does not receive the account’s OAuth tokens. The mail content is not sent to a Dumbwaiter server or an AI service.

If you choose a code, Dumbwaiter can fill it into the website. If you choose a link, your browser opens the link’s destination. The destination website then handles that visit under its own privacy policy. A login link can complete sign-in when you open it.

How Google data is used

Dumbwaiter uses data received from Google only to find and show recent one-time codes, sign-in links, email-confirmation links, and password-reset links for your authentication request.

Google mail data is not sold, used for advertising, shared with data brokers, or used to train AI models. The developer does not receive or review your mail through the app.

Dumbwaiter’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

The Chrome extension uses page and mail data only for its sign-in features. It does not sell this data, use it for advertising, or use it for credit decisions. Its data use follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

How we protect sensitive data

Dumbwaiter uses the following security measures to protect Google user data and other sensitive account data. This includes email content, login codes, links, and account access tokens.

• Encryption in transit: The Mac app uses HTTPS with TLS encryption for account sign-in, token exchange, and mail requests to Google and Microsoft. These connections protect data while it travels between your Mac and the provider.
• Encryption at rest and access control: Account access tokens, refresh tokens, and connected-account details are stored in the macOS Keychain. Keychain encrypts stored data and restricts access through the app's signed access group. Dumbwaiter uses device-only Keychain entries and does not enable iCloud Keychain sync for them. The Chrome extension does not receive these tokens.
• Protected account connection: You sign in on the provider's own page. Dumbwaiter uses OAuth with PKCE and a random state value. These checks help prevent another app from using an intercepted authorisation code or substituting a sign-in response. Dumbwaiter does not receive your inbox password.
• Local mail processing: Mail content passes between the Mac app and Chrome through Chrome Native Messaging on your Mac. The native connection permits only the configured Dumbwaiter extension identifiers. Mail content, login codes, links, and account tokens are not sent to a Dumbwaiter mail server or an AI service. The limited local storage is described below.
• Limited access and removal: Mail permissions are read-only. You can remove a connected account to delete its stored account credentials from Keychain. You can also revoke access in your Google or Microsoft account settings. Dumbwaiter has no server-side mail database or mail backup.

When you use a code on a website or choose to open a link, that website receives the value needed for the action. Copied codes can remain in your system clipboard or a clipboard manager. See local storage and your controls for these details.

What stays on your Mac

• Account access: OAuth tokens and connected-account details are stored in the macOS Keychain. The extension does not receive the tokens.
• Mail content: Recent message content is processed in memory. Dumbwaiter does not create a mail archive.
• Copied codes: “Copy codes automatically” is on by default. A suggested code may be copied to the system clipboard before you click. Selecting a code also copies it when Chrome allows clipboard access. The system or a clipboard manager can keep or sync copied content under its own settings.
• Settings: Chrome stores extension preferences on your device. Its session storage holds temporary watch state, account-check results, and message identifiers used to prevent repeated results.
• Closed alerts: The Mac app stores a hash of a message identifier and an expiry time to prevent the same alert from appearing again. A record expires after 20 minutes and is removed when the app next checks this store. These records contain no message body, code, or login link.

Dumbwaiter has no server-side mail database or mail backup to delete.

How to remove access

Remove an account in the Dumbwaiter Mac app to delete its local Keychain entry. You can also revoke the app’s access in your Google or Microsoft account settings. Removing the local account does not delete any mail.

Turn off “Copy codes automatically” in the extension settings to stop copying suggested codes before your click. This does not remove codes already held by the system clipboard or a clipboard manager.

You can turn off automatic checks in the extension settings. To restrict website access, use Chrome’s site-access controls, or remove the extension from Chrome. Uninstall the Mac app when you no longer want to use Dumbwaiter.

Dumbwaiter does not submit a website form or open an authentication link without your choice. You choose when to fill a code or open a link.

Software update checks

Public Mac releases can check an HTTPS update feed through Sparkle. An update request can expose your IP address and basic app or system version information to the download host. System-profile reporting is disabled. Update requests do not include mail, codes, login links, or OAuth tokens.

Chrome manages updates for extensions installed from the Chrome Web Store.

This website and support

This website has no analytics, advertising scripts, or tracking cookies. Its interactive example uses fixed, made-up data. It does not connect to your inbox or open a real login link.

To show a country price, the website asks its existing host, Cloudflare, for a country estimate based on your internet connection. It does not request precise device location. The pricing code uses the country code and does not save the connection details or a country preference. If detection fails, it shows the US price. Saved choices from the former country selector are cleared.

If you email support, Michael Heap receives the message and any files you choose to send. Support email is handled by the email providers used to deliver it. Only include the information needed to answer your question.

The Mac app can prepare a support report for you to check and copy or share. The report can include a site domain, result type, timing, app and system versions, account counts, and mail-access status. It excludes email bodies, account email addresses, codes, and full login links. Nothing is sent until you choose a share destination.

Purchases and licences

Stripe handles payment. Dumbwaiter stores a purchase reference, the price and currency paid, the country used for that price, the purchase date, the update end date, and licence status. Your payment email is encrypted in the licence database. Card details are handled by Stripe and are not stored by Dumbwaiter.

The licence service runs on the website host, Cloudflare. Resend sends purchase and licence-recovery emails. These services receive the data needed for payment, hosting, or email delivery. They do not receive your connected inbox content, login codes, sign-in links, or Google and Microsoft access tokens.

Activation sends your licence code, a random identifier made by Dumbwaiter for that Mac, and a short Mac name. The server stores a hash of the identifier and the name so you can manage your two Macs. It does not collect a hardware serial number. The app stores its licence code and signed activation record in Keychain.

The app checks licence status at intervals. A signed activation record allows up to 30 days between successful checks. These checks continue without a fee after the 12-month update period. The end of that period limits new updates; it does not end your right to use eligible versions.

An essential checkout cookie connects the payment return page to the browser that started the purchase. It expires after 7 days. A recovery link works once and expires after 15 minutes. Short-lived hashed records limit repeated requests. Purchase and licence records are kept while needed to provide the licence and meet record-keeping duties. Contact Michael Heap to ask about access or deletion.

Contact

For privacy questions or help removing local account data, email Michael Heap at michaeljheap@gmail.com.