Privacy Policy for BusyBox

Effective date: 16 September 2026

BusyBox is a Linux desktop email client developed by BusyStack.

This Privacy Policy explains how BusyBox handles information when you use the app, including Gmail and Microsoft account connections, synchronized mail, attachments, local files, OpenPGP features, remote content, and feedback.

Information BusyBox accesses

BusyBox may access the following information when you connect an account or use app features.

Google account information

When you connect a Google account, BusyBox requests the OpenID, email, profile, and gmail.modify permissions required by its authentication and Gmail integration.

BusyBox may access:

  • Your Google account identifier and Gmail email address, used to identify the connected account inside BusyBox.
  • Gmail mailboxes, labels, threads, messages, message headers, sender and recipient information, subjects, message bodies, timestamps, message state, stars, drafts, and related Gmail metadata.
  • Gmail attachments and attachment metadata when required for synchronization, display, download, forwarding, drafting, or sending.
  • Gmail synchronization information such as history identifiers and provider message identifiers.
  • Raw RFC/MIME message content when you explicitly request message source, export a message, or when BusyBox requires exact MIME content for supported mail operations.
  • Search results returned by Gmail when provider-assisted search is used.

BusyBox uses Gmail data to provide email features including displaying and synchronizing mail, creating and editing drafts, sending messages, replying, forwarding, working with labels, changing message state, searching mail, downloading attachments, and keeping local BusyBox data synchronized with Gmail.

BusyBox does not use IMAP or SMTP for Gmail.

BusyBox’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft account information

When you connect a Microsoft account, BusyBox requests delegated Microsoft permissions including OpenID identity permissions, User.Read, Mail.ReadWrite, Mail.Send, MailboxSettings.Read, and offline_access.

BusyBox may access:

  • Your Microsoft account identifier, home-account identifier, tenant identifier, email address or user principal name, and display name, used to identify the connected account.
  • Microsoft mail folders and folder metadata.
  • Messages, conversations, sender and recipient information, subjects, message bodies, timestamps, flags, importance, categories, read state, drafts, and related mail metadata.
  • Attachments and attachment metadata when required for synchronization, display, download, forwarding, drafting, or sending.
  • Provider identifiers, change information, and synchronization cursors needed to keep the local mailbox synchronized.
  • Search results returned by Microsoft Graph when provider-assisted search is used.

BusyBox uses Microsoft data only to provide email and related account functionality inside BusyBox.

BusyBox connects to Microsoft through Microsoft Graph rather than IMAP or SMTP.

The current BusyBox implementation uses Microsoft Graph for account profile and mail operations. Although MailboxSettings.Read is included in the Microsoft authorization configuration, the current application source does not contain a Microsoft mailbox-settings API request.

Contacts and calendars

BusyBox does not request Google Contacts, Microsoft Contacts, Google Calendar, or Microsoft Calendar provider permissions.

BusyBox does not maintain a provider contacts database. It may locally derive correspondent email addresses and display names from synchronized mail history for features such as recipient autocomplete.

BusyBox can detect calendar invitations contained in email. When you explicitly choose to open one in a calendar application, BusyBox passes the iCalendar content to the desktop's registered calendar handler. This does not give BusyBox access to your calendar account.

Mail content and attachments

BusyBox processes email content necessary to provide its mail-client features.

This may include:

  • Sender, From, To, Cc, Bcc, and Reply-To addresses.
  • Subjects and message previews.
  • Plain-text and HTML message bodies.
  • Message IDs, reply references, and conversation relationships.
  • Labels, folders, categories, read state, flags, importance, and similar provider metadata.
  • Attachments, filenames, MIME types, sizes, content identifiers, and attachment data.
  • Draft recipients, subjects, bodies, signatures, attachments, and scheduling information.
  • Mailing-list and unsubscribe metadata contained in messages.
  • Calendar invitation metadata contained in messages.
  • OpenPGP verification and decryption information.

HTML mail is sanitized before it is stored and rendered.

Raw message source is not fetched merely by displaying a normal message. BusyBox requests raw source when an explicit source-view or export operation requires it or when an exact MIME representation is required by a supported mail operation.

Files

When you attach a local file, drop a file into the composer, save an attachment, export a message, import OpenPGP key material, or perform another explicit file action, BusyBox accesses the selected file or destination as required for that action.

Files attached to an outgoing message may be uploaded to the connected email provider when a draft is synchronized or the message is sent.

Downloaded attachment copies kept in BusyBox's own cache are encrypted. When you explicitly save an attachment outside BusyBox, the resulting file is stored at the destination you selected and is no longer protected by BusyBox's encrypted attachment cache.

A raw .eml export is an unencrypted copy of the message source and is created only after an explicit export action.

Remote images and external content

BusyBox blocks remote images in HTML email by default.

When you explicitly load remote images, or choose to trust a sender for remote images, BusyBox may connect directly to the HTTPS image addresses contained in the message. The remote server can therefore receive the requested image URL and normal network information associated with the request, such as your network address.

If you choose to trust a sender, BusyBox stores that preference locally and may load remote images for later messages from that sender.

