Privacy Policy | Dumb Work

App: Dumb — for iPhone, iPad, Mac, Apple Watch and Apple Vision Pro
Provider: S25 Studio Pty Ltd
Effective: 17 September 2026
Version: 1.3 — see §15. A correction rather than a change: nothing about what Dumb does with your data changed in this version. Version 1.2 described a narrower app than the one you have, and this one describes the app you have.
Canonical URL: https://www.dumb.work/privacy

The short version

Dumb has no servers of its own. It is a mail client, not a mail service.

Your mail is fetched by the app directly from your email provider to your device — Google, Apple's iCloud, or whichever mail server you name — over an encrypted connection nobody else is on, and kept in a file inside the app's own storage. None of it is sent to us, because there is nowhere to send it. There is no Dumb account, no sign-up, no analytics, no advertising, no tracking, and no third-party SDK in the app that reports anything anywhere.

A few features you can see keep copies of their own: Spotlight, notifications, widgets, your Apple Watch, and your signatures in your own iCloud account. Every one of them is on your own devices or in your own iCloud account, and none is anywhere we can reach. §4 lists them all.

The rest of this document says the same thing at the length a privacy policy is expected to be, and is specific about every network connection the app makes.

1. Who we are

Dumb is developed and published by S25 Studio Pty Ltd (“we”, “us”, “our”), registered office: Suite 1501, Level 15, 9–13 Castlereagh Street, Sydney NSW 2000, Australia.

For readers in the EU/UK: with respect to the small amount of processing described in §6, we are the controller. For the content of your mailbox, the controller is your email provider — Google, Apple, or whoever runs your mail server. We never receive that content, so we cannot be its controller.

Contact: privacy@dumb.work (or hello@s25.studio)

2. What Dumb is, architecturally

Understanding the shape of the app answers most privacy questions on its own:

Dumb is a client-only application. It runs entirely on your devices.
We operate no backend, no relay, no proxy, and no cloud storage. Nothing in the app is configured to talk to a server we control. The only site we run is the marketing page at dumb.work, which the app can open in your browser and which is otherwise unrelated to it.
The app connects to your email provider's mail servers, using credentials you give it, and to a short list of other hosts. §5 names every one of them, and there are no others.
The calendar screen reads the calendars your device already has, through the operating system's own Calendar service, with your permission. Dumb makes no network connection of its own for the calendar and asks Google for no calendar permission. See §3.
Apart from Apple's own system frameworks, the app includes these open-source libraries, compiled into it:
- GRDB, a wrapper around SQLite, the database the app keeps your mail in.
- From Apple's open-source projects: swift-nio, swift-nio-ssl (which contains BoringSSL, the code that encrypts the connection), swift-nio-imap, swift-collections, swift-atomics, swift-system and swift-se0270-range-set. These are how the app speaks IMAP and SMTP to your mail server.
None of them collects, reports or analyses anything, and none of them opens a connection the app did not ask for, to a host §5 does not list.

3. What the app accesses in your Google Account

When you sign in, Google shows you a consent screen listing the permissions (“scopes”) Dumb asks for. It asks for three, and no others:

Scope	What it permits	Why Dumb needs it
`https://mail.google.com/`	Full access to your Gmail mailbox over the IMAP and SMTP protocols — reading, changing read/starred state, moving between folders, sending, and permanently deleting	Reading your mail and everything you do to it. Google grants the IMAP and SMTP protocols under this scope and no other; its own list writes the entry as (includes any usage of IMAP, SMTP, and POP3 protocols). See the note directly below on what Dumb does and does not do with it.
`userinfo.email`	Your email address	To know which mailbox is signed in, and to label the account.
`userinfo.profile`	Your name and profile photo	To show you as yourself in the account list and sender picker. Both arrive inside the sign-in token. The app asks Google for them again from time to time, so that a name or photo you change in your Google Account is picked up — see §5.

