Privacy at Bottle Mail
Last updated 7 November 2026
Bottle Mail is made by Waffle Whale (“we”, wafflewhale.com), the studio formerly called BrandCode10. It is built so that your email stays between you and your mail provider. This page explains, in plain language, exactly what is stored where, what our servers receive, and what they never see.
The short version
- Windows app: your mail is stored only on your PC, encrypted. The app connects directly to your own mail servers.
- Read tracking: our tracking service learns when a tracked message is opened or a tracked link is clicked. It does not receive message content, subjects or email addresses, and it does not store IP addresses.
- Web app: runs as a guest session. Your sign-in and mail are held in memory only while you use it, and nothing is kept after you sign out.
- This website: no cookies, no analytics, no advertising and no third-party scripts.
- AI in the Windows app: runs on your PC, on our Waffle Whale Cloud service, or with your own AI key, as you choose. With Waffle Whale Cloud, only the conversation or text being worked on is sent, and we keep no mail text (see AI).
- We do not sell data, show ads or use your mail to train AI models.
1. The Windows app
What stays on your PC
Everything the app needs to work offline is kept in your Windows user profile (%APPDATA%\Bottle Mail):
- Your messages, folders, attachments you opened, drafts, contacts suggested from your own sent and received mail, and your settings, rules, templates, signatures and snoozed items.
- The read-tracking events for mail you sent (when and how each recipient’s message was opened).
- If you use AI features: cached summaries, labels and the search index built from your mail.
The mail database is encrypted at rest (SQLCipher), and so is the attachment cache (AES-256-GCM). The encryption key, your mail passwords or sign-in tokens, AI keys and S/MIME / PGP private keys are protected by Windows (DPAPI and the Windows credential store) and never leave your PC. An optional app lock (Windows Hello or a PIN) keeps the app closed to anyone else at your desk.
Who the app talks to
- Your mail providers (for example Gmail, Microsoft or your company’s server), directly over encrypted connections, to fetch and send your mail.
- Our tracking service, only if read tracking is on (see section 2).
- Our update feed (
track.brandcode10.com/updates): the app asks for the latest version number a few times a day. This is an ordinary web request that contains no personal data. To roll updates out gradually, the update check sends a random number created on your PC. It isn’t linked to you or your mail, and it isn’t stored. - Crash reports (on by default, can be switched off in Settings → Security and privacy): technical details of a crash, the app and Windows version and a random install id. Addresses, subjects, file names, account names and server names are removed before anything is sent, and mail content is never included. Reports go to our error-monitoring provider (Sentry), and builds without a reporting address send nothing at all.
- Problem reports, only when you choose to send one (see Problem reports below).
- Usage statistics (off by default): if you turn them on, one anonymous summary of which features were used, as counts, at the end of a session.
- AI, depending on the option you pick on the AI page:
- On this PC: the app downloads an open AI model once (from Hugging Face) and runs it on your PC. Your mail never leaves it.
- Waffle Whale Cloud (selected until you choose another option): the conversation or text being worked on goes to our AI service (
ai.brandcode10.com), which passes it to Groq, the company that runs the open model for us, and returns the answer. Long conversations are shortened first. Our service keeps only details about each request, such as the time, the feature and its size, for 90 days, never the mail text, and uses a random key for your installation to apply a daily limit. - Your own key (Anthropic, OpenAI, Google Gemini or a compatible service): the text goes directly from your PC to that provider under its terms. The key stays on your PC.
- Plugins are not switched on in the app yet. This and the next two points describe how they will work. Plugins you install can only reach the web addresses they declared, which you see and approve when you install them. Plugins come only from Waffle Whale and are checked against our signature before they install.
- Our plugin service (
plugins.brandcode10.com): the app downloads the plugin list, the plugins you choose and a list of withdrawn plugins from it. Unless you switch it off in Settings → Security and privacy, the app also sends anonymous plugin statistics: for each plugin and version, how often it was installed, updated, removed, switched on or off, and how often it failed, with short error messages that have addresses and names removed. These statistics carry no install id, account, address or mail content, and the service keeps only daily totals, not your IP address. - Your Waffle Whale ID, only if you use plugins. Bottle Mail itself never needs an account. Browsing plugins needs none either, but installing one asks you to sign in with Waffle Whale ID (our account service,
id.brandcode10.com), so your plugins can follow you to another PC and Waffle Whale plugins (such as Clams Budget and Pebble Notes) can sign you in without asking again. Our plugin service then keeps, for your account: your name and email address from Waffle Whale ID, which plugins you installed (and which version), whether each is switched on, and the settings a plugin marks as safe to sync. It never receives your mail, mail passwords, the private keys or passwords that plugins keep on your PC, or your sign-in details for other services. The plugin statistics above stay anonymous and are not linked to your account. Signing out stops syncing; plugins you installed keep working. You can ask us to delete the plugin data kept for your account.
Problem reports
With Report a problem (in the Windows app: Settings → Feedback, or Report this problem on an error note; in the web app: the sidebar) you can tell us when something goes wrong. How it works.
