Built to be trusted.

Your data

BackMyMail downloads your messages directly from your mail provider into an archive folder you choose on your own computer. Your mail never passes through a server of ours, and we have no copy of it.

Mail passwords use macOS Keychain. On Windows, the local credential vault is encrypted with Windows DPAPI for your Windows account. Passwords are never stored in the mail archive.

Archive files and the index are readable while the disk is unlocked. On macOS, create an encrypted disk image in Disk Utility, unlock it, then let BackMyMail verify and copy the archive there. Disk Utility can save its password in Keychain. FileVault or BitLocker protects the working disk; portable .tar.age backups use a separate passphrase.

Privacy laws

GDPR (EEA and UK): your mail is processed only on your computer. For error reports, the legal basis is our legitimate interest in keeping the app stable and secure (Art. 6(1)(f)); you can object by turning off Send error reports. Reports are transferred to the USA under Standard Contractual Clauses.

California (CCPA/CPRA): we do not sell or share your personal information, and we do not use it for advertising.

The privacy policy has the details, including what this website stores.

Health data (HIPAA)

BackMyMail archives your mail on your own computer. Your mail never reaches us, so we do not receive or store protected health information (PHI), even if your messages contain it.

Your organization stays responsible for its HIPAA compliance, including how the computer and the archive are protected. We do not sign Business Associate Agreements.

Error reports

While Settings › Privacy › Send error reports is on (it is on by default), the desktop app sends a report to Sentry when something goes wrong: the error and its stack trace, the app version and the operating system. Before a report leaves your computer, email addresses and file paths are removed; it never contains your mail, attachments, passwords or license key. There are no usage statistics, screenshots, session recordings or performance traces. Reports go out through the app's own network connection, are listed in Settings › Privacy › Network activity and expose your IP address to Sentry. Offline mode sends none. Sentry keeps reports for 90 days.

Sentry holds ISO 27001 and SOC 2 Type 2 certifications. These are Sentry’s certifications, not ours.

Payments

Polar (polar.sh) sells BackMyMail licenses on this website as our merchant of record. Polar’s checkout collects card details and Stripe processes the payment; this website never sees them. Invoices, refunds and computer activations are in Polar’s customer portal.

macOS and Windows are separate products: a macOS license does not unlock Windows, and a Windows license does not unlock macOS.

In the Mac App Store edition, Apple is the seller: payment and refunds follow Apple's terms, and refunds are requested from Apple.

Report a security issue

Write to security@backmymail.com. Our contact details are also published in /.well-known/security.txt. Please do not send mail archives, passwords or license keys by email or in a public issue.

Open-source components

BackMyMail is built on open-source libraries, used under their own licenses. The desktop app lists them in its third-party notices and shows the license texts offline.