Pouchby Kalopsia
← Back to PouchPOUCH · APP PRIVACY

Pouch privacy
policy.

Last updated: 21 October 2026.

Who we are

Pouch is an email and calendar application for Windows and macOS provided by Kalopsia Software Ltd, a company registered in Scotland under number SC547689. Our registered office is Flat 15, 3 Coburg Street, Edinburgh, Scotland, EH6 6ET.

You can contact us about privacy at [email protected].

This policy explains how Pouch handles information from your connected accounts, information stored on your device, and information we receive when providing optional services or support. Our website privacy notice separately covers visits to the Kalopsia website.

The essentials

Pouch connects your device to Google so you can use your Gmail accounts, contacts and calendars. Mail is downloaded and processed on your device; Pouch does not upload your mailbox to a Kalopsia mailbox-storage service.

That does not mean Pouch never contacts other services. Google provides your connected accounts. Email images, sender avatars and links can contact third parties. Optional Private Push uses a notification backend. Analytics and crash reporting are described separately below.

We do not sell personal information or use Google account data for advertising or credit decisions.

Connecting your Google account

You sign in through Google in your browser. Pouch receives permission tokens, not your Google password. These tokens allow it to access the permissions you grant and, where authorised, continue synchronising without asking you to sign in each time.

Depending on your permissions and the features you use, Pouch accesses:

  • Account identity, including your email address, name and profile information, to identify and display your connected accounts.
  • Email content and metadata, including senders, recipients, subjects, dates, message identifiers, labels, read status, message bodies and attachments, to display, search and organise mail and provide offline access.
  • Drafts, outgoing messages and selected files, to prepare and send email. Mail-changing permissions also support actions such as marking, starring, moving, archiving and deleting messages, and managing Gmail labels and filters.
  • Contacts and associated profile information, to suggest recipients and display contact details and avatars.
  • Calendar information, including event descriptions, times, locations and participants, to show your calendars and, when you grant the relevant editing permissions, make calendar changes you request.

Pouch uses these permissions for its visible mail, contact and calendar features. Some features will not work if their required permissions are unavailable. Google continues to hold your account data under its own privacy policy.

Search may use the local mail index or send your query to Gmail. Sending mail and synchronising changes transmit the relevant information to Google. Messages you send are also delivered to their recipients and the services those recipients use.

Information on your device

Pouch stores account settings, profile preferences and downloaded account data locally. This can include message metadata, mail bodies, attachments, contacts, calendar data, signatures, templates, saved searches, drafts and queued actions. Local storage supports fast loading, search and offline use.

Automatic background downloading for offline mail is off by default. Automatic image and attachment downloading are also off by default and have separate settings. When enabled, download windows control which content Pouch keeps available offline.

Opening mail and prefetching content can create local caches even when automatic offline downloading is off. Turning that feature off does not immediately remove existing downloads. Content subject to an age limit is cleaned up during maintenance while Pouch runs; expiry is not an instantaneous deletion guarantee.

Drafts, messages waiting to be sent and other supported offline actions may remain queued until Pouch can reconnect. It then submits the relevant actions to Google. A queued send is not delivered merely because it is stored locally.

Files you save or export, and backups you create, are separate copies. Opening an attachment may also create a temporary local file. Your operating system, chosen applications and backup services may retain copies outside Pouch's managed cache.

Email images and sender avatars

Remote images are allowed by default. Loading an image contacts its host, which can receive your IP address, request time and the image URL. A URL may contain an identifier linking the request to a recipient or message. Background image downloads can make these requests without you opening the message.

Pouch offers remote-image and tracking controls. Tracking protection is enabled by default, but blocking known trackers cannot guarantee that every tracking image or URL is detected.

Sender avatars can involve external lookups. External avatar providers are off until you choose to enable them. Initials and authorised Google Contacts photos are available without enabling the other lookup services. Depending on your avatar settings, Pouch may use:

  • Google Contacts for contact photos.
  • Gravatar, which receives an MD5 hash of the sender's email address. This hash is not anonymous and may be matched to an email address.
  • The sender's domain and its published logo or website icon, including BIMI logo lookups.
  • Google's favicon service, which receives the sender's domain.
  • Apistemic's logo service, if you enable that source, which also receives the sender's domain. This source is off by default.

These services also receive the network information needed to respond, such as your IP address. Avatar sources can be controlled in settings. Opening an email link uses your selected browser configuration; the destination website can then use its own cookies and tracking technologies.

Notifications and optional Private Push

Desktop notifications can expose message information on your screen or lock screen according to your Pouch and operating-system notification settings.

Private Push is off by default. Where available and configured, it allows Pouch to learn that a mailbox has changed without relying only on periodic checks. If you enable it, Google's notification service sends our push backend your account email address and a mailbox change identifier. Your device registers an identifier, its platform and a push-delivery token or channel, with registration and update timestamps. A Google identity token authenticates registration.

The backend uses Google Cloud services to route notifications through the relevant platform provider: Microsoft on Windows, or Apple where macOS push is supported and configured. Delivery includes account-identifying information and a mailbox change identifier, not the message body, subject or attachments. The backend does not receive your Gmail access or refresh tokens.

Push records and operational logs can reveal account associations and the timing of mailbox activity. Device registrations are removed when deregistration succeeds or an invalid delivery channel is detected. If the device is offline or a request fails, removal may not happen immediately. Disabling push does not itself erase already-recorded service logs.

