Privacy Policy
Hylki is a free, open-source email client that runs on your own device. This policy explains what information Hylki handles, how it is used, and the choices you have. It applies to the Hylki desktop application and to this website, hylki.hyprlab.co. Hylki is developed by Hyprlab (“we,” “us”).
The short version
- Hylki runs locally on your device and talks directly to your email providers.
- We operate no servers that receive, store, or process your email or account data.
- We collect zero telemetry — no analytics, tracking, or usage reporting from the app.
- Our Flatpak repository keeps anonymous counts of update checks and release downloads, from ordinary server traffic, without storing IP addresses. See Update checks and install counts.
- Your credentials and access tokens are stored on your device in your operating system’s secure keyring.
- We do not sell, rent, or share your data with anyone.
Information Hylki accesses
To function as an email client, Hylki accesses the email accounts you choose to connect. Depending on how you sign in, this may include:
- Account credentials or OAuth tokens — used to authenticate with your email provider (for example, via Google or Microsoft OAuth, or an IMAP/SMTP username and password).
- Your email content and metadata — messages, folders, contacts you correspond with, attachments, and message flags — so Hylki can display, search, compose, send, and organize your mail.
Hylki requests only the access needed to send and receive your email on your behalf. This information is read from, and written to, your email provider directly by the app on your device.
How Hylki uses this information
Information is used solely to provide email functionality that you initiate — retrieving and displaying your mail, sending messages you compose, and keeping folders in sync. It is never used for advertising, profiling, or any purpose unrelated to operating your mailbox.
Google user data
If you connect a Google account, Hylki uses Google OAuth to obtain access to your Gmail mailbox (IMAP/SMTP) so it can display and send your mail. Hylki accesses this data only on your device and only to provide the app’s email features at your direction.
Limited Use disclosure. Hylki’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Hylki does not transfer or sell Google user data, and does not use it for advertising or any purpose other than providing the email client’s user-facing features.
How your data is stored
- Credentials and OAuth tokens are stored in your operating system’s secret service / keyring, not in plaintext on disk.
- Cached mail (folders, message summaries, and bodies) is stored locally on your device to enable fast startup and offline reading.
- None of this data is transmitted to us or to any third party. It stays between your device and your email provider.
Sharing and disclosure
We do not receive your email or account data, so we have nothing to sell or share. Hylki does not send your data to any third party. Your email naturally travels between your device and the email and identity providers you choose to use (such as Google or Microsoft), whose own privacy policies govern their handling of it.
Data retention and deletion
Because your data lives on your device, you are in control of it:
- Remove an account in Hylki to delete its stored credentials and cached mail from your device.
- Uninstalling Hylki removes its locally cached data.
- You can revoke Hylki’s access to a Google account at any time from your Google Account permissions page (and the equivalent settings for other providers).
Telemetry
Hylki collects no analytics, no usage statistics, and no crash telemetry. The app does not phone home. The only contact an installed copy has with us is the update check that Flatpak itself performs against our repository, described next.
Update checks and install counts
Hylki is distributed from a Flatpak repository on this website. Like any
Flatpak remote, it is contacted by GNOME Software (or the
flatpak command) on your device when it checks for updates
and when it downloads a release. These are ordinary web requests that any
software repository receives; they are made by Flatpak, not by Hylki, and
they carry no information about you, your accounts, or your mail.
We use that repository traffic to keep two aggregate counts: how many installed copies checked for updates on a given day, and how many pulled each release. This is how we know roughly how many people use Hylki and how quickly a release reaches them. To do it, the server records:
- A one-way hash instead of your IP address. To count a device once per day rather than once per request, the server combines your IP address with a secret key held only on the server and the current date, hashes the result (SHA-256, truncated), and keeps only that hash. The raw IP address is never written to storage. Because the date is part of the hash, it changes every day, so the same device cannot be recognised or linked from one day to the next.
- Which file was requested — the repository summary (an update check) or the metadata of a specific release (a download) — and the date.
The per-day hashes are deleted after 60 days. What remains is a table of daily totals: a number of unique update checks per day, and a number of unique downloads per release. There is no user-level or device-level record, no user agent or location, and nothing that identifies you. These totals are visible only to the maintainer and are not shared.
Requests to this website pass through Cloudflare, our network provider, whose handling of connection data is governed by Cloudflare’s privacy policy. Downloads of the RPM package and the standalone Flatpak bundle from GitHub Releases are counted by GitHub under GitHub’s privacy statement; we see only a total download number per file.
Because the update check is made by Flatpak rather than Hylki, the app has no setting to turn it off. If you would rather not be counted, you can install the RPM package or the standalone bundle from GitHub instead of adding our repository, or disable automatic updates for the Hylki remote in your Flatpak configuration.
Children’s privacy
Hylki is not directed to children under the age of 13, and we do not knowingly collect personal information from them.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected here with a revised “Last updated” date.
Contact
Questions about this policy or your privacy? Email [email protected].