BusyBox does not allow the embedded message renderer to freely load external HTTP or HTTPS resources.

External web links are opened through the system browser only after you activate them. The destination website or browser can then receive the destination URL and normal network metadata.

For supported mailing-list messages, BusyBox may offer unsubscribe actions. A confirmed HTTPS one-click unsubscribe sends a limited request directly to the unsubscribe endpoint specified by the message. BusyBox does not automatically fetch unsubscribe URLs during ordinary synchronization or message display.

Feedback

BusyBox sends feedback to BusyStack only when you explicitly submit an issue report from the app.

A feedback submission includes:

  • A random submission identifier.
  • BusyBox application version.
  • Build number.
  • Linux platform identification.
  • The problem description you entered.

If you choose to include technical details, BusyBox also sends:

  • Your Linux operating-system version.
  • The application locale.

BusyBox feedback does not automatically include mailbox content, email addresses, message identifiers, provider responses, OAuth tokens, upload URLs, or attachments.

The current BusyBox feedback form does not submit a reply email address.

The BusyBox client does not define a fixed server-side retention period for submitted feedback.

How BusyBox uses information

BusyBox uses connected-account and local data to:

  • Display and synchronize your mailboxes.
  • Display messages, conversations, folders, labels, and categories.
  • Create, edit, synchronize, and delete drafts.
  • Send, reply to, and forward email.
  • Change read, unread, flag, star, folder, label, category, and related message state.
  • Download and manage attachments.
  • Provide local and provider-assisted mail search.
  • Build a local search index.
  • Provide recipient autocomplete from local correspondence history.
  • Maintain pending operations while a provider or network connection is unavailable.
  • Provide BusyBox-managed scheduled sending and snoozing.
  • Provide desktop mail and failure notifications when enabled.
  • Process mailing-list and calendar metadata contained in messages.
  • Provide OpenPGP signing, verification, encryption, and decryption when you use those features.
  • Maintain account, synchronization, security, and application settings.

BusyBox does not use connected-provider data for advertising or marketing.

BusyBox does not include application analytics or telemetry.

BusyBox does not operate a BusyStack cloud mailbox or mail relay. Normal Gmail and Microsoft mailbox synchronization occurs directly between BusyBox and the relevant provider.

Local storage

BusyBox is designed as a local-first email client and stores synchronized mailbox data locally on your device.

The local database may contain:

  • Connected account records and provider identifiers.
  • Mail folders, Gmail labels, and Microsoft categories.
  • Conversations and message metadata.
  • Email addresses and display names associated with messages.
  • Message subjects, bodies, and sanitized HTML.
  • Locally derived correspondence history.
  • Drafts and draft content.
  • Search indexes and saved searches.
  • Synchronization cursors and synchronization state.
  • Pending provider operations.
  • Notification state and notification preferences.
  • Scheduled-send and snooze state.
  • Sender identities and email signatures.
  • Remote-image permissions.
  • OpenPGP preferences, fingerprints, address mappings, and safe verification or decryption metadata.
  • Application settings.

BusyBox opens its local Drift database using SQLCipher. The database is protected with a randomly generated 256-bit key stored through the operating system's Secret Service.

BusyBox does not fall back to a plaintext mailbox database if the required database secret is unavailable.

Attachments

Cached attachment payloads are stored separately from the SQLCipher database.

BusyBox uses an independent per-account attachment master key stored through Secret Service and encrypts cached attachment data using authenticated XChaCha20-Poly1305 encryption.

BusyBox does not store the attachment master keys in its SQLCipher database or ordinary filesystem files.

Remote images that BusyBox caches are also protected using the account's encrypted cache.

Authentication credentials

Google OAuth credentials are stored using the operating system's Secret Service.

The Microsoft authentication component also uses Secret Service-backed credential storage for its MSAL account cache.

Google and Microsoft authorization is performed through the system browser. BusyBox does not ask you to enter or store your Google or Microsoft account password.

OpenPGP

BusyBox maintains its own private GnuPG home for OpenPGP functionality and does not use or modify the user's unrelated system GnuPG keyring.

Imported OpenPGP key material is stored in this BusyBox-specific GnuPG environment rather than in the BusyBox SQLCipher database.

The SQLCipher database stores only information such as key fingerprints, explicit email-address-to-key mappings, preferences, and safe verification or decryption metadata.

OpenPGP passphrases remain between GnuPG Agent and the graphical Pinentry application rather than being passed into BusyBox's Dart application code.

Standard OpenPGP/MIME protects message bodies and attachments but does not normally conceal transport headers such as Subject, From, To, and Date.

Desktop notifications

BusyBox can display desktop notifications for new mail and certain account or synchronization failures.

The default notification privacy setting uses a generic notification rather than exposing sender or subject information.

If you change the notification privacy setting, BusyBox can display sender information or sender and subject information through the desktop notification system.

BusyBox does not place email body previews in these notification modes.

Data sharing

BusyBox does not sell your personal data.

BusyBox does not share connected mailbox data with advertisers, data brokers, or unrelated third parties.

