Privacy statement

MailVault for macOS · 26 September 2026

Who is responsible
Where your data lives
Signing in to Microsoft 365 and Outlook.com
What the software connects to
This website
Signing up for news
Measurement with Google Analytics
Your rights
Changes

1. Who is responsible

MarketVision AG
Hagenholzstrasse 84
8050 Zurich, Switzerland
Company number CHE-141.149.077
info@marketvision.ch

2. Where your data lives

MailVault is a program that runs entirely on your own Mac. Your email travels directly between your mail server and your Mac, into an archive folder you choose. That data never reaches us. We have no access to your archive, your mailboxes, your credentials or your keys.

The software connects to us for two things only, each described in section 4: a count of installations, which you can switch off, and the licence, if you sign in for one. The trial needs no account; it is counted on your Mac. The software sends no crash reports, and it does not check for updates on its own.

For mailboxes at Microsoft 365 and Outlook.com, MailVault signs in with OAuth 2.0, because Microsoft no longer accepts an ordinary password for IMAP. It works like this:

The sign-in form is shown by Microsoft, not by MailVault. Your password is typed there and nowhere else, and the software never knows it.
The permission is exchanged for an access token directly between your Mac and Microsoft, using PKCE, with no server of ours involved.
The permissions requested are IMAP.AccessAsUser.All, offline_access, openid and email.
Microsoft's consent screen describes the first of these as read and write access to your mail. That is accurate and deserves an explanation: Microsoft offers no read-only permission for IMAP. IMAP.AccessAsUser.All is the only one, and it includes writing. The permission granted is therefore wider than what the software uses.
MailVault does not use the writing half. Mailboxes are opened with EXAMINE and read with BODY.PEEK. The IMAP client refuses STORE, APPEND, EXPUNGE, COPY, MOVE, DELETE, RENAME and SELECT before a byte leaves the machine, unless the connection was deliberately opened for writing. That happens only when you restore a message and on the destination side of a migration you start yourself.
The access and refresh tokens are kept in your Mac's keychain, under the entry oauth.mailvault. They are not stored in the archive and are not sent to us.

You can withdraw the permission at any time: in your Microsoft account, or by removing the account in MailVault, which deletes the stored tokens.

Gmail and Google Workspace are collected, in the current version, with an app password that Google issues for a single program. It is kept in your Mac's keychain like any mailbox password and sent only to the mail server it belongs to.

Mailboxes are opened read-only. Nothing is marked as read, no flag is changed and nothing is deleted.

4. What the software connects to

Apart from your own mail server and, for Microsoft, its sign-in service, MailVault makes only the following connections:

Count of installations: On by default; switched off under Settings ▸ Internet ▸ Counting use. At launch and once a day after that, MailVault reports to api.apps.marketvision.ch, a server run by MarketVision AG: a random identifier made once on your Mac and kept in the app's preferences, the versions of MailVault and of macOS, the country set in macOS and the Mac's first language. Nothing about your mail: no addresses, no mailbox or server names, no counts. Neither an account nor your network address is stored with the count, even when you are signed in. One entry is kept per installation and day, and deleted after a little over a year. With the count switched off, MailVault sends nothing for it. The legal basis is our legitimate interest in knowing how many installations there are and which versions and languages are in use (Art. 31(1) FADP, Art. 6(1)(f) GDPR).
Licence: Only if you sign in under Settings ▸ Licence, for instance to use a licence you bought. You sign in with a code sent to you by email; no password is asked for. For this, your email address and the name of your Mac are sent, so you can tell your sign-ins apart later. The sign-in token is kept in the keychain. While you are signed in, MailVault asks for the licence at most once a day, sending the token and a second random identifier for this installation, which is kept in the keychain and is not linked to the count. Signing out removes the token and the licence from your Mac. The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR). We delete your account on an informal request to info@marketvision.ch.
Time-stamping authority (RFC 3161): On by default, so that the time of storage does not rest on your Mac's clock alone. When sealing the audit chain, MailVault asks a time-stamping authority for a time-stamp: first SwissSign in Switzerland (tsa.swisssign.net); if it cannot be reached, DigiCert in the USA (timestamp.digicert.com, over unencrypted HTTP, which is how DigiCert offers the service), and then FreeTSA (freetsa.org). Only a hash value of the audit chain and a random number are sent, never content, addresses or subject lines; as with any connection, the authority sees the network address the request comes from. Each archive can name a different authority or switch time-stamping off, on the command line with mailvault policy <archive> --timestamp-authority <address> or none.
Sender pictures: Off by default. If you switch them on, a third party is asked for a picture: Gravatar receives a hash of the sender's address, and BIMI fetches the logo from the sender's domain, which tells the sender the message was opened. Switch this on only if your organisation permits it.

