Every app calls itself privacy-first, so the phrase tells you nothing on its own. What you actually want to know is what the software can reach, what it sends, and who can see it. This post lays out the specific, checkable facts about mailin: the App Store privacy label, the absence of any email-server code, the one thing that uses the network by default, and exactly what the optional Cloud AI mode sends if you turn it on.
The App Store privacy label
mailin's App Store privacy label reads: "The developer does not collect any data from this app." That is the whole label. There is no analytics, no telemetry, no tracking, and no third-party SDKs bundled into the app. The developer, EcoSanskriti Innovation Pvt Ltd, has no channel through which to learn who uses mailin or what they do with it.
The label is backed by how the app is built. It runs inside the Apple App Sandbox with minimal permissions. mailin can only access files you explicitly select or drag in. It does not scan your disk, and it cannot read your Mail folders unless you point it at them.
No account, and no way to reach a mail server
There is no sign-up, no login, and nothing to reset. You open the app and drop an export in. The Free tier does not even ask for payment information.
More unusual is what is missing from the code. The shipped app contains no IMAP, SMTP or Gmail API code at all. mailin cannot connect to your mailbox, and live mail will never be added; that is a deliberate product decision, not a roadmap gap. The app works only on files you already have: .mbox from Google Takeout, .pst and .ost from Outlook, .nsf from Notes, and .eml, .emlx and .msg messages. The Gmail Takeout guide shows how to get such an export in the first place.
Because nothing is fetched, mailin works fully offline. You can import, index, search and analyze an archive with networking disabled, and the app behaves identically.
What can touch the network
Exactly two things in mailin are capable of using a connection. The first is App Store purchase verification through StoreKit, which is how Apple confirms a subscription or lifetime purchase and lets Restore Purchases work across your devices. That exchange is with Apple, not with the developer, and it is the only network use in the default configuration.
The second is the optional Cloud AI mode, which is off until you turn it on. Everything else, including full-text indexing, analytics, the AI Assistant, sentiment, entity extraction and Thread Story, runs on the device by default with no connection.
What Cloud AI mode actually sends
By default mailin's AI runs on two on-device engines: Apple Intelligence, which handles summaries, questions and reasoning on macOS 26 and iOS 26 or later, and Apple NaturalLanguage, which handles sentiment, language detection and named-entity recognition on every supported device. If Apple Intelligence is not available on your hardware or OS version, NaturalLanguage takes over. Neither needs an API key, and neither sends anything anywhere.
Cloud AI mode exists for people who want a larger model for a specific task and are willing to send text to a provider to get it. It is opt-in, off by default, and clearly disclosed in the app. It uses your own OpenAI or Anthropic API key, so the relationship is between you and that provider. Only the excerpts you choose are sent, never the whole archive, and nothing is ever sent to the developer. Each feature that can use cloud AI requires its own explicit consent, so enabling it for one task does not enable it for everything.
Every AI output, on-device or cloud, carries an AIProvenance tag naming the engine that produced it, so you can always tell which path a result took. And regardless of engine, AI features can produce inaccurate or incomplete results; verify anything important against the underlying emails. The on-device AI post describes the fallback chain in more detail.
Protecting the archive on the device itself
Keeping data off the network is half the job; the other half is the machine it lives on. mailin offers encrypted storage using AES-256 for sensitive archives and a biometric lock with Touch ID or Face ID. iCloud sync, if you enable it, carries settings only, through Apple's iCloud and no third-party server; your emails are never synced. Each device holds its own archive.
Your data lives at ~/Library/Application Support/com.ecosanskriti.mailin/, and you can clear it at any time from Settings, which permanently deletes it from the device. Sensitive archives of the kind journalists and investigators handle are the reason these controls exist; the journalism post shows them in use.
Why this is a product decision, not a setting
An app that can reach a mail server can be made to, by a user, by a bug, or by a third party. An app that has no such code cannot. The same logic applies to analytics: a developer who collects nothing has nothing to leak, sell or be compelled to hand over. mailin gives up live mail and cloud sync of archives to get that property, and the trade is visible in the design rather than buried in a policy. The design is what backs up the privacy policy, not the other way around.
FAQ
Does mailin need an internet connection to work?
No. Import, search, analytics and on-device AI all work fully offline. The only default network use is App Store purchase verification through StoreKit.
Does iCloud sync copy my emails between devices?
No. iCloud sync carries settings only. Each Mac, iPhone or iPad keeps its own archive, and nothing about your emails goes through iCloud or any other server.
Can I use the AI features without any cloud service at all?
Yes. Apple NaturalLanguage runs on every supported device, and Apple Intelligence runs on macOS 26 or iOS 26 and later with supported hardware. Cloud AI mode is optional, off by default, and requires your own API key.