About the mail scope, plainly

An earlier version of Dumb asked for gmail.modify, and this document said that scope "cannot permanently delete anything — that requires a wider scope Dumb deliberately does not request". Dumb now requests that wider scope, and it would be wrong to let that sentence quietly disappear, so here is what changed and what it means.

Why. Dumb reads your mail over IMAP and sends over SMTP, instead of through Gmail's REST API. Those are the protocols every other mail client uses, and Google permits them only under https://mail.google.com/. There is no narrower scope that grants IMAP; gmail.modify grants none of it. The choice was not between a wide permission and a narrow one — it was between this permission and not being able to reach your mailbox the way a mail client does.

What it honestly means. This permission does allow permanent deletion. The capability is real, and we are not going to describe it as though it were not.

What Dumb does with it. Not that. Dumb moves mail to your Bin and stops there. There is no button, menu item, gesture or setting anywhere in the app that permanently deletes a message, and the only code that can destroy anything is the path that replaces a draft with your edited version. Mail in the Bin stays recoverable, and Gmail empties its own Bin on its own 30-day schedule — so the window in which a deletion can be undone belongs to you rather than to us.

What that is worth. It is a commitment, not a technical impossibility, and you should read it as one. The protections that are structural are in §4 and §5: Dumb has no servers, so nothing it reads can be sent to us. If Dumb ever did expose permanent deletion, this section would say so before that version shipped.

Dumb previously requested contacts.readonly and no longer does. It was removed because it required reading your whole address book to answer a question your correspondents' email addresses already answer.

Sign-in uses OAuth 2.0 with PKCE in a system-provided browser sheet. Your Google password is typed into Google's own page and is never seen by, passed through, or stored by Dumb.

About the calendar, plainly

An earlier version of Dumb asked Google for calendar.readonly and read your events from Google Calendar's API over the network. It no longer asks for that permission, and that row is gone from the table above — the list is three scopes where it was four.

What replaced it. Dumb now reads the calendars your device already has, through the operating system's own Calendar service — the same calendars Apple's Calendar app shows you. If your Google Calendar appears there, Dumb sees it, because you connected that account to your device, not because Dumb asked Google for it. If it does not appear there, Dumb does not see it, and the app will tell you so rather than silently showing an empty week.

Why it is a stronger position and not merely a different one. Dumb makes no network connection at all for the calendar. There is no request to Google, so there is nothing for this policy to promise about how that request is handled. The permission is granted by you to the app on your own device, is revocable at any time in your device's Settings, and is visible there alongside every other app that has asked for it.

What Dumb can now do that it could not before. Create, change and delete events. The previous permission was read-only and this document said so; that is no longer true and it would be wrong to leave the old sentence standing. Every such change is written to the calendar on your device and syncs onward exactly as a change made in Apple's Calendar app does. Dumb never keeps an event that exists only inside itself.

What it asks for. Full access to your calendars, because the screen both reads and writes. Your device asks you for this the first time you open the calendar, not at sign-in, and declining it costs you the calendar screen and nothing else — mail is unaffected.

Google API Services User Data Policy

Dumb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, and in the terms Google's Limited Use rules ask us to be explicit about: Google user data obtained through these scopes is used only to provide the user-facing features described in this document. It is not transferred to us or to anyone else, not sold, not used for advertising, credit assessment, lending or any similar purpose, not used to train, fine-tune or evaluate any AI or machine-learning model — ours or anyone else's — and not read by any human, including us.

No employee, contractor or automated process of ours has access to it. It is kept on your device, and the only copies made anywhere else are the ones §4 lists — your device's own search index, notifications and widgets, your Apple Watch, and the signatures in your own iCloud account — each there to provide a feature you can see, and none anywhere we can reach.

The summaries described in §4 are written by a language model that is part of your device's operating system, running on your device. Using it to read a message does not train, fine-tune or evaluate it, and sends nothing anywhere.

Accounts other than Google

Dumb also works with iCloud Mail, Fastmail, Yahoo and any other mail server that speaks IMAP and SMTP. Everything else in this document applies to those accounts exactly as it does to a Google account: the same storage, the same protections, the same absence of any server of ours. What differs is how the account proves itself.

