Privacy Policy

Last updated 26 September 2026

Merubo is a Gmail client for macOS, published by Clovelly AB (Sweden). This policy covers both the Merubo app and this website.

The short version: Merubo has no server. Your mail is fetched from Google straight to your Mac and kept there. We never receive it, never see it, and have no way to.

1. What the app stores, and where

Everything Merubo keeps lives on your Mac, in your own user account:

• A local copy of recent mail. Merubo keeps your recent emails on your Mac — their senders, subjects, text and attachment details — so that opening and searching mail is instant. It is a cache: deleting it is always safe.
• Attachments are not cached. They are downloaded only when you click them, straight to your Downloads folder.
• Your Google account name and profile photo, so the app can show which account you are looking at.
• Sign-in tokens, stored in the macOS Keychain, not in the app's own files.
• Your settings, in the standard macOS preferences for the app.

The cache lives inside the app's sandbox container, at ~/Library/Containers/se.clovelly.merubo/Data/Library/Application Support/Merubo/.

2. Who Merubo talks to

Merubo itself connects to Google and to nothing else — specifically gmail.googleapis.com, www.googleapis.com, accounts.google.com and Google's profile-photo servers. There is no Merubo server, no analytics service, no crash reporter and no advertising network.

There are two exceptions, both of which are things you ask for:

• Unsubscribing. If you use the unsubscribe button on a mailing-list message and confirm it, Merubo sends a single request to the unsubscribe address the sender published in that message. This goes to the sender, not to us, and only after you confirm.
• Loading images in a message. Remote images in email are hosted by the sender. Merubo blocks them by default; if you choose to load them, your Mac requests them from the sender's servers as any mail app would.

The subscription. Merubo is sold as a subscription through the Mac App Store. The purchase, the free trial and each renewal are handled by Apple through macOS's own App Store machinery, not by the app: Merubo never sees your name, payment card or billing address, sends nothing to Apple itself, and receives from macOS only a statement, signed by Apple, that a subscription is active and when it expires. It keeps that expiry date on your Mac so it can open straight to your mail. Apple's handling of purchase data is described in Apple's privacy policy.

3. Google user data

Signing in uses Google's own OAuth screen. Merubo never sees or stores your Google password. It requests exactly two permissions:

• Read, compose, and send emails from your Gmail account (gmail.modify) — to show your mail, mark it read or unread, archive, trash, mark as junk, and send the messages you write. Merubo does not permanently delete mail; trashing a thread moves it to Gmail's Trash, as it would in Gmail.
• See your personal info, including any personal info you've made publicly available (userinfo.profile) — to show your name and profile photo next to your account.

Merubo does not request any other permission, and data obtained through these permissions is used only to provide the features described above, on your device.

Limited Use disclosure

Merubo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Merubo does not transfer Google user data to any third party, does not use it for advertising, does not sell it, and does not allow humans to read it — it never leaves your Mac.

4. Translation and summaries

Merubo translates mail written in other languages and can summarise a conversation. Both run entirely on your Mac: translation uses Apple's on-device Translation framework, summaries use Apple's on-device Foundation Models. No message text is sent to us, to Apple's servers, or to any cloud service for translation or summarisation.

Google user data is never used to develop, improve or train any artificial intelligence or machine-learning model, by us or by anyone else, and it is never transferred to any third-party AI service. There is no setting that sends your mail to the cloud to be translated or summarised. We will not add cloud translation or cloud summarisation — they are not features we have yet to build, they are features we have ruled out.

5. Tracker blocking

Merubo blocks known tracking pixels and remote images before a message is displayed, using a list of tracker vendors. That list ships inside the app and is never downloaded, and no record of what was blocked is sent anywhere; the count you see in a message is computed and discarded on your Mac.

6. How your data is protected

There is no Merubo server, so there is no server-side store of anyone's mail to breach and no administrator anywhere who can read it. Protection here means protection on your own Mac, and in transit between it and Google.

• The app is sandboxed. Merubo runs under the macOS App Sandbox with the Hardened Runtime enabled. macOS grants it only the permissions it needs: the sandbox itself, outgoing network access, and read and write access to your Downloads folder. Its data sits inside its own container, where other apps cannot reach it.
• Signing in uses OAuth 2.0 with PKCE. No client secret ships in the app. Tokens are kept in the macOS Keychain, one item per account, tied to our signing team and the app's bundle identifier, so no other app can read them.
• Traffic is HTTPS to Google. Merubo's own networking is TLS to Google's servers only, under App Transport Security. The single exception is the one-click unsubscribe request described in section 2, which goes over HTTPS to the sender's own address, and only after you confirm it.
• Mail is rendered with JavaScript disabled, and known tracking pixels and remote images are blocked before a message is drawn, as described in section 5.
• At rest, the cache is protected by your macOS user account, and by FileVault if you have it turned on. Merubo does not add an encryption layer of its own, and we would rather say so than imply it does.

7. This website

merubo.app is a static site. It sets no cookies, includes no analytics, no advertising and no third-party scripts or fonts. It is hosted on Cloudflare Pages, which processes standard request information such as your IP address in order to deliver the site and protect it from abuse, under Cloudflare's privacy policy. We do not receive, store or analyse that data.

If you email us, we will have your message and your email address, and will keep it only as long as needed to answer you.

8. How long data is kept, and deleting it

Merubo keeps a recent part of your mailbox on your Mac, never the whole of it. It starts with your most recent mail and grows as you read and scroll further back. Attachments are never cached — they are downloaded to your Downloads folder when you click them. Cached translations are capped, and the oldest are discarded first.

Once a message is cached it stays until you remove the account or reset the cache. There is no automatic expiry, because the cache is on your machine rather than ours.

To remove it:

• Remove an account in the app, under Settings ▸ Accounts ▸ Remove Account. This deletes that account's mail stored on your Mac, its cached profile photo and its sign-in tokens. Remove every account and none of your mail is left on the Mac — only the app's own settings.
• Revoke Merubo's access to your Google account at any time at myaccount.google.com/permissions.

Clovelly AB retains nothing, because no Google user data ever reaches us; there is no server-side retention period to state. Because we hold nothing, there is nothing for us to delete on your behalf.

If you delete the app without removing your accounts first, macOS leaves the app's container folder behind, cached mail included. Removing your accounts in the app first is the clean route; if the app is already gone, delete ~/Library/Containers/se.clovelly.merubo/.

9. Your rights

Clovelly AB is the data controller for this policy. Under the GDPR you have rights of access, correction, erasure, restriction, objection and portability over personal data a controller holds about you. As set out above, we do not hold your mail or your Google account data — it stays on your device — so in practice these rights apply only to any correspondence you send us. Email hello@merubo.app to exercise them, or to complain. You may also complain to your national data protection authority; in Sweden this is Integritetsskyddsmyndigheten (IMY).

10. Children

Merubo is not directed at children under 13, and we do not knowingly collect information from them.

11. Changes

If this policy changes, the new version will be posted here with a new date at the top. Material changes affecting how your data is handled will also be noted in the app's release notes.

12. Contact

Clovelly AB
hello@merubo.app