Aerogram · BETA ON INVITATION

Privacy

Last updated: October 13, 2026.

This instance and its contact

This policy concerns Aerogram on mail.aerogram.cloud, private email client administered by Michael Vande Velde. For any questions regarding your data or a request for access, correction, export or deletion: michael@magrana.be. Never send a password, login code or recovery key to this address.

Data used and purposes

Each Aerogram account has a username, a password saved as a cryptographic derivative, a two-factor authentication state and private sessions. Invitations are temporary. Connected boxes, mail and preferences belong to this user's space; they are not shared with other users of the application.

Aerogram processes the addresses and identities of the connected mailboxes, the senders and recipients, the subjects, dates, contents and attachments of the messages, as well as their folders, labels and reading states. This data is used to synchronize, display, search and organize mail and execute requested mailings.

Aerogram drafts, signatures, templates, preferences and scheduled submissions are saved to find your work. Recipient suggestions come from downloaded mail; no access to Google Contacts is required. Connection information and technical events are used to protect and operate the application; Application logs do not record email bodies or secrets.

Closed Beta Applications

The form collects your email address (required) and, if you provide them, the suppliers used, the number of boxes and your needs. Michael Vande Velde uses this information to review your request and respond to you regarding the beta, based on the pre-contractual steps requested by you. They do not subscribe you to any newsletters or create any accounts. The owner personally validates the invitations.

Applications are kept for a maximum of 90 days in the active list, then deleted. Previous versions may remain in backups until they are rotated. Temporary counters and a technical token limit abusive submissions, without third-party advertising services or CAPTCHAs. Do not insert any passwords, private messages or sensitive data into the form.

You can request access, rectification or deletion of your application to michael@magrana.be. You can also enter theBelgian Data Protection Authority. The data of the account possibly created after your acceptance follows the separate rules described below.

Gmail permission

Connecting to Gmail uses OAuth: you authorize Aerogram with Google, without giving it your Google password. Permissions openid and email identify the account. Permission gmail.modify allows you to read mail, search, send, change classification and move messages to trash. Aerogram does not request access to Drive, Calendar or Contacts and does not offer permanent Gmail deletion.

Authorization tokens enable background syncing, even when the browser is closed. A search carried out on a Gmail mailbox is transmitted to Google; the local search of the unified mailbox concerns messages already downloaded. Drafts created in Aerogram remain local until sent; those created in Gmail are viewable in read-only mode.

Microsoft Authorization

Outlook.com, Hotmail, Live, and Microsoft 365/Exchange Online use a delegated OAuth connection. Permissions openid profile email offline_access identify the account and allow the connection to be resumed; User.Read, Mail.ReadWrite and Mail.Send allow you to read the identity, synchronize and classify the mail, then send from the main connected address. No access to Microsoft calendars or contacts or application permissions is requested. Tokens are encrypted at rest. An organization may require administrator consent; aliases and shared mailboxes are not supported.

Microsoft logout deletes active tokens in Aerogram and suspends the mailbox; it does not guarantee withdrawal of consent at Microsoft. You can remove permission for this app in your Microsoft account or organization permissions. Old encrypted backups may still contain previous permissions; Remove Microsoft consent before a restore if necessary. The mail already downloaded remains present.

Storage and protection

The application, its indexes and its cache are hosted at Netcup in Germany. Mail data and connection secrets are encrypted at rest. External personal storage uses Scaleway in Paris, France; encrypted backups use Hetzner in Nuremberg, Germany. Verification of backups is carried out in flow by an isolated service on the Netcup infrastructure, without permanent retention of decrypted data. The owner's Mac only retains offline recovery identity, manifests, and small receipts; it no longer keeps databases, caches or mail archives. External storage only concerns data actually copied and capabilities activated. Exchanges with the application and mail providers use encrypted connections.

Connection protections are based on authentication, TOTP and mandatory backup codes; Passkeys can be registered to log in without a password. HTML contents are filtered and isolated without scripts. The server must be able to decrypt the data to provide the service: it is not end-to-end encryption, and cache encryption alone does not protect against complete server compromise.

Sharing and limited use

The data passes through Google, Microsoft or the providers of the mailboxes configured for the requested operations, and through the hosting and backup infrastructure necessary for the service. A send communicates the message and its attachments to the chosen recipients.

Aerogram does not sell the data, does not use it for advertising purposes and does not integrate audience measurement or artificial intelligence services processing emails. Google data is not used to train artificial intelligence models.

The use and transfer of information received from the Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Any human intervention on Google data for assistance requires the explicit consent of the holder on the data concerned, unless necessary for security or legal obligation.