Support and diagnostics

If you contact us, we receive your contact details, your message and any files or diagnostic information you choose to share. Support is handled by Kalopsia's operator using Google Workspace. We use this information to answer you and investigate the issue. Please do not send passwords, sign-in tokens or unrelated mailbox content.

Pouch writes diagnostic logs locally. Logs can include account or message identifiers, email addresses, domains, file paths and error details. They should not be treated as anonymous. Sharing local log files with support is distinct from the analytics and crash-reporting collection described below.

Optional online services, including Private Push, have their own operational logs. These may include connection information, account or device identifiers, timestamps, delivery outcomes and errors, used to operate and secure the service.

We do not routinely read your email. Human access to Google account data is limited to your affirmative agreement to review specific data for support, or access necessary for security or compliance with applicable law.

Analytics and crash reporting

Usage analytics helps us understand which features are used and how they perform. It is off until you opt in, and you can change your choice in Settings. Crash reporting is separate and used to diagnose failures and improve reliability. Where permitted without prior consent, it is enabled by default with an option to turn it off; otherwise, we ask for consent before collecting reports. You can switch it off in Settings. Enabling crash reporting does not enable usage analytics.

Automatic telemetry is limited to app and operating-system versions, basic device information, random installation identifiers, coarse feature events, timings and sanitised crash traces. Feature-usage events are subject to the analytics choice. We exclude email content, email addresses, account and message identifiers, search text, attachment names, credentials, raw logs, screenshots and session replay from automatic telemetry. Manually sharing a file with support is a separate action.

Random installation identifiers can distinguish installations across reports, so these reports should not be considered anonymous. Connections also expose network information, such as the source IP address, to the receiving service.

The selected services are PostHog for opt-in usage analytics and Sentry for crash and error reporting on Windows and macOS. They receive the permitted telemetry for these purposes. Their retention arrangements are separate from our support and push-log limits.

Google API data commitments

Our handling of information obtained through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We use this information for the user-facing features described here. We do not transfer it for unrelated advertising, resale or data-broker purposes. Transfers are limited to providing those features with your consent, necessary security purposes, compliance with applicable law, or a business transfer with your explicit prior consent as required by Google's policy. These restrictions also apply to information derived from Google account data.

Security

Pouch stores sign-in tokens using Windows user-protected encryption or the macOS Keychain. These protections are distinct from the local mail store: Pouch's mail databases, downloaded files and database backups are not independently encrypted by Pouch.

Your device's account security and disk encryption therefore matter. We recommend a protected user account, a screen lock and full-disk encryption such as BitLocker or FileVault. Protect any exported messages, attachments and backups you keep elsewhere.

Connections to Google and the push service use encrypted transport. Other connections, such as destinations opened from email links, depend on the destination's security. No storage or transmission method can eliminate every security risk.

Retention and removal

Pouch keeps local account data while needed for your connected accounts, settings and enabled features. Cache limits and maintenance controls can remove downloaded content. Clearing offline downloads does not remove all message metadata, drafts, settings or sign-in credentials.

Removing an account removes its connection and managed account data from Pouch. Shared caches, diagnostic logs and copies outside the managed account store, such as exports and backups, may remain. Removing an account from Pouch does not delete the account or mailbox held by Google.

You can also revoke Pouch's permissions through your Google Account's third-party connections settings. Revocation stops authorised access but does not erase existing local copies. Uninstalling Pouch may leave application data behind; remove remaining data and separately saved files if you no longer need them.

We keep ordinary support correspondence for up to 12 months after resolution. Diagnostic files, screenshots and sample emails supplied for support are deleted within 30 days after resolution, or sooner when no longer needed. A necessary exception for a legal obligation or dispute is limited to the relevant information and documented reason.

Our routine push-service logs are retained for 30 days, and undelivered push events for no more than 24 hours. Push registration retention follows the lifecycle described above. These limits do not set analytics or crash-reporting retention.

Individual crash and error events use Sentry's Free Developer retention period of 30 days. We do not keep a separate archive of raw reports. Sentry deletes production event-data backups 30 or 90 days after each backup is created, depending on the data type, so backup copies can outlast an individual event's normal retention period.

We begin deletion of individual-level usage analytics after 60 days from the event. Continued use of Pouch does not extend that deadline. Deletion is processed asynchronously, so starting deletion does not mean every provider-held copy disappears immediately.

International transfers

Your device communicates with Google and, depending on your settings, image hosts, avatar services, push providers and websites in other countries. Their processing may take place outside the UK. Their own privacy notices explain their handling of information.

For personal information for which Kalopsia is responsible under UK data-protection law, our legal bases are:

  • Contract, where processing is necessary to provide the Pouch features you request.
  • Legitimate interests in responding to support requests and maintaining a secure, reliable service, balanced against your rights.
  • Consent for usage analytics and other optional processing where we rely on it. You can withdraw that consent without affecting the lawfulness of earlier processing.
  • Legal obligation, where processing is required by applicable law.

Granting a Google permission authorises access to that account; it is not a blanket agreement to unrelated uses of your information.

Depending on the circumstances, you can ask to access, correct or erase personal information we hold, restrict or object to processing, or receive portable copies. Contact [email protected]. We may need to verify your identity. Some information is held only on your device or by Google, so we may explain how to exercise the relevant controls there rather than ask you to send us your mailbox.

You can raise a concern with us and have the right to complain to the UK Information Commissioner's Office. Other rights may apply under the law where you live. If your account is managed by an employer or other organisation, its administrator may also control account access and retention.

Changes to this policy

We will update this policy when Pouch's handling of personal information changes and show the effective date. Where a change requires a new disclosure or permission, we will provide it before using information in the new way.