Scratchpad Studios (“SCRATCHPAD,” “we,” “us,” or “our”) makes SCRATCHmail, an email and calendar app for Mac (the “App”), and operates the website at scratch.email (the “Site”). This Privacy Policy explains what information is involved when you use either one, and the choices you have. By using the App or the Site, you agree to this policy and to our Terms of Use.
The Short Version
- The App runs on your Mac and talks directly to Google. We operate no servers that receive, store, or process your mail, calendar, contacts, or sign-in tokens.
- The App contains no analytics, advertising, tracking, or crash-reporting code.
- We never see your Google data, so we cannot read it, sell it, share it, or use it to train anything.
- The Site uses no cookies and no analytics. Our hosting provider keeps standard server logs.
1. The App: What Stays on Your Mac
SCRATCHmail is a local application. When you connect a Google account, the App downloads your data from Google and keeps a working copy on your Mac so that it can respond instantly and work offline. That local copy is stored in the App’s data folder inside your macOS user Library and includes:
- Mail. Messages, headers, labels, read and starred state, and attachment details for the accounts you connect. Attachments you open or save are handled on your Mac.
- Calendar. Events from your Google Calendar, including attendees and your responses.
- Address book. A ranked list of names and email addresses, built on your Mac from the senders and recipients of your own mail, used to autocomplete recipients.
- Things you schedule. Reminders and snoozes, messages queued for Undo Send or Send Later, and drafts. Drafts are stored locally only and are not synced to Gmail.
- Settings. Your preferences, such as theme, text size, and connected accounts.
- Credentials. Your Google sign-in tokens, and the OAuth client ID and client secret you create during setup, are encrypted using the macOS Keychain before they are written to disk.
None of this information is sent to SCRATCHPAD. We have no copy of it and no ability to access it.
2. The App: What Is Sent Over the Network
Google. The App communicates over HTTPS with Google’s sign-in service, the Gmail API, and the Google Calendar API. These requests go directly from your Mac to Google. They are not routed through any server operated by us or by anyone else. Google handles the data in your Google account under its own terms and the Google Privacy Policy.
Images inside messages. The App removes scripts, frames, and forms from message HTML and displays it in a sandbox. Images that a sender has embedded by link are loaded from that sender’s server when you open the message, as they would be in most email apps. The sender may be able to see that the image was loaded, along with your IP address.
Links and unsubscribe. Links in a message, including the unsubscribe page opened with the Unsubscribe command, open in your default web browser and are subject to the privacy practices of the site you visit.
Nothing else. This version of the App does not contact SCRATCHPAD for any purpose. It does not send usage statistics, diagnostics, or crash reports, and it does not check in with us for updates. If a future version adds any feature that communicates with us, we will update this policy before that version is released.
3. Google Account Access
During setup you create your own OAuth client in your own Google Cloud project, and you sign in through Google’s own sign-in page in your web browser. The App never sees your Google password. It asks Google for the following permissions:
| Permission | Why the App needs it |
|---|---|
Read, compose, and modify mail (gmail.modify) | To show your mail and to archive, label, star, trash, and mark messages as you work. |
Send mail (gmail.send) | To send the messages you write. |
Basic mail settings (gmail.settings.basic) | To list your “send as” addresses so you can choose a From address. |
Calendar (calendar) | To show, create, and edit events and to send your RSVPs. |
Basic profile (openid, email, profile) | To identify each connected account by name, address, and picture. |
Limited use. SCRATCHmail’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the email and calendar features you see in the App. It is never transferred to us or to any third party, never used for advertising, and never used to develop or train artificial intelligence or machine learning models. No person at SCRATCHPAD can read it.
4. Controlling and Deleting Your Data
Because your data lives on your Mac and in your Google account, you control it directly:
- Disconnect an account. Choosing Disconnect in the App’s Preferences removes that account and deletes its cached mail from your Mac.
- Revoke access. You can withdraw the App’s access at any time from your Google Account’s third-party access page, or by deleting the OAuth client in your Google Cloud project.
- Remove everything. Deleting the App and its data folder from your Mac removes all locally stored information. This does not delete anything from your Google account.
Anyone with access to your Mac user account may be able to open the App and see your mail. We recommend protecting your Mac with a password and FileVault disk encryption.
5. The Site
Server logs. The Site is hosted by Vercel. Like most hosting providers, Vercel automatically records standard log information when you visit or download a file, which may include your IP address, browser type, the pages or files requested, the referring page, and the date and time. We use this information only to keep the Site secure and working.
Cookies and analytics. The Site does not set cookies, does not use browser storage, and does not use any analytics or advertising service.
Fonts. The Site loads its typeface from Google Fonts. When your browser requests the font, Google receives your IP address and standard browser information, as described in the Google Privacy Policy.
If you contact us. When you email us, we receive your email address and whatever you include in your message. We use it to respond to you and keep it for as long as needed to handle your request and for our records.
6. How We Share Information
We do not sell personal information, and we do not share it for advertising. The limited information described in Section 5 may be shared only with service providers that host the Site and deliver our email, when required by law or to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets. We hold no App data, so there is none for us to share.
7. Your Rights
You may contact us at any time to ask what personal information we hold about you, or to ask us to correct or delete it. For most people this will be nothing more than emails you have sent us. We will respond to verified requests within a reasonable time and as required by applicable law.
California residents. California law may give you additional rights, including the right to know what information we collect and how we use it, the right to request deletion, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.
Visitors outside the United States. The Site is operated from the United States. If you contact us or visit the Site from another country, that information will be processed in the United States, where privacy laws may differ from those where you live.
Do Not Track. We do not track anyone across websites, so there is nothing for a browser’s “Do Not Track” signal to change.
8. Children
The App and the Site are intended for a general business audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the effective date at the top. If a change affects how the App handles your Google data, we will describe it here before the change takes effect.
10. Contact Us
If you have questions about this Privacy Policy or how SCRATCHmail handles information, please contact us at info@scratchpadstudios.com.
Scratchpad Studios
Palo Alto, CA