BusyBox sends data to other services only as required for features you use.

Google

Google account and mail data is exchanged directly with Google APIs as required to authenticate the account and provide Gmail functionality.

This may include reading and synchronizing messages, drafts, labels, attachments, and related metadata, and sending changes or new messages back to Gmail.

Microsoft

Microsoft account and mail data is exchanged directly with Microsoft identity services and Microsoft Graph as required to authenticate the account and provide Microsoft mail functionality.

This may include reading and synchronizing folders, messages, drafts, categories, attachments, and related metadata, and sending changes or new messages back to Microsoft.

Other destinations

Separate from normal provider synchronization:

  • Remote image servers receive requests only when remote images are loaded under your selected permissions.
  • Websites receive a destination only when you activate an external link and it is opened through your system browser.
  • A confirmed one-click mailing-list unsubscribe sends its request to the unsubscribe endpoint specified by the message.
  • Your desktop calendar handler receives iCalendar data when you explicitly choose to open an email invitation in a calendar application.
  • BusyStack receives the feedback fields described above only when you explicitly submit an issue report.

BusyBox does not automatically send synchronized mailbox content to BusyStack servers.

Data retention

BusyBox keeps local account and synchronized mailbox data on your device while the account remains connected and while cached data is required by the application.

When you remove an account from BusyBox:

  • BusyBox stops synchronization for that account.
  • Locally stored authentication credentials for that account are removed from BusyBox's credential storage.
  • The account's encrypted attachment cache is purged.
  • The account's attachment encryption key is removed.
  • BusyBox's protected MIME spool for the account is purged.
  • The account record and account-associated mailbox data are removed from the BusyBox local database.

Removing a Gmail account can also revoke the provider authorization when that revocation option is selected.

You can separately revoke BusyBox's access through your Google or Microsoft account settings.

Removing local BusyBox data does not delete mail that remains stored by Google or Microsoft unless the relevant mail operation was itself synchronized to the provider.

Files you explicitly exported or saved outside BusyBox are not removed when the account is removed.

Feedback submitted to BusyStack is separate from the local mailbox data described above. The BusyBox application source does not define a fixed server-side retention period for feedback submissions.

Account authorization

Google authentication uses OAuth 2.0 Authorization Code flow with PKCE.

BusyBox opens Google authorization in the system browser and uses a temporary loopback callback bound to the local device. Authorization requests use cryptographically generated state, nonce, and PKCE values, and BusyBox validates the returned authorization information before accepting the account.

Microsoft authentication uses Microsoft's desktop/public-client authorization flow through the system browser and a local Microsoft authentication component.

BusyBox does not use your Google or Microsoft account password for these integrations.

You can revoke BusyBox's provider access using the account-security controls supplied by Google or Microsoft.

Data protection and security

BusyBox uses the following mechanisms to protect connected-account data:

  • Gmail and Microsoft Graph connections use HTTPS/TLS.
  • BusyBox connects directly to Gmail and Microsoft Graph and does not route normal mailbox synchronization through a BusyStack mail server.
  • The local mailbox database is encrypted using SQLCipher with a random 256-bit key stored through Secret Service.
  • Cached attachments and remote-image cache data use separate authenticated encryption with per-account Secret Service keys.
  • BusyBox has no plaintext fallback when required database or cache encryption keys are unavailable.
  • OAuth credentials and the Microsoft authentication cache use operating-system-backed Secret Service storage.
  • HTML email is sanitized before persistence and rendered in an isolated surface with JavaScript, plugins, browser storage, arbitrary file access, and normal external subresource loading disabled.
  • Remote images are blocked by default.
  • External links do not navigate inside the embedded message renderer.
  • Logs redact OAuth tokens, authorization codes, bearer credentials, email addresses, and other security-sensitive values.
  • OpenPGP key material is kept in a separate BusyBox-specific GnuPG environment.
  • Downloaded attachment caches are encrypted, and temporary decrypted files are restricted and removed through the attachment lifecycle.
  • Raw .eml source is fetched only for explicit source or export operations or when required by an exact MIME operation.
  • Calendar handoff uses a permission-restricted temporary .ics file and removes it after the handoff.
  • The Snap package runs under strict Snap confinement.

No method of electronic storage or transmission is completely secure. Users are responsible for protecting access to their operating-system account, Secret Service/keyring, device, exported files, and device-level backups.

Children’s privacy

BusyBox is not directed to children under 13. BusyBox does not knowingly collect personal information from children under 13.

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. When it changes, the effective date at the top of this page will be updated.

Contact

For privacy questions or requests, contact:

support@busystack.org

Website hosting — updated 15 October 2026

Cloudflare hosts the live BusyStack website at busystack.org and processes its HTTP requests, including your IP address and ordinary network metadata needed to deliver and protect that website service. The website does not add advertising, analytics scripts or application telemetry. Cloudflare may process service and security data under its own applicable terms and privacy policy.

This hosting notice applies only to the hosted website, not to the desktop application's other behavior. Cloudflare also hosts the production feedback service described in the separate Feedback Privacy for BusyMark and BusyMax.