Privacy Policy

Effective date: 17 July 2026 · Castellum

Castellum ("the app", "we", "us") is a native desktop email client provided by Joan Marc Riera (sole trader), trading via riera.co.uk ("the provider"). This policy explains what data Castellum handles, where it is stored, and — importantly — what we do NOT do with it.

1. Summary (the short version)

Castellum is local-first. Your email, contacts and calendar data stay on your own device, and AI features run against a local model by default. We operate no cloud server that receives your mailbox content. Castellum also offers an optional cloud-AI mode that is turned OFF by default; it only ever activates if you deliberately enable it and configure a provider (see §4). We do not sell your data, do not use it for advertising, and no human at Joan Marc Riera (sole trader), trading via riera.co.uk reads your email.

2. What data Castellum accesses

When you connect an account, Castellum accesses, on your device:

• Email messages, headers, and attachments in the accounts you connect (via IMAP,

or via Gmail/Microsoft over OAuth where you choose it).

• Send capability to send mail on your behalf (SMTP, or Gmail/Graph send).
• Contacts and calendar data already present in your mail account, for the app's

contacts and agenda features.

• Account credentials / OAuth tokens, stored locally to keep you signed in.

For Gmail via OAuth, Castellum requests these scopes: gmail.readonly, gmail.modify, gmail.send. These let the app read, organise (label/archive/flag), and send your mail — the core function of an email client.

3. Where your data is stored

• On your device only. Messages, search index, and app state are stored in a local

SQLite database on your Mac. This data is not transmitted to us and does not pass through any Castellum-operated server.

• Standard local-storage caveats apply (e.g. the local database and its journal files

are readable by anything with access to your user account on that machine; use full-disk encryption).

4. Artificial intelligence — local by default, optional cloud AI (opt-in)

Castellum's AI features (summaries, draft replies, etc.) run against a local AI model (Ollama) on your own hardware / LAN by default. In this default mode the app enforces a hard egress guard so that no mailbox content leaves your device for AI processing.

Castellum additionally offers an optional cloud-AI mode. It is disabled by default and never sends anything unless you explicitly turn it on and configure a provider. When — and only when — you enable it:

• The specific content you act on (e.g. the message you ask to summarise or reply to) is

sent to a third-party cloud AI provider that you explicitly select and enable in the app solely to produce the output you requested, and is not used to train or improve any generalised AI model.

• It is used only to deliver the in-app feature you invoked — not for advertising,

profiling, or any unrelated purpose.

• You can turn cloud AI off again at any time, returning the app to local-only processing.

If you never enable it, Castellum behaves exactly as a local-only, no-egress email client.

5. Google API Services — Limited Use

Castellum's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Data from Google accounts is used **only to provide and improve the email-client

features you see in the app**.

• We do not transfer or sell this data for advertising, marketing, or any other purpose.
• We do not allow humans to read this data, except (a) with your explicit consent for a

specific action (e.g. debugging a problem you report), (b) where required for security, or (c) to comply with applicable law.

• We do not use Google user data to train or improve generalised/foundation AI models.

If you enable the optional cloud-AI mode (§4), Google-sourced content you act on is sent to a third-party cloud AI provider that you explicitly select and enable in the app only to produce the in-app result you requested, under provider terms that prohibit training on your content — consistent with the Limited Use requirements.

• We use this data only in ways consistent with this Privacy Policy.

A fuller standalone statement is at /google-limited-use.

6. Data we process off your device (sub-processors)

Castellum's core email function uses no cloud sub-processor. Off-device processing is limited to the following, and (except licensing) only when you opt in:

• a third-party cloud AI provider that you explicitly select and enable in the app — *only if you enable the optional cloud-AI mode (§4).* Receives the

specific message content you act on, to generate the summary/reply you requested. Does not train on your content. If cloud AI is left off (the default), no mailbox content is sent here.

• Lemon Squeezy — Merchant of Record; handles checkout, payment and tax. Receives your

purchase details (name, email, payment data), not your mailbox content.

• License-fulfilment automation (self-hosted n8n) and CRM (self-hosted EspoCRM) —

process your purchase email/name to issue and manage your licence. No mailbox content.

Apart from the opt-in cloud-AI provider, these handle purchase/account data only and never receive your email, contacts, or calendar.

7. What we do NOT do

• We do not sell or rent your data.
• We do not use your data for advertising or ad targeting.
• We do not build profiles of you for third parties.
• No human at Joan Marc Riera (sole trader), trading via riera.co.uk reads your email except the narrow security/consent/legal cases in §5.

8. Data retention and deletion

Because your mail lives on your device, you control it: deleting the app and its local data store removes it. Disconnecting an account removes its stored tokens. For any purchase data held by the sub-processors in §6, contact info@castellummail.com to request deletion, subject to legal record-keeping requirements.

9. Your rights

Depending on where you live (e.g. UK GDPR / EU GDPR / CCPA), you may have rights to access, correct, delete, or port your data, and to object to processing. Since Castellum stores your mail locally, you already exercise most of these directly. For purchase data, email info@castellummail.com.

10. Children

Castellum is not directed at children under 16 and we do not knowingly collect their data.

11. Changes

We may update this policy; the effective date above will change and material changes will be noted at /privacy.

12. Contact

Joan Marc Riera (sole trader), trading via riera.co.uk Email: info@castellummail.com Governing law: England & Wales, United Kingdom