- A report is sent only when you choose to send one. It contains what you typed and, if you add one, an email address for a reply.
- Diagnostic info and a screenshot are included only if you switch them on. Both are off by default, and you see the exact diagnostic text and a preview of the screenshot before you send.
- Diagnostic info contains the app and Windows version, the kinds of accounts you have, which features your mail servers support, recent sync and send states and recent lines of the app’s log. Before you see it, passwords, sign-in codes and tokens, email addresses, names, subjects, message text, attachment names, your own folder names, server names, IP addresses and file paths in your Windows user folder are removed, and message IDs are replaced by a scrambled code. Your mail is never included.
- The screenshot shows only the Bottle Mail window, never your desktop or other apps.
- In the web app, the only extra you can add is the app version and your browser, if you switch it on. There is no diagnostic text and no screenshot.
- Reports are stored on our own server (
track.brandcode10.com) and deleted automatically after 180 days. We don’t store your IP address with a report. - The reply email is used only to answer that report.
2. Read tracking
Read tracking uses three signals: a read-receipt request, a tracking image and tracked links. You can turn each one off per account and per message, and you can add a line to your signature telling recipients that a message is tracked.
What our tracking service receives
When you send a tracked message, your app registers a random, unguessable code (a “token”) for each recipient, together with the time it was sent. The token is linked to a random key for your installation, not to your name or email address.
When a recipient’s mail app loads the tracking image or the recipient clicks a tracked link, the service records an event with:
| Stored | Why |
|---|---|
| Time of the event, and seconds since the message was sent | To tell a real open from an automatic one right after delivery |
| Signal type (image or link click) | A click is stronger evidence than an image load |
| Device class (for example desktop, phone, webmail image proxy or security scanner) | To label Apple Mail Privacy Protection and security gateways honestly |
| The browser or mail app identifier string (user agent), shortened | Used for the device class above |
| Approximate country, when our network provider supplies it | Shown to the sender as a coarse location |
| For clicks: the link’s destination address | So the sender can see which link was opened, and so the recipient is forwarded there |
Never stored: IP addresses (they are used for a moment to recognise known scanners and to limit abuse, then discarded), message content, subjects, sender or recipient email addresses, or anything that fingerprints the recipient.
Only the installation that registered a token can read its events. Events and tokens are deleted automatically after 12 months.
Read receipts (MDN) travel as ordinary email from the recipient’s mail server to yours; they never pass through our service.
If you receive tracked mail
You stay in control: blocking remote images in your mail app stops the tracking image, and declining read-receipt requests stops receipts. Bottle Mail never shows a sender “Not read”, so declining does not mark you as ignoring anyone. Replies and forwards written in Bottle Mail have the tracking removed.
3. The web app (mail.brandcode10.com/app/)
The web app runs in guest mode: you sign in with your own mailbox, and we do not create an account for you.
- Your mail password and the mail you view are held only in the server’s memory for the length of your session. They are never written to disk, logs or backups.
- Your session ends when you sign out, after 30 minutes without activity, after 12 hours at most, or when the service restarts. Everything in memory for that session is then deleted.
- One strictly necessary cookie keeps you signed in during the session. The web app does not keep an offline copy of your mail in your browser in guest mode.
- Messages you send with tracking use the same tracking service described in section 2.
4. This website
This site sets no cookies and uses no analytics, advertising, embedded videos or third-party fonts. If you switch between light and dark mode, that choice is saved in your own browser’s storage. The download page reads the current version number from our update feed. Like any web server, our hosting provider may keep standard access logs (including IP addresses) for a short time for security and troubleshooting.
Feature requests and votes
- The title and details of a feature request you send (on the roadmap page or from inside the app) are public on that page.
- The email address is optional. It is used only to follow up on your request, is never shown publicly, never written to our logs and never used for marketing. Ask us to delete it at any time.
- To allow one vote per request, your browser keeps a random voter id in its own storage. It is not linked to your name or mailbox. To limit spam we keep a keyed one-way hash of your IP address with each request and vote, never the address itself.
5. Sharing, hosting and retention
- We do not sell or rent data and do not use it for advertising.
- Our services run on our hosting provider’s servers in Singapore. Crash reports, when enabled, are processed by Sentry.
- Tracking events: deleted after 12 months. Web app sessions: deleted when the session ends. Mail on your PC: kept until you remove the account in the app. Feature requests and votes: kept while the request is on the roadmap page; a follow-up email address is deleted on request. Problem reports: deleted after 180 days.
- We may disclose information if the law requires it, but by design we hold very little that could identify you.
6. Your choices and rights
Depending on where you live (for example under Thailand’s PDPA or the EU GDPR), you may have the right to access, correct or delete personal data and to object to its processing. You can switch off tracking, crash reports and AI features in the app at any time, and removing an account deletes its local mail. For any privacy request or question, email hello@wafflewhale.com or use wafflewhale.com. We aim to answer within 30 days.
Do not use read tracking to harass anyone or for unsolicited bulk email.
7. Changes
If this policy changes, we will update this page and the date at the top.