Privacy policy — Courant

Who we are

Courant is made by Wonderlink SL, NIF B10564698, España (“we”). We are responsible for the processing described on this page. Contact: support@courant.app.

Your Google data

Courant connects to your Google accounts with Google's own sign-in (OAuth), on Google's page: we never see your password. With your permission, the app accesses:

Gmail (your messages, labels, drafts, filters, signatures and settings), to show, send, organize and search your mail;
Google Contacts, to suggest recipients and to show and edit your contacts;
Google Calendar, to show your calendars, create and change events, answer invitations and see when the people you invite are free;
your name, email address and profile picture, to show which account is which.

The app talks to Google directly from your devices, and what it reads is kept on your devices, in its own storage: a copy of your recent conversations so it works fast and offline, a search index, your contacts and events. The system's search (Spotlight), widgets and notifications show some of it on the device. Your sign-in tokens are kept in your Keychain, shared between your own devices through iCloud Keychain if you use it.

Your Google data leaves your devices only in the cases described on this page, each for a feature you use: your own iCloud, the AI service you choose if you connect one, our notification and scheduled sending relays if you turn them on, and the requests for senders' pictures and remote images. It is never sold, never used for advertising, and never used by us to train any artificial intelligence model. Removing an account, or deleting the app, removes these copies from the device.

Courant's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

iCloud

Unless you turn it off in Settings, Courant keeps your devices in step through your own iCloud account, in the app's private space there, which we cannot access: your settings, signatures, templates, reply rules, VIPs, saved searches, categories and the corrections you make to them (with the subject, sender and preview of the emails concerned), the categories of your conversations and their one-line summaries, snoozed conversations (with their subject and sender), the names, colours and pictures of your accounts, and your themes and their pictures. Your emails themselves are not copied there: they stay in Gmail. Apple keeps this data encrypted, under its own privacy policy.

Intelligence

The intelligence features (summaries, suggested and prepared replies, writing help, AI search, questions about your mail, Decisions, events created from an email) use the model you choose in Settings:

Apple Intelligence, the default where your device has it, runs on your device: nothing leaves it.
An AI service you connect with your own key: Mistral, Anthropic, OpenAI or another service compatible with OpenAI's interface (such as Scaleway or OVHcloud), or a model running on your own computer or network (such as Ollama or LM Studio). For each request, your device sends that service directly what the feature needs: the conversation or the excerpts of the emails concerned, your instruction or your draft, the question or the search you typed (a search written as a sentence is read by the model), and, so that it writes in your name, your name, your email address and your usual greetings and sign-off. Decisions sends the conversation shown on each card. The summaries of the whole list and the replies prepared in the background go to the service only if you turn on their option. Nothing goes through us. That service processes the data under its own terms, which we encourage you to read. Your key is kept in your Keychain, synced through iCloud Keychain.

The categories, the sorting of attachments, the descriptions of mailing lists and the checks before sending never use an AI service: they run on your device. Your writing style is learned on your device from the emails you sent, and stays there. Translation uses Apple's translation on your device. Listen (your emails read aloud, voice commands and dictated replies) runs on your device, except that for a language your device can't recognise by itself, your voice is sent to Apple's speech recognition.

Instant notifications on iPhone (optional)

If you turn them on for an account, our notification relay (hosted on Google Cloud, in the European Union) receives from Gmail the signal that the mailbox changed. To see what changed, it keeps that account's sign-in token, encrypted. That token gives access to the mailbox, but the relay only uses it to read the identifiers and labels of the new messages — never their content or subject — and the sender's address only when your notification setting lets just your VIPs through. The relay also keeps the account's address, your iPhones' notification identifiers, your notification setting, your VIPs' addresses, the account's name if you show it in notifications, and the identifiers of the last messages notified (so that none is notified twice). It then sends your iPhone, through Apple's notification service, a notification carrying the account's address, the identifiers of the message and its conversation, and the account's name if you chose to show it — never any content: your iPhone reads the sender, subject and preview itself to write the notification. Turning the option off on your iPhones deletes this data from the relay; removing the account from Courant revokes the token at Google, and the relay then forgets the account within a day.

Scheduled sending (optional)

Gmail can't send an email later by itself. If you turn on sending by our server for an account (Settings › General), the emails you schedule are sent by our relay, even when your devices are off. For this you give a separate Google permission that only allows sending — the relay checks that it can't read your mail — and the relay keeps it, encrypted. Each scheduled email is uploaded as Courant wrote it, attachments included, with what the app's list shows (recipients, subject, a short preview): all of it encrypted, and its content deleted as soon as the email is sent or cancelled. The rest — the account's address, the sending time and time zone, the state of each email and, after a failure, its reason — is deleted 7 days after sending, 30 days after a failure, and at the latest 31 days after the sending time. Turning the option off deletes the emails waiting and the permission.

Inside the app

Courant has no account and contains no analytics, advertising or tracking code.

