A client, not a server
Pimkin is a federating client. It connects to the mail, calendar, contacts, and tasks accounts you already have — Gmail, Microsoft 365, IMAP, CalDAV, CardDAV — and gives you one place to work with them. It is not a mail or calendar server, and it does not replace your providers.
Outbound mail is sent through your own provider, using your own credentials. Pimkin does not run a mail-sending service of its own.
What Pimkin stores
To make your accounts fast and searchable, Pimkin keeps a synced copy of your data in its managed cloud:
Metadata — message headers and previews, flags, threads, calendar events, contacts, and tasks — lives in a managed PostgreSQL database. Full message bodies, attachments, and contact photos are stored in object storage, content-addressed so identical files are never stored twice.
The credentials that let Pimkin reach your providers — your OAuth refresh tokens — are encrypted at rest with a key held only by the service. That key is never shipped inside any app you download, and the tokens are never readable from the database alone.
Who can see your data
Pimkin is operated by ganshiki, and more than one person may have an account on the service. Your data is not shared with them.
Every request is scoped to the account that made it. Other people using Pimkin cannot see your mail, calendar, contacts, or tasks, and there is no shared or cross-account view of any of it. The spam filter learns only from your own messages and is never pooled with anyone else’s.
Administrators of the service can manage accounts — send invitations, enable or disable an account, change its role, sign it out, delete it, and see aggregate counts like how many accounts exist. They cannot read your mail, calendar, or contacts: no part of the administration tooling exposes another person’s content.
Running a hosted service does mean ganshiki holds the infrastructure your synced data sits on. That access exists to operate, secure, and support the service — not to read your mail. Nobody reads your content except you, unless you explicitly ask for help with a specific problem, the law requires it, or it is genuinely necessary to investigate abuse or a security incident.
What Pimkin does not do
No ads. No profiling. Your data is never sold, rented, or mined to build a profile of you.
Message bodies and attachments are stored so Pimkin can give you full-text search across every account. They are not end-to-end encrypted — they are protected by per-account access controls and by encryption of the credentials that reach your providers. End-to-end body encryption is intentionally out of scope, because it would make search and on-device intelligence impossible.
Google data — Limited Use
Pimkin’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely: your Google data is used only to provide the features you can see in the app. It is never sold, rented, or transferred to anyone; never used for advertising or to build advertising profiles; and never used to train generalized or machine-learning models. The same commitments apply to data from every other provider you connect.
Optional AI features
Pimkin offers optional AI features — inbox triage and message summaries. They are off by default. Nothing about your mail is sent to an AI provider unless you turn them on.
When you do enable them, the relevant message content — sender, subject, and a length-limited excerpt of the body — is sent to Anthropic’s API to produce the triage label or summary, and the result is returned to you. Your passwords, OAuth tokens, and attachment files are never sent. Your data is not used to train any model. Turn the features off and the egress stops.
Where it runs, and who else is involved
Pimkin runs as a managed service on Render, with blob storage on Cloudflare R2 and DNS and TLS through Cloudflare. Connections to the service are encrypted in transit (HTTPS).
Those are the only companies that handle your data on Pimkin’s behalf, alongside the providers whose accounts you asked Pimkin to sync — and Anthropic, only if you switch the AI features on. There are no analytics, advertising, or tracking services anywhere in Pimkin. The backend is the only component that talks to your providers; the web and desktop apps talk only to the backend.
The desktop app keeps a local read-and-write cache on your own machine so you can work offline; your provider credentials on the desktop live in your operating system’s secure keychain, never in plain files.
Your control
You connect accounts, and you can disconnect them. Removing an account under Settings → Accounts deletes that account and everything synced from it — mail, calendar, contacts, and tasks. Removing the last account for a provider also revokes Pimkin’s access with that provider, so the grant is torn down upstream and not just locally.
Microsoft does not offer that revocation programmatically; to revoke there, remove Pimkin from your Microsoft account’s app permissions. You can always revoke Pimkin’s access directly from your Google Account permissions page, independently of anything Pimkin does.
Deleting your Pimkin account removes your data from the service entirely. And because Pimkin is a client, your mail and calendars continue to live with your providers exactly as before — there is no migration and no lock-in.
Contact
Questions about how Pimkin handles your data, or a request about your account? Email support@pimkin.app.
Changes to this page
This is Pimkin’s privacy policy — written in plain language on purpose, but meant to be relied on. It will be updated as the product changes, and material changes are reflected in the “last updated” date above. The terms governing your use of Pimkin are on the Terms page.