Fumiko

Security & Transparency

Privacy Policy

Your privacy is our primary design principle. Fumiko keeps all email synchronization, credential storage, and AI processing entirely on your local device.

1. Overview & Core Philosophy

Fumiko is a local-first desktop email client and inbox watcher developed by ShuhariTech. "This Privacy Policy outlines how Fumiko interacts with your data when you link your Gmail, Outlook, or standard IMAP accounts."

Fumiko operates without any central backend servers, cloud relays, or proxy services. All network requests take place directly between your local machine and your email providers over encrypted HTTPS connections.

2. Information Fumiko Accesses & Stores

Fumiko operates strictly as a read-only client to monitor, summarize, and categorize your email. It never requests permission to send, alter, or delete emails from your remote mailboxes.

  • Account Authentication Credentials: For OAuth providers (Google and Microsoft), Fumiko uses industry-standard OAuth 2.0 with PKCE via dynamic loopback listeners (127.0.0.1). Fumiko never asks for, sees, or stores your primary email account passwords. For IMAP accounts, provider-generated App Passwords are encrypted directly in your operating system's native credential vault.
  • Refresh Tokens & Client Secrets: Long-lived OAuth refresh tokens and user-provided client secrets are stored exclusively in your operating system's native credential vault (Apple Keychain, Windows Credential Manager, or Linux Secret Service / Keyutils). They are never written to plain-text database tables or application logs.
  • Access Tokens: Short-lived access tokens are retained exclusively in system memory (RAM) and are discarded upon token rotation or application shutdown.
  • Email Metadata & Snippets: To enable fast, offline inbox navigation, Fumiko synchronizes lightweight summary metadata (message IDs, subjects, sender addresses, timestamps, preview snippets, read status, and trash flags) directly into an indexed local SQLite database on your device.
  • Full Message Bodies: Message bodies (HTML and plain text) are fetched on-demand directly from your provider only when you view an email or during quota-capped Tier 2 AI body analysis. Message bodies are rendered inside sandboxed, sanitized HTML containers and are not permanently saved into the local SQLite database.
  • Watch Rules & Local Settings: User-configured watch criteria, custom category labels, display names, and theme preferences (custom.css) reside strictly in your local database.

3. Local-Only AI Classification

Fumiko provides automated email classification powered by local language models through an on-device daemon (such as Ollama) over local IPv4 loopback (http://127.0.0.1:11434).

  • Zero Cloud AI Calls: Email headers, preview snippets, and body contents are never transmitted to external cloud AI APIs (such as OpenAI, Anthropic, or remote inference endpoints).
  • Two-Tier Local Processing: Tier 1 evaluates only metadata and snippets already cached locally. Tier 2 promotes ambiguous messages to temporary body inspection under strict batch limits. All inferences occur entirely in memory on your local CPU/GPU.
  • Prompt Isolation: Prompt buffers are temporary and discarded immediately following local model evaluation.

4. Third-Party Provider Integrations

Fumiko interacts directly with official third-party APIs using minimal, read-only permissions:

  • Google (Gmail API): Fumiko uses the https://www.googleapis.com/auth/gmail.readonly scope. Fumiko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Fumiko does not transfer, sell, or use Google user data for advertising, profiling, or training external AI models.
  • Microsoft (Microsoft Graph API): Fumiko requests Mail.Read, User.Read, and offline_access permissions to authenticate and sync inbox metadata from personal, school, or work accounts directly via Microsoft identity endpoints.
  • Universal IMAP Providers (Apple iCloud, Fastmail, Yahoo, Gmail, or Custom Mail Servers): Fumiko connects directly to your specified mail servers using encrypted TLS connections on standard port 993. All IMAP communications (credential verification, message header discovery, and PEEK body retrievals) occur strictly between your computer and your email server with no intermediary proxies or relay servers.

5. Information Fumiko Does Not Collect

  • Fumiko does not collect telemetry, crash dumps, IP addresses, or diagnostic logs.
  • Fumiko does not use third-party analytics SDKs, trackers, or cookies.
  • Fumiko does not sell, rent, monetize, or broker user data under any circumstances.
  • Fumiko does not run intermediate cloud servers or proxy your network traffic.

6. Data Retention, Control, and "Wipe All Data"

Because all data is stored locally, you have total control over your information at all times:

  • Account Unlinking: Disconnecting an account immediately removes its refresh token from your operating system keyring and triggers a cascading deletion of all associated email metadata and classifications in your local SQLite database.
  • Configurable Trash Purging: You can configure automated local retention windows to permanently delete expired or trashed items from your local database.
  • One-Click "Wipe All Data": Fumiko includes a built-in master reset feature. Using the "Wipe All Data" function will:
    1. Delete all saved refresh tokens and custom OAuth client secrets from your operating system keyring.
    2. Atomically clear all linked accounts, synchronized emails, classifications, watch criteria, and settings from SQLite.
    3. Perform an immediate database checkpoint and VACUUM to physically zero out and reclaim disk space.
  • Revoking Access: You can revoke Fumiko’s access tokens at any time directly through your Google Account Security Settings or Microsoft Privacy Dashboard.

7. Application Security Practices

Fumiko employs defensive architectural safeguards to secure your mailbox data:

  • Keyring Isolation: Secrets are physically separated from application databases and held in native OS-level credential vaults.
  • PKCE & Constant-Time Validation: Authorization requests generate cryptographically random PKCE verifiers and validate CSRF state tokens byte-by-byte to prevent timing side channels.
  • HTML Frame Sandboxing: Email content is sanitized using strict parsers (Ammonia) and isolated within sandboxed frames to prevent cross-site scripting and unauthorized local resource access.
  • Redacted Logging: Credential structures implement redacted debug formatting to prevent tokens from appearing in terminal output or system traces.

8. Children's Privacy

Fumiko is a desktop email utility and is not directed at children under the age of 13 (or 16 in the European Union). ShuhariTech does not knowingly collect or solicit personal information from children.

9. Changes to This Policy

This policy may be updated periodically to reflect new local features or changes in provider API requirements. The revised version will always be published on this page with an updated effective date.

10. Contact Information

If you have questions, feedback, or security concerns regarding Fumiko or this Privacy Policy, please contact ShuhariTech:

ShuhariTech is based in the United States.

Effective date: September 14, 2026