Privacy Policy

Effective October 21, 2026 · Version 1.2

1. Overview

This Privacy Policy explains how buxjr (“Developer,” “we,” “us,” or “our”) handles information in connection with the Melia Email Client (“Software”).

Short version: Your email and personal data stay on your device. We do not collect, store, or sell your data.

2. Information We Do Not Collect

The Software is designed to operate locally and does not collect or transmit the following to the Developer:

  • Email content (messages, attachments, metadata)
  • Contacts or address books
  • Email account credentials (passwords or OAuth tokens)
  • Usage analytics or behavioral telemetry
  • Crash reports or diagnostic data
  • Device activity or interaction tracking

The one exception is your choice: Settings → Support → Report a problem opens an email to the Developer with diagnostic reports attached. Nothing is sent unless you send that email yourself, and you can open and read every attachment first.

We do not operate servers that store or process your email data.

3. Where Your Data Lives

All user data is stored locally on your device, including:

  • Emails and attachments (SQLite database at ~/.config/melia/)
  • Application settings and preferences
  • Account configuration and contacts

Credentials are encrypted with a key held in your operating system’s secure keyring (Electron’s safeStorage is used only where no keyring is available). They are never written in plaintext or stored in the application database.

The Developer does not have access to this data.

4. Network Connections

The Software may make outbound network connections as part of normal operation. You can verify these at any time using Melia’s built-in Connection Monitor or external tools like ss, netstat, or Wireshark.

4.1 Email Providers

Connections to your configured IMAP and SMTP servers to send, receive, and synchronize your email. These are the servers you choose when adding an account.

4.2 OAuth Providers

When you choose to use OAuth login (e.g., for Microsoft accounts), authentication is handled via your default browser. Melia receives only the resulting token, which is stored in your OS keyring.

4.3 Licensing Service

Every installation, free or licensed, asks the Developer’s licensing service (locksmith.buxjr.com) whether an update is available, when the Software starts and every 48 hours while it runs. This request includes only the product identifier and the installed version.

Licensed installations also activate, and check in roughly every 14 days. These requests include only:

  • Product identifier
  • License key
  • Machine identifier (/etc/machine-id, or where that file cannot be read, a one-way hash of the hostname and user name)
  • Device hostname (used to label machines in your activation list)

If you ask the Software to resend your license key, the email address you enter is sent so the key can be emailed to you.

None of these requests include email content, credentials, hardware serial numbers, or usage data. For full details, see Licensing Transparency.

4.4 DNS Lookups

Melia performs outbound DNS lookups to verify email authentication (SPF, DKIM, DMARC), and to discover server settings when you add an account. These are standard DNS queries made from your machine to your configured DNS resolver. Melia does not operate its own DNS service.

4.5 Remote Content (Optional)

When remote images in an email load, external servers may receive your IP address. Remote images load by default; the Software lets you block all remote images and provides per-sender trust controls. Tracking pixels are detected and neutralized by default, regardless of the remote image setting.

4.6 Address Book Servers

If you connect an address book (CardDAV), Melia connects to the server you configure to sync your contacts.

4.7 Downloading Updates

When you choose to install an update, the package is downloaded from GitHub (github.com/buxjr311/melia-app). Snap and Flatpak installations are updated by their own package managers instead.

4.8 Spell-Check Dictionaries

The spell checker built into the Chromium engine downloads the dictionary for each spelling language that is switched on from Google’s servers, including your system language on first launch. Only the dictionary file is requested; nothing you type is sent. Each download appears in the Connection Monitor.

4.9 Features You Turn On or Use

  • Sender logos (off by default): a brand’s certified logo is downloaded from the certificate it publishes (BIMI), and the Contacts window can fetch a contact’s company logo from that company’s own website. No third-party icon service is used.
  • Link previews in compose (off by default): the page you link to is fetched to build the preview card.
  • Unsubscribe: when you click Unsubscribe, Melia contacts the address the sender published for it.

5. No Telemetry or Tracking

The Software:

  • Does not track user behavior
  • Does not collect analytics
  • Does not include third-party tracking libraries
  • Does not send usage data to the Developer

There is no telemetry code in Melia because none was ever written. No analytics SDK, no usage reporting, no crash reporting that phones home. The absence is structural, not a setting we promise to leave off. See our Privacy Architecture page for verification methods.

6. No Advertising or Data Selling

We do not:

  • Sell user data
  • Share data with advertisers
  • Use tracking pixels or ad networks
  • Monetize personal information in any way

7. Third-Party Services

The Software interacts with third-party services you configure, such as email providers (Gmail, Outlook, Fastmail, etc.) and OAuth providers (Microsoft). Those services operate under their own privacy policies. The Developer is not responsible for their data practices.

Melia connects to these services using standard protocols (IMAP, SMTP, OAuth2) and does not relay your data through any intermediary.

8. Data Security

Melia is designed to minimize your attack surface. Credentials are encrypted in your OS keyring. Email is stored in a local database accessible only to your user account. All IMAP and SMTP connections support TLS/SSL encryption. There are no cloud components and no shared servers, and your email only ever goes to the servers you configure.

Because your data lives entirely on your device, its physical security depends on your environment. We recommend standard practices: keeping your OS updated, using full-disk encryption, and maintaining regular backups of ~/.config/melia/.

9. Children’s Privacy

The Software is not directed to children under 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

If this Privacy Policy changes, the updated version will be published at this URL with a revised effective date. If future versions of the Software introduce any form of data collection, this Policy will be updated accordingly and the changes will be clearly noted.

11. Contact

If you have questions about this Privacy Policy:

buxjr
Email: melia@buxjr.com
Website: melia.buxjr.com

12. Summary

  • Your email stays on your device
  • We do not collect or track your activity
  • We do not sell or share your data
  • You control what gets transmitted

That’s the entire point of Melia.