Senders' pictures. To show a sender's photo, the app asks Gravatar for the picture matching a one-way hash of the sender's address (yours too, for your own messages), and asks Google for the small icon of the sender's domain (except for webmail domains such as gmail.com). Your iPhone does the same for the picture of a notification.
Remote images in emails load as you choose in Settings: by default every image except known tracking pixels, which are removed first. They come straight from the sender's servers, without cookies; loading an image tells its server that the email was opened, as in any mail app.
Unsubscribing. When you ask for it, the app sends the request the sender offers: a web request to its address, or an email from your account.
Your device's contacts and calendars, if you allow access, are used on the device to suggest recipients and show your events; they are not sent anywhere.
Apple Watch. Your iPhone sends your watch your recent conversations and, so that it can reach Gmail on its own, your accounts' sign-in tokens, which the watch keeps in its own Keychain.
Handoff. The conversation or draft you have open can be picked up on your other devices, through Apple's Handoff.
AI apps on your Mac (off by default). If you turn on Courant's MCP server, the AI apps on your Mac that you connect to it can search and read your mail and prepare drafts, each of which you approve; it only accepts connections from your own Mac. What such an app does with your mail is governed by its own terms.
Update check (website edition). Once a day, Courant downloads a small file from courant.app to see whether a new version exists. The request carries the app's version number and where the Mac is in its trial (its day, trial over, or licensed); it contains no personal data and, like any web request, shows your IP address to our host. We count these checks day by day, by version and trial state, without anything that could identify you or the Mac.
App Store edition. Apple handles the download and the purchase; Apple's privacy policy applies to them, and Apple doesn't tell us who bought. Your purchase also unlocks the website edition on your Macs: the proof of purchase, signed by Apple, reaches them through your iCloud, without going through us.

This website

We don't use cookies, analytics tools or advertising on courant.app, with one exception: the purchase page loads the checkout of Paddle, our reseller, which may set its own cookies and collect technical data to process the payment and prevent fraud; Paddle's privacy policy applies to them. (Before the launch, a cookie also opens the preview pages to the people we give access to.) Elsewhere, your browser only keeps a few preferences on your device, such as the language you chose. We count, day by day, how many times the app is downloaded, from which country and on which system, keeping nothing that could tell who downloaded it (the IP address is not kept, and robots are counted apart). To know what brings visitors, we also count visits, downloads and purchases by where they came from: the label of a link we published (such as ?ref=), or else the name of the site you came from (never the page or what you searched for). On the purchase page, we count how far the checkout goes, without your email address or anything that could tell who you are. If a page runs into a programming error, your browser sends us the error message, where it happened in our code, the page's path and the browser's name and version. The site is hosted by Cloudflare, which processes technical data (such as IP address and browser type) to deliver pages and protect them against abuse.

Purchases

Website purchases are processed by Paddle.com, our reseller and Merchant of Record. Paddle collects what is needed for payment, taxes and fraud prevention (such as your name, email address, country and payment details) under its own privacy policy, and shares with us your name, email address, country and the details of your transaction so that we can deliver your license.

Your license

To deliver your license and let you recover it, we keep your email address, your name if you gave it, your license keys, the transaction ID, your language and the purchase date. A license works on 3 Macs at a time: when you activate it on a Mac, then once a day when that Mac is online, Courant sends courant.app your key, an identifier of this Mac derived from its hardware number (which can't be turned back into it), its name, model and the macOS and app versions. For each activated Mac, we keep these details, the country it connects from (without keeping the IP address) and the dates of its activation and last check: this lets us limit the license, and lets you see your Macs and free one.

The app also keeps your key in your iCloud, so that Courant for iPhone and the App Store edition are unlocked too on the devices signed in to your Apple Account. They check the key on the device and, now and then, ask courant.app whether it is still valid (it isn't after a refund): that request carries only the key, and is not recorded with your license. Nothing about your mail is ever sent.

License emails go through our email delivery provider. We keep this information as long as you might need to recover your key, and as long as tax and accounting rules require. You can ask us to delete it at any time; we'll keep only what the law requires.

Support

When you write to us, we use your message and email address to answer you, and keep the conversation as long as it is useful to help you. To prepare our answers, we may pass your message to an artificial intelligence service (Anthropic), which doesn't use it to train its models; every answer is read and sent by a person. Please never send us your Google password or the content of private emails you don't want us to read.

Legal bases

We process data to perform our contract with you (the app's features, including the ones you turn on, delivering and recovering your license, support), to meet legal obligations (accounting and taxes), and in our legitimate interest in keeping the website and our relays secure.

Service providers

Paddle (payments), Cloudflare (website hosting, storage of licenses and support messages), Google Cloud (notification and scheduled sending relays, in the European Union), Apple (push notifications, iCloud), our email delivery provider and Anthropic (help drafting support answers) process data on our behalf or as independent controllers. The AI service you choose, Gravatar and Google (domain icons) receive data directly from your device, under their own terms. Some of them may process data outside the European Economic Area, under appropriate safeguards such as the European Commission's standard contractual clauses.

Your rights

Under the GDPR you can access, correct, delete or export your data, and object to or restrict its processing. Write to support@courant.app. You can revoke Courant's access to your Google account at any time from your Google Account's security settings. You can also lodge a complaint with a data protection authority — in Spain, the Agencia Española de Protección de Datos (aepd.es).

Changes

If our practices change, we will update this page and the date above.