The thirty-day trial is counted on your Mac and needs no connection.

Remote content in HTML messages is not loaded by default, neither in the software nor in the exported viewer; a remote image would tell the sender that and when an archived message was read. This can be changed under Settings ▸ Internet. For an archive kept under the GDPR or SEC 17a-4, such permission has to be granted by name in the archive itself. Opening links is off by default too, in messages as in PDF and Markdown attachments: a click on a link then connects to nothing. Switched on under Settings ▸ Internet ▸ Open links in messages, a link opens in your default browser, never inside MailVault.

5. This website

Fonts, images, stylesheets and scripts are served from the same host. Without your consent this website sets no cookies and loads nothing from third parties. If you accept measurement, Google Tag Manager is added; what it collects is set out in section 7.

As with any web server, technical access data is logged when a page is requested: IP address, time, the address requested, status code, bytes transferred, referrer and user agent. These logs serve the operation and defence of the service. The legal basis is our legitimate interest in secure operation (Art. 31 Swiss FADP, Art. 6(1)(f) GDPR). They are deleted after 90 days and are not combined with other data.

If you write to us, we use what you send only to answer you and to perform any contract that follows.

On the home page you can leave your email address to be told when there is a new version of MailVault, or when something changes in the regimes the software is built around.

What is stored: the email address, the time of the signup, the language of the page it was made from, the wording of the consent you were shown, and your IP address in truncated form, with the last field set to zero. The truncated address serves only to show that the signup took place.

The legal basis is your consent (Art. 6(1)(a) GDPR; for Switzerland Art. 3(1)(o) UCA). You can withdraw it at any time, with a short note to info@marketvision.ch or through the unsubscribe note in any message. The address is deleted once you do.

The list sits on the same server as this website. It is not passed on, not sold and not used for anyone else’s advertising. The web server itself sends no email; when a message does go out, it leaves from MarketVision AG’s own mail system.

7. Measurement with Google Analytics

If you accept in the banner, we load Google Tag Manager and, through it, Google Analytics 4. Without your consent none of that happens: no script is loaded from Google, no cookie is set and nothing is transmitted. The site works fully without it.

Once you have accepted, the following is collected: the pages you open and how long you stay, your approximate location at city or country level, device type, operating system, browser and screen size, where the visit came from, and events such as a click on the download. Google Analytics sets cookies lasting up to two years for this and assigns a randomly generated identifier. We transmit neither your name nor your email address.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework; beyond that we rely on the European Commission’s standard contractual clauses.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG; for Switzerland Art. 45c(b) TCA and Art. 31(1) FADP). You can withdraw it at any time, through Change measurement at the foot of every page. Your decision is kept locally in your browser, not with us.

The figures serve one question: which parts of this site get read. They are not combined with the list described in section 6. MailVault itself contains no measurement: the software reports no usage back to us, whatever you decide here.

8. Your rights

Under the Swiss Federal Act on Data Protection and, where it applies, the GDPR, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing. Write to info@marketvision.ch.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority responsible for you.

Because we neither receive nor process the content archived with MailVault, we cannot give you access to it. It sits with you alone.

9. Changes

We revise this statement when the software or the legal requirements change. The version published here, bearing the date above, is the one that applies.