Is it safe to connect your email to an app? Five things to check

Connecting your email to a new app feels like handing over the keys to your house. Your email holds bank letters, contracts, password resets and conversations with the people closest to you. So the question is fair, and it deserves a real answer instead of a reassuring slogan. These are the five things we would check ourselves, for any app, including ours.

1. How do you sign in?

The best case is a button like “Continue with Google” or “Continue with Microsoft”. You sign in on Google’s or Microsoft’s own page, the app never sees your password, and it only gets the access you agree to.

Some providers, such as iCloud or Yahoo, work with an app password instead: a separate password you create in your provider’s settings just for this one app. If you ever stop using the app, you delete that password and the app is locked out, while your real password stays untouched.

Be careful with apps that simply ask for your normal email password.

2. Where do your emails go?

This is the most important question, and the one apps answer least clearly. There are two ways an email app can work:

• On your device. The app fetches your emails straight from your provider and keeps them on your computer or phone. The company behind the app never receives them.
• Through the company’s servers. Your emails are copied to the company’s computers first, for example to power search, summaries or notifications. That can be useful, but it means a second company now holds your email.

A good privacy policy says clearly which of the two it is. If you can’t find out, ask, and if you still can’t find out, be careful.

3. What does the company keep?

Even an app that keeps your emails on your device needs to know a few things: who you are, which plan you have, which devices you use. Look for a plain list of what is stored and for how long. Short lists are a good sign.

4. Can you remove its access?

You should be able to cut off an app at any time, even without opening it. In a Google account, the list of linked apps shows every app with access; you pick one, choose Remove access and confirm (Google Account Help). Microsoft accounts have their own settings at account.microsoft.com.

5. Who is behind it?

A real company with an imprint, a contact address and people who answer is worth more than any badge. Write to them before you connect your account. How they answer tells you a lot.

How Chail answers these five questions

• Sign-in: with Google or Microsoft where possible, otherwise with an app password from your provider. Your password never reaches us.
• Where your emails go: nowhere but your device. Chail connects your PC directly to your email provider.
• What we keep: the address of your Chail account, the email addresses you connected, your plan and the devices you signed in on. Never your emails, contacts, attachments or notes. Our privacy policy lists it all.
• Removing access: remove the address in Chail, or remove Chail’s access in your Google or Microsoft account. Your emails stay with your provider either way.
• Who we are: Adrian and Hendrik, two founders in Germany. You can write to us at support@chail.app, and we answer ourselves.