Files shared by link

Offers with personal storage allow you to share a file of up to 1 GB per link, without an Aerogram account for the recipient. The encrypted file is stored at Scaleway and uses the same quota as mail archives. Recovery copies follow the backup policy for this offering. Anyone with the link can download the file until it expires (7 or 30 days) or is revoked; Only share this link with the people you want. Revocation does not remove copies already downloaded.

Expiring the link does not delete the file: you can download it or request its deletion in Your space → Mailboxes → Shared files. An unfinished transfer is cleaned up after 24 hours of inactivity. A deletion releases the quota after confirmation of the removal of active data; Previous backups follow their rotation. Switching to Access (legacy contract) disables public links and allows 30 days to download your files before phasing out. These files are not deposited with your mail provider: only the link address appears in the message sent.

External images and links

External images in messages are blocked by default. Activating them by message or mailbox loads them directly from their host and can reveal your IP address and the opening of the message. The links you open take you to sites with their own privacy practices.

Cookies and browser preferences

Aerogram uses technical cookies for sign-in and security. A shared-file link also uses a temporary cookie limited to the authorized download. A user session expires after 30 days of inactivity and, in all cases, after 180 days; its cookie cannot extend beyond that absolute deadline. Signing out or revoking the session also closes it. Sign-in steps and Google and Microsoft authorization callbacks use temporary five-minute cookies. The mail theme and sidebar state are stored in the browser. Before signing in, the mail language choice may be stored locally in the browser; after signing in, the preference is linked to the encrypted user profile. On the public site, your choice of light or dark is saved in this browser’s local storage for this site, independently of the mail theme. Without a saved choice, the theme follows your system and its changes. If JavaScript or local storage is unavailable, you can still change the theme on the open page, without guaranteed persistence. This preference uses no cookies or tracking and is not sent to the server. Aerogram adds no advertising or analytics cookies.

Retention, disconnection and deletion

Downloaded history remains available as long as it is kept in this instance. HTML and attachments retrievable from a provider can be removed from the cache according to the size and duration limits chosen per mailbox. Drafts, signatures, submissions and indexed text remain kept in the local database. The cache does not replace an archive.

Offers with personal storage allow, upon activation by box, to keep the originals and their attachments in the subscribed capacity. Disabling this option or removing a mailbox does not automatically delete existing copies. Switching to Access (legacy contract) or expiring the trial ends new copies and opens a 30-day window to read and export the archive. After this period, its deletion is processed gradually; technical failure may delay its completion. No messages are deleted from the provider by this processing. The presence of each original with this supplier is not guaranteed: you must export the copies that you wish to keep.

Access (legacy contract) does not include any backup of the contents of emails, indexes, contacts, drafts, templates or attachments. The technical data necessary for the account, its connection and its security remain saved. Local-only content may therefore be lost if the server goes down. Backups created before switching to Access (legacy contract) may persist until they are rotated.

Staging preview: The new plans provide for protection of useful local data and retained copies through regular backups. A local draft and an archived copy are distinct from the reading cache. Available storage and successful backups remain necessary; immediate recovery is not guaranteed.

The cache prepares messages for display and may evict content that can be fetched again from the provider. Its message bodies, indexes and attachments are excluded from backups for the new plans. Content currently cached is no proof that a message can be recovered after a failure.

Encrypted daily backups are transferred to Hetzner and verified by an isolated infrastructure service. The server keeps a verified local periodic backup, the active rollback point and any exceptions needed for recovery. Hetzner retains backup sets for 30 days and keeps the latest recovered and verified set; shared segments remain while any set depends on them. Protection of the latest copies may take up to a day until the next daily transfer, or longer after a reported failure. Deletion is gradual and may be delayed by a lock, an outage or an unavailable maintenance service. Recognized older deployment backups may be removed after their off-site recovery has been verified, while retaining the sets needed for rollback. Backups may contain older versions of data and authorizations.

In Your space → Mailboxes, Google logout removes active tokens and suspends the mailbox, then attempts to revoke them at Google. The mail already downloaded remains present. You can also withdraw the authorization in the connections from your Google account. Simply logging out of Aerogram closes the browser session without stopping syncing or scheduled sends.

Moving a message to the trash does not delete all of its copies. In Your space → Mailboxes, removing a mailbox allows you to keep the data received or to request the gradual deletion of your data in Aerogram, without deleting the mail from the supplier. Old backups track their locks and rotation; they are not immediately erased by this button. For a request regarding your space and its recovery copies, contact the administrator. It does not erase messages stored by recipients or the provider.

Evolution of this policy

The date above indicates the released version. Any new use of Google data will be explained and subject to new authorization before implementation.