What Sortmail can and can't see

This is the question worth asking of anything that connects to your email, so here is the complete answer.

What it can do

• Read a message in order to decide which category it belongs to.
• Add and remove labels on messages in your mailbox — on Gmail, labels named Sortmail/ and the category; on Outlook, categories of the same name.
• Archive a message — remove it from the inbox while leaving it in your mailbox. On Outlook that means moving it to your Archive folder.

What it cannot do

• Send mail as you. On Outlook the permission we request cannot send at all. On Gmail it could — Google has no narrower permission that can label and archive — so there it is a rule our code keeps: it calls no send, draft or trash function, and a test fails our build if anyone adds one.
• Delete or trash anything. On Gmail the permission we hold cannot delete permanently; on Outlook it could, and Sortmail never does — it only applies categories and moves messages between folders.
• Read your contacts, your calendar or your files. We ask for none of those.

What it keeps

For each message: the sender and their domain, the mailing-list identifier if there is one, a keyed hash of the subject, a handful of true or false characteristics such as whether there was an attachment, the category we chose, and why we chose it.

It does not keep the body, the attachment, or the subject in readable form. The body exists in memory for as long as classification takes, or, when you open the message in Sortmail, for as long as it takes to show it to you, and is then gone.