SiftPrivacy
Sift stores your mailbox on your Mac and collects no telemetry. Mail goes directly to Google; optional update checks go to GitHub.
What leaves your Mac
Mail traffic goes only to Google, directly over TLS — the requests needed to read, sync and send your mail. Two other network paths exist, and neither is hidden:
- Remote images. Sift does not load an image a sender hosts on their own server by default: the account's remote-content policy decides, and a new installation starts at
ask, which fetches nothing on its own.blocknever fetches anything external. - Update checks. Sift asks GitHub for the newest release manifest when it launches, so it can tell you a newer version exists. Settings → Updates turns the automatic check off, and the check by itself never downloads or installs anything.
There is no Sift backend, no analytics endpoint, no crash reporter, and no ads.
What stays on your Mac
- A local SQLite database with your mailbox, search index, attachments, and drafts.
- Your Gmail app password or OAuth refresh token, stored in the macOS Keychain.
- Logs and diagnostics, which are written locally and never uploaded.
Remote images
An image a sender hosts on their own server is not fetched by default. A new installation keeps the account's remote-content policy at ask, so nothing external loads on its own; block never loads external content, and allow loads the HTTPS images a message needs without asking. Fetching a remote image would tell its sender that you opened the message, which is why it is not the default here.
Credentials
Sift authenticates with an app password or an OAuth refresh token. Tokens are held in the Keychain and only ever sent to Google. The local database never stores them.
Deleting your data
Removing an account deletes its Keychain entry and every row associated with it in the local database. Uninstalling the app and deleting its application support folder removes everything else.
Reading the code
You do not have to take this page’s word for any of it. Sift is open source under the MIT License: the repository holds the sync engine, the HTML sanitizer, the local schema and the release pipeline that builds the DMG, so every claim above can be checked against the code that runs it.
Questions
Open an issue on GitHub if anything here is unclear.