Privacy policy

Last updated September 24, 2026. Family Mail is a private, personal service operated by your family organizer, Tyler.

What the service accesses

When you connect Gmail, Family Mail receives your email address and authorization to read email messages and settings and send email on your behalf. These provider permissions can cover your entire mailbox. The application checks recent inbox messages and reads their sender, subject, authentication information, date, and content to find sign-in emails. During setup it can search recent messages for a sample you select.

We store your display name, passkey public key, recovery-code hash, session information, connected email address, encrypted connection credentials, and sharing choices. Your email password is not collected by the Gmail connection. Yahoo connections use a separately generated app password.

How information is used and shared

Information is used to connect your mailbox, authenticate your portal account, apply the rules you enable, and send matching plain-text messages to the family recipients you select. The forwarded message can include the sign-in code and other text in that message. Attachments are not forwarded. Your email provider and each recipient’s provider process those messages for delivery.

Other family members cannot browse your inbox through Family Mail. The organizer administers the server and can technically access its runtime data. We do not sell mailbox data, use it for advertising, or send it to AI services. Google user data is used and transferred in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Storage and retention

API connection credentials and queued message content in the portal are encrypted at rest on the organizer’s server. Pending messages have a short delivery window; queued content is removed after delivery, expiry, cancellation, or uncertain delivery. Activity and delivery metadata are kept for up to 30 days. The seven most recent encrypted portal backup snapshots may retain older records until rotation. Forwarded copies remain in recipients’ mailboxes under their providers’ policies.

Some accounts connect through Thunderbird on the organizer’s Mac instead of a direct API connection. Thunderbird manages those credentials and its local message headers and caches separately. Full offline mailbox downloads are disabled for the configured local account, but this does not eliminate all local storage. Thunderbird’s profile is outside the portal’s encryption and backup system. Disconnecting in Family Mail stops portal sharing; the organizer must separately remove the account from Thunderbird to remove that local connection.

Your choices and deletion

You can pause sharing, change recipients, or disconnect an email account in My email. Disconnecting removes that account’s active connection credentials and rules and cancels pending forwards. To revoke the provider authorization too, remove Family Mail from your Google Account’s connected apps, or revoke the relevant provider app password. A message already being sent may still arrive.

For help, access questions, or deletion of your portal account and retained records, contact Tyler through the family contact method used for your invitation. Deletion from backups occurs as snapshots rotate. Removing a connection or account cannot recall copies already delivered to recipients.

This information site

These public pages contain no mailbox connection form, analytics scripts, or advertising. The web hosting provider may process ordinary request information, such as IP addresses, to serve and protect the website.