- Fastmail keeps your mail. The app talks to it directly.
- The phone keeps a local copy for the inbox, in the app’s own storage. It goes when the app does.
- Your Opensolr Index, only with an Opensolr account connected, holds the text of your messages and of their attachments, for search. To make search by meaning, that text passes through Opensolr’s own AI service on api.opensolr.com. Attachments are read there too: the app hands api.opensolr.com a one-time link to each attachment, the server fetches it straight from Fastmail, reads its text into your index and does not keep the file. Moving every result of a search at once works the same way: your Fastmail sign-in is handed to the server for that one request and is not stored.
- Contacts: your Fastmail address books are read from Fastmail and kept on the phone; the phone’s own contacts are read only when you allow it, and never leave the phone.
- Gravatar: for a person with no picture of their own, the app asks Gravatar for one by a one-way SHA-256 hash of the address, never the address itself. Gravatar’s answer, or that there is none, is kept on the phone for a week.
- No ads, no analytics, no tracking, no crash reporting.
01 · How it is protected
- Passwords and two-factor codes are only typed in your browser, on Fastmail’s and Opensolr’s own pages.
- Sign-ins are stored encrypted with a key held by Android’s secure key store, and never included in phone backups.
- Push messages are encrypted by Fastmail with a key that never leaves your phone.
- Every connection is HTTPS.
Found a security problem? Write to support@opensolr.com.