Privacy and security (technical)

This page covers the technical side. The legal text is in the Privacy policy.

How data flows

• Mail and calendar go directly between your device and the provider (Gmail, Google Calendar, your IMAP/SMTP server). Our server doesn’t see them.
• Sync between devices goes through our sync server (relay), but end-to-end encrypted (see below).
• AI either runs on the device or goes directly to the provider you choose and agree to (see AI).
• Agents (MCP) connect only locally on your computer (see Agents and MCP).

Apart from that, the app itself connects to only a few services: Thunderbird’s mail settings database when detecting a mailbox’s settings (only the domain is sent), Hugging Face when downloading the local AI model, and jsDelivr when downloading spell-check dictionaries.

What’s stored where

What	Where
Mail, events, tasks, settings	a local database (SQLite) in the app’s data folder, encrypted on Mac and iPhone (SQLCipher, key in the system keychain)
Mailbox passwords, tokens, AI API keys	the system keychain (Keychain on Mac and iPhone)
The sync key	the system keychain; the server holds only an encrypted backup of it
Encrypted changes and task attachments	the sync server
Web version	the web account’s data (including downloaded mail) is on our server, each account in its own database

Sync encryption

• Each batch of changes is encrypted on the device with XChaCha20-Poly1305, with a fresh random nonce for every batch.
• The sync key is created on the device and never leaves it in readable form.
• So that a new device can get the key, the server holds a backup of it encrypted with a key derived from your password (Argon2id, computed only on the device) and a second backup encrypted with your recovery code.
• Your password never goes to the server. The device derives a sign-in secret from it (PBKDF2-HMAC-SHA256, 600,000 iterations, and HKDF), and the server stores it hashed once more (Argon2id).
• Mailbox sign-in details are synced between your devices only inside this encrypted layer.

What the sync server sees

The server sees and stores: your account email, the hash of the sign-in secret, your device list, plan and invites, the encrypted batches of changes, the encrypted key backup and encrypted task attachments (each at most 25 MB; larger ones stay only on the device). For each iPhone it also keeps the Apple push address (APNs device token), so it can send the content-free “something is new” signal described in Sync and devices. The token is deleted when you sign out, remove the device or delete your account.

The server can’t see the content of tasks, settings or sign-in details (they’re encrypted). In the desktop and iPhone apps it does not receive your mail, events or AI content either. Exceptions: the web version (not yet available), where downloaded account data is stored on our server, and features you turn on yourself: e-mail notifications, in-app feedback, and storing a mail password or API key on the Letos server (explicit consent).

Signing in to your account

Your account is protected by your password. You can also turn on two-factor authentication and passkeys, both in Settings → Letos account on desktop and on iPhone. The server slows down and temporarily blocks repeated failed attempts.

Both extra steps protect signing in to the account, not the encryption of your data: the data is still derived only from your password (and the recovery code), so if you forget both the password and the recovery code, nobody can recover it.

Two-factor authentication

• Turning on: Turn on two-factor authentication and enter your account password. Scan the QR code in an authenticator app (if that doesn’t work, use Copy key and enter it by hand), enter the Code from the app and confirm with Turn on.
• Backup codes: Letos shows Backup codes. Each works only once and they are shown only now, so save them (Copy or Save to a file) and tick I have saved my backup codes. You can create new ones with Generate new backup codes; the old ones then stop working.
• Signing in: on a new device you need a code from your authenticator app, or one of the backup codes.
• Turning off: Turn off two-factor authentication, again after entering your password. The account is then protected by the password only.

Passkeys

• Adding: Add a passkey. Adding happens in your browser: the Letos page opens, where you name the key and confirm it with a fingerprint, a face or a PIN.
• Signing in: a passkey is used instead of typing a code. A passkey and a code from the app are equivalent: for the second step, one of them is enough.
• Domain: the keys are bound to the sync server’s domain; Letos shows it next to the list of keys.
• Managing: for each key you see when it was last used, and you can Remove it. The last passkey can be removed only when two-factor authentication with a code is turned on.

Logs

• The app writes a technical log, letos.log, into the system’s logs folder. Open it with Settings → Diagnostics → Open logs folder. At startup the log is cut back if it grows over 2 MB.
• Sensitive data is removed before writing: passwords, tokens and Authorization headers, paths and parameters of URLs (only the domain stays), your home folder in paths, and file names (only the extension stays).
• The log can contain e-mail addresses and message subjects. It’s never sent anywhere on its own.
• The app has no telemetry and no automatic crash reporting.

Wiping data

• Signing out on the computer and iPhone deletes from that device the tasks, mail, calendars, attachments, connected accounts and their passwords, AI API keys and the app log. It keeps appearance and layout. Nothing is deleted on the server or at your mail provider.
• Deleting your account deletes the account, devices, encrypted data and attachments on the server, signs the device out and deletes its local data too.
• Wiping on the device survives crashes: if it’s interrupted, it finishes at the next launch.

More in Sync and devices.

Consent to sending (Settings → Privacy)

Whenever data would leave the device for a third party for the first time, Letos asks with one shared dialog: where (service and address), what exactly is sent, why, and that the data leaves the device. Allow / Decline; closing it (Esc) is not a decision. A decline is permanent and you aren’t asked again.

This covers the AI providers (Claude, OpenAI, custom endpoint, Claude CLI, Codex CLI), local agents (MCP), e-mail notifications, sender logos and, in the web version, storing an API key or mail password on the Letos server. Sender logos ask with an unobtrusive banner rather than a dialog; until you allow them you see initials.

Settings → Privacy (on the iPhone at the bottom of Settings) lists every place data can leave, in three groups — content to a third party, network requests, the Letos server — with the state Allowed / Denied / Undecided / Waiting for a decision. Allowing always opens the consent; revoking applies at once (AI: optionally also deleting the API key; e-mail notifications: scheduled e-mails are cancelled; agents: the server stops).

Decisions about API AI providers, e-mail notifications and sender logos sync end-to-end encrypted to your other devices; agent and CLI consent applies to that device only.

Mail settings discovery (Mozilla’s ISPDB), model and dictionary downloads and the update check don’t ask — the feature shows a short note on where the request goes. Images in emails stay blocked until you load them.

Agents (MCP)

The local MCP server listens only on 127.0.0.1, runs only after your consent, gives every agent its own token with its own access, rejects requests from browsers and records every call in the activity log. More in Agents and MCP.