Privacy notice
The bridge has no publisher-operated server, analytics, advertising, or tracking. Straeder does not receive Mail or Calendar content through the app.
Information the app can use
Depending on your request and selections, the app can use Mail fields, Calendar fields, local account and calendar selections, and content-free technical status. The current version does not read or transfer attachments.
Purpose and location of processing
Processing occurs locally on the Mac to perform a request from the configured MCP client, enforce your selections, confirm protected actions, and check technical operation. Results are returned to the MCP client you configure, such as Codex or ChatGPT desktop. That client and its provider have their own privacy terms.
Local storage
- Selections are stored in macOS preferences.
- A random IPC secret is stored in macOS Keychain as a non-synchronizing, device-bound item.
- The local audit log contains the time, method, outcome, and an optional standardized error code, but no free-form content or tool parameters.
- A bounded operation registry stores opaque identifiers and hashes to prevent duplicate mutations after retries.
- Mail and Calendar content is not copied into a separate bridge database.
- A content-free diagnostic report is created only when you choose Export.
Sharing and retention
The bridge shares requested results only with the locally configured MCP client and, if you configure one separately, a secure tunnel provider. The app does not sell information or share it with advertisers, data brokers, or analytics providers. Audit logs rotate at 5 MB; completed and failed operation records expire after seven days. Local settings and Keychain items remain until you remove them.
Your controls
You can revoke macOS permissions, select Mail accounts and calendars individually, clear local audit logs, and remove the app. Removing the app does not automatically remove preferences, Application Support data, Keychain items, or exported diagnostic files. See the safe removal steps.
This staging website
The unlisted preview is publicly accessible through Cloudflare and the website host. When you make an HTTP request, these infrastructure providers may process operational security and access data such as time, IP address, requested path, user agent, and referrer. The pages set no cookies and contain no product analytics, forms, external fonts, or scripts. Do not place Mail or Calendar content in the URL or other request fields.
Security and questions
Local IPC uses controls including HMAC-SHA256, timestamps, one-time nonces, same-user checks, and restrictive file permissions. No security measure can protect information after the Mac account or a connected service account is compromised. Use the private invitation route for privacy questions, and never post private Mail or Calendar content in a public issue.