A client, not a server
Pimkin is a federating client. It connects to the mail, calendar, contacts, and tasks accounts you already have — Gmail, Microsoft 365, IMAP, CalDAV, CardDAV — and gives you one place to work with them. It is not a mail or calendar server, and it does not replace your providers.
Outbound mail is sent through your own provider, using your own credentials. Pimkin does not run a mail-sending service of its own.
What Pimkin stores
To make your accounts fast and searchable, Pimkin keeps a synced copy of your data in its managed cloud:
Metadata — message headers and previews, flags, threads, calendar events, contacts, and tasks — lives in a managed PostgreSQL database. Full message bodies, attachments, and contact photos are stored in object storage, content-addressed so identical files are never stored twice.
The credentials that let Pimkin reach your providers — your OAuth refresh tokens — are encrypted at rest with a key held only by the service. That key is never shipped inside any app you download, and the tokens are never readable from the database alone.
Who can see your data
Pimkin is operated by ganshiki, and more than one person may have an account on the service. Your data is not shared with them.
Every request is scoped to the account that made it. Other people using Pimkin cannot see your mail, calendar, contacts, or tasks, and there is no shared or cross-account view of any of it. The spam filter learns only from your own messages and is never pooled with anyone else’s.
Administrators of the service can manage accounts — send invitations, enable or disable an account, change its role, sign it out, delete it, and see aggregate counts like how many accounts exist. They cannot read your mail, calendar, or contacts: no part of the administration tooling exposes another person’s content.
Running a hosted service does mean ganshiki holds the infrastructure your synced data sits on. That access exists to operate, secure, and support the service — not to read your mail. Nobody reads your content except you, unless you explicitly ask for help with a specific problem, the law requires it, or it is genuinely necessary to investigate abuse or a security incident.
What Pimkin does not do
No ads. No profiling. Your data is never sold, rented, or mined to build a profile of you.
Message bodies and attachments are stored so Pimkin can give you full-text search across every account. They are not end-to-end encrypted — they are protected by per-account access controls and by encryption of the credentials that reach your providers. End-to-end body encryption is intentionally out of scope, because it would make search and on-device intelligence impossible.
Google data — Limited Use
Pimkin’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely: your Google data is used only to provide the features you can see in the app. It is never sold, rented, or transferred to anyone; never used for advertising or to build advertising profiles; and never used to train generalized or machine-learning models. The same commitments apply to data from every other provider you connect.
Optional AI features
Pimkin offers optional AI features — inbox triage, message summaries, and reading travel or booking details out of a confirmation email so you can add them to your calendar. Each is off by default, and each has its own switch. Nothing about your mail is sent to an AI provider unless you turn one on.
When you do enable one, the relevant message content — sender, subject, and a length-limited excerpt of the body — is sent to Anthropic’s API to produce the triage label, the summary, or the booking details, and the result is returned to you. Your passwords, OAuth tokens, and attachment files are never sent. Your data is not used to train any model. Turn the features off and the egress stops.
One further feature works differently and is worth stating plainly: you can describe a mail rule in your own words and have Pimkin draft it for you. What you type in that box is sent to Anthropic to be turned into a rule. Your messages are not — only the sentence you wrote. That box appears whenever the AI provider is configured rather than behind its own switch, so unlike the three above it is not off by default; nothing is sent unless you type in it and ask for a draft.
Where it runs, and who else is involved
Pimkin runs as a managed service on Render, with blob storage on Cloudflare R2 and DNS and TLS through Cloudflare. Connections to the service are encrypted in transit (HTTPS).
Those are the only companies that handle your data on Pimkin’s behalf, alongside the providers whose accounts you asked Pimkin to sync — and Anthropic, only if you use one of the AI features described above. There are no analytics, advertising, or tracking services anywhere in Pimkin. The backend is the only component that talks to your providers; the web and desktop apps talk only to the backend.
The desktop app keeps a local read-and-write cache on your own machine so you can work offline; your provider credentials on the desktop live in your operating system’s secure keychain, never in plain files.
Your control
You connect accounts, and you can disconnect them. Removing an account under Settings → Accounts deletes that account and everything synced from it — mail, calendar, contacts, and tasks. Removing the last account for a provider also revokes Pimkin’s access with that provider, so the grant is torn down upstream and not just locally.
Microsoft does not offer that revocation programmatically; to revoke there, remove Pimkin from your Microsoft account’s app permissions. You can always revoke Pimkin’s access directly from your Google Account permissions page, independently of anything Pimkin does.
If you don’t use Pimkin for 30 days — no sign-in, and no activity from the app on your phone or watch — Pimkin may pause syncing your accounts until you’re back. Nothing is deleted, and syncing resumes on its own the next time you sign in or open the app.
Deleting your Pimkin account removes your data from the service entirely. And because Pimkin is a client, your mail and calendars continue to live with your providers exactly as before — there is no migration and no lock-in.
Contact
Questions about how Pimkin handles your data, or a request about your account? Email support@pimkin.app.
Changes to this page
This is Pimkin’s privacy policy — written in plain language on purpose, but meant to be relied on. It will be updated as the product changes, and material changes are reflected in the “last updated” date above. The terms governing your use of Pimkin are on the Terms page.