Nylas-mail: Privacy Check

[PhillipTaylor]

Hi, I was a little alarmed to receive this email from you below.

Q1. Do your logs contain my passwords?
Q2. Can you direct me to the lines of code in your application which send my account credentials back to your servers please, so I can be confident of what you're collecting?

Thanks

Phill

---

Hi there-- Michael from Nylas here.

I wanted to let you know that we recently fixed a bug in N1 that was causing auth errors for generic IMAP and SMTP accounts. Our error logs show that your account was affected by this bug.

You should now be able to successfully connect via N1, and you can reply to this message if you have any feedback or issues going forward.

Thanks!
Michael

[dasDaniel]

I also was immediately concerned. This kind of email, while a nice gesture, is very alarming.

[grinich]

Hi folks,

N1 uses the hosted Nylas cloud sync engine by default. This software is open source (https://github.com/nylas/sync-engine) and you can run it yourself. More details can be found in our FAQ: https://nylas.com/n1/faq or in the GitHub repo https://github.com/nylas/n1

If you have connected an account and would like it deleted, please send a note to [email protected] from that account and we'll wipe it from our system.

We've only had a few reports from folks confused about this, but we're still working to make it clear the app does this. One of the reason the entire stack is open source is to be transparent with developers (and offer a solution if they don't want to maintain a server). These days, running the mail processing+parsing in the cloud is a pretty common pattern (Mailbox, Accompli, CloudMagic, Polymail, etc.) and it's documented both on our website and in articles that journalists write about us such as this one from OMGubuntu http://www.omgubuntu.co.uk/2016/02/nylas-n1-email-client-4-4-features

[PhillipTaylor]

I have read the links which were interesting.

I think you should definitely make it more obvious that the user's entire email mailbox including all historical email is silently uploaded to your servers as the default behaviour for the application.

Regardless,

Thank you for your reply. You can consider this issue closed.

Phill