These accounts sign in with a password rather than a consent screen. For iCloud it is an app-specific password you generate at appleid.apple.com; for Fastmail and Yahoo, usually an app password generated in their settings; for another server, whatever that server accepts. You type it into Dumb, the app checks it against the server before keeping it, and then keeps it in the system Keychain under the same protections as a Google refresh token (§4). It is never written anywhere else and never sent anywhere but that server.
There is nothing for Dumb to revoke. Google lets an app hand its permission back; a password cannot be handed back. Signing out deletes it from your device, and the password itself stays valid until you revoke it where you made it. See §8.
Microsoft (Outlook.com and Microsoft 365) appears in the list of account types but cannot sign in yet. Choosing it explains why and makes no connection.

4. What is stored, and where

Almost everything Dumb stores is in the app's own storage on your device:

What	Where	Notes
Messages: subjects, senders, recipients, dates, snippets, bodies, inline images, attachment metadata	A SQLite file in the app's Application Support container	Held in plain text
Calendar events	The same file	A local copy of events from the calendars already on your device, kept so the screen can draw without waiting. The originals belong to your device's Calendar service, not to Dumb
Drafts	The same file
The list of senders whose remote images you allowed	The same file, attached to the account	Deleted with the account
The mailing lists you have unsubscribed from — the sender's name and address, the date, and which route was taken	The same file, attached to the account	So that Settings can list what you have left. Deleted with the account, and removable a row at a time
Files you attach to a draft	A folder in the same container	Removed when the draft is sent or discarded, and at sign-out
Attachments you open	A temporary folder in the same container	Emptied every time the app launches, and at sign-out
Your last eight searches	A file in the same protected folder as the store	So the search page can offer them again. Clear recent searches on that page removes them
Pictures fetched from the internet: remote images you allowed (§7), sender marks and account photos (§5)	A cache in the app's own Caches folder	Up to 128 MB, with no cookies stored alongside it. Emptied at sign-out
Your refresh token for a Google account, or your password for any other account	The system Keychain	See below

And a few copies live outside the app's own storage, each because a feature you can see needs it:

What	Where	Notes
For each message: its subject, the sender's name and address, its snippet (the opening line or so) and its date. Not the body	The operating system's search index (Spotlight), on this device	So your mail can be found from Spotlight. On by default. The Find mail in Spotlight switch in Settings turns it off and deletes what was written. Removed account by account at sign-out
The sender, subject and snippet of new mail	The system's notifications	Only if you allow Dumb to send notifications. They stay until you clear them — see §8
Your inbox count, the senders and arrival times of a few messages in your inbox and in Later, and your upcoming calendar events (title, time and place)	A file shared between the app and its widgets	Protected until the device is first unlocked after starting up, and excluded from backups. Deleted when the last account signs out
The newest 20 messages in your inbox: sender, subject and the first 280 characters	A file (`inbox.json`) in the Apple Watch app's own storage	iPhone only. The phone hands it to your watch through Apple's WatchConnectivity; the watch fetches nothing itself. Replaced as new mail arrives, and emptied when the last account signs out
Your signatures — their text, any picture in them (or the web address of that picture), and the email address each belongs to	The app's preferences on each device, and iCloud key-value storage in your iCloud account	So a signature follows you to your other devices. Only when the device is signed in to iCloud, and held by Apple under iCloud's terms. Kept when you sign out, because another device may still be using it; edit or empty them in Settings → Sending → Signature

Choices worth stating, because they are the substance rather than the promise:

