A Gmail client that never sees your mail

A private email client is a claim you should be able to check. This page is the architecture behind Hark’s version of the claim — your mail never touches our servers — in enough detail to do that, including the small set of things that do reach us, the third parties a message can touch, and the settings that decide each one.

The shape of it

Two parties: your Mac and Google. Hark runs on the first and talks to the second through Google’s Gmail, Calendar, Tasks and People APIs, over TLS, from your machine. There is no third party in that path. We do not operate a server that syncs, relays, indexes, backs up or “speeds up” your mail, so there is no copy of it in our infrastructure to be breached, subpoenaed or leaked.

This is not a policy choice that could be quietly reversed in a later version; it is how the app is built. The sync engine lives in the app, and putting a server in the path would mean rebuilding it around one.

Where your data lives, exactly

• Your Google tokens: in the macOS Keychain. The credentials that let Hark act on your account are stored as Keychain items, encrypted and access-controlled by macOS. They are never written into Hark’s own files.
• Your cache: in Application Support, readable by you only. Messages, events and tasks are kept in a local database under ~/Library/Application Support/Hark, one folder per account, with file permissions that allow only your user to read it. Downloaded attachments are cached under ~/Library/Caches/Hark; cached remote images, sender photos and logos under ~/Library/Caches/hark-url-cache, ~/Library/Caches/hark-image-cacheand in the app’s WebKit store, all inside your own Library folder. FileVault encrypts all of it at rest. Hark adds no encryption layer of its own on top — that is stated plainly so you can decide whether FileVault matters to you.
• Your settings: in a preferences file. Window positions, view choices and the like are in the ordinary macOS preferences file for the app, along with your recent search queries (the last 25) and the ids of conversations you have muted. No message content goes in it.
• On sign-out: revoked, deleted, purged. Hark revokes its grant at Google, deletes the Keychain items, and removes that account’s cache from disk.

What does reach us, and when

In ordinary use — reading, writing, organising, looking at your week — nothing about your mail. Four things involve a server of ours, and each has a trigger you control:

• Checking for updates. Once you have allowed automatic checks (Hark asks on its second launch), it fetches a small update-feed file from updates.harkmail.app about once a day (hourly on beta builds), and downloads a new build from there when you accept one. That server sees what any download sees: your IP address, the time and the app version. Hark sends it no profile of your Mac and nothing about your account.
• A bug report you send. Help › Report a Bug sends what you typed, whether you marked it a bug or a request, which area you picked, any images you attach yourself, the name-or-email field (pre-filled with your signed-in address and editable — clear it to send the report anonymously), and facts about the app and machine — app version, build and commit, macOS version, hardware model, CPU core count, memory size, free disk space, locale, time zone, thermal state, low-power mode, hours since boot, the time you sent it, how many accounts are connected (a count) and a random per-install id — to logs.harkmail.app. It never sends message content, subjects, anyone else’s address, tokens or logs. The images are the part to think about: a screenshot of your inbox is your inbox.
• Crash reports, only if you turn them on. Off by default. With the switch on in Settings, a crash sends the stack trace, the exception type, signal and termination reason, which thread crashed, when it happened and macOS’s id for that crash, the app version, build and commit, and the macOS version and hardware model. No field in that report can carry mail.
• Attaching a Google Drive file. Google’s file picker is a web component, so choosing a Drive file opens a page on harkmail.appin your browser. Our host sees the same things any website sees — your IP, the time, a one-time id — and not your address, your files or which one you picked. The picker’s Google credential is created in your browser and can only ever grant access to files you pick yourself.

One more, later: a billing account, if you subscribe once the beta ends. It is a separate identity from your Google account — an email address of your choosing, or a Google sign-in through a client that has no access to Gmail — and the full list of what it stores is in the privacy policy.

The third parties a message can touch

Email is not a closed system, and a client that showed you nothing from outside Google would be showing you a lot of broken messages. These are the outside connections a message can cause, and the setting that governs each:

• Remote images in a message. Newsletters and receipts pull their pictures from the sender’s servers. With the default, Always display external images, Hark loads them directly, which tells that server your IP address and that the message was opened. Choose Ask before displaying external images in Settings › General and nothing is fetched until you click.
• Sender logos and avatars. A person’s photo comes from Google, through the same connection as your mail. A company’s logo may come from the brand’s own published record (a lookup of the sender’s domain through Google’s DNS service, then the logo file from the brand’s server) or from Google’s favicon service. Both follow the same External images setting: set it to Ask and neither lookup happens.
• Gravatar, only if you turn it on. Off by default. On, Hark sends a hash of each contact’s address to gravatar.com to look for a picture, which exposes who you correspond with to that service. The setting says so next to the switch.

How to check it yourself

You do not have to take this page’s word for it. An outbound firewall on your Mac shows every host an app talks to. With Hark in ordinary use you should see accounts.google.comduring sign-in and Google’s API hosts (googleapis.comand its subdomains) for mail, calendar, tasks and contacts, and Google’s image host (in practice lh3.googleusercontent.com) for contact photos. You should see updates.harkmail.app when it checks for updates, and logs.harkmail.apponly when you send a report (or, if you switched crash reports on, after a crash). With External images set to Ask, you should see no sender’s server until you ask for the pictures. If you ever see something else, we want to know: support@souplin.com.

Hark asks Google for the narrowest permission that implements each feature — for example, it does not request the permission that would allow it to delete mail permanently, so the app can only ever move a message to Trash — and its use of Google data is bound by Google’s Limited Use policy. The permissions, and what each is for, are listed on the help page.

Questions