The store is excluded from backups, and so are the search history, the picture cache and the widgets' file. Neither iCloud Backup nor Time Machine picks them up. Without Advanced Data Protection, an iCloud Backup is not end-to-end encrypted, and a backed-up mail store would be a plaintext copy of your mailbox on someone else's server. The app's preferences, which hold your signatures, are backed up like any other app's.
The store is marked protected at rest (.completeUnlessOpen), so the operating system keeps it encrypted while the device is locked.
Refresh tokens and passwords are kept in the Keychain, not in the database, with accessibility WhenUnlockedThisDeviceOnly: they are decryptable only while the screen is unlocked, and they do not travel in an encrypted Keychain backup, so they cannot be restored onto a different device.
Access tokens are never written to disk. They live an hour in memory and are re-minted as needed.
Calendar access is a device permission, not a Google one. It is granted to Dumb by you, on your device, and withdrawn the same way — Settings → Privacy & Security → Calendars. Withdrawing it empties Dumb's copy above; it does not touch your actual calendars.
On the Mac, the app relies on the App Sandbox and on FileVault for at-rest protection of the container; the store file itself is not separately encrypted by the app.

Summaries, on the device

On a device with Apple Intelligence turned on, Dumb can summarise a long conversation in a line, say what a long message is asking of you, and suggest ways to begin a reply. It does this with the language model built into your device's operating system, and the model runs on the device.

Nothing is sent anywhere to make a summary — not to us, not to Apple, not to any other AI service.
Nothing is written down. Summaries are held in memory while the app is open, and are gone when it quits or when you sign out.
The model is not trained on your mail. See §3.
It is on by default where the device supports it, and the Summarise long mail switch in Settings turns it off.

Shortcuts and Siri

Dumb offers actions to Shortcuts and Siri, such as finding mail or checking a pile. They run only when you run them, and what they find is handed to whatever asked — your shortcut, or Siri — on your device. The app keeps nothing from them.

5. Every network connection the app makes

This is the complete list. There are no others.

Your mail provider, on your behalf. Only the provider of an account you have added, and only for that account:

Google
- accounts.google.com — the sign-in and consent page
- oauth2.googleapis.com — exchanging and refreshing tokens, and revoking them when you sign out
- openidconnect.googleapis.com — your name, address and profile photo, asked for again from time to time so that a change you make is picked up
- imap.gmail.com — reading your mail, over IMAP. This connection is also what delivers new mail to a Mac the moment it arrives, without any server of ours being involved
- smtp.gmail.com — sending the mail you write
iCloud Mail — imap.mail.me.com and smtp.mail.me.com
Fastmail — imap.fastmail.com and smtp.fastmail.com
Yahoo — imap.mail.yahoo.com and smtp.mail.yahoo.com
Any other mail server — the IMAP and SMTP servers you enter, or the ones the app suggests from your address (imap. and smtp. followed by your domain) if you accept them

Every one of these connections is encrypted. IMAP is encrypted from the first byte, on every server, and there is no setting that turns that off. SMTP is encrypted from the first byte wherever the server offers it; where a server only offers to upgrade a connection to encryption after it has started — iCloud does this — the app requires the upgrade, and refuses to send anything if the server does not offer it. The app accepts TLS 1.2 or later only, and checks the server's certificate.

Your Google account photo. lh3.googleusercontent.com, Google's copy of the profile photo on your own Google Account, fetched to show it in the app. The request carries no credential and needs none.

Apple, through the operating system:

iCloud key-value storage — your signatures, so they follow you between your devices (§4). Only when the device is signed in to iCloud.
The App Store, through StoreKit — the price of the purchase that lets Dumb hold more than one mailbox, the purchase itself if you make one, and whether your Apple Account has already made it. Payment is handled entirely by Apple; we never see your payment details or your Apple Account.

Not on this list, deliberately: anything for the calendar. Dumb reads and writes your calendar through your device's own Calendar service and makes no network connection of its own to do it. Whatever your device does to keep that calendar in step with Google, iCloud or your employer is your device's business and is governed by that provider's own policy, not by this one.

Four more, worth calling out by name:

Sender marks. To draw a recognisable mark next to a message, the app requests a favicon from www.google.com/s2/favicons for the sender's domain — openai.com, not the individual's address. This tells Google, along with your IP address, which domains appear in your mail. It never sends a full address, a subject or any message content. There is no setting that turns it off; wherever no mark comes back, the app draws the sender's initials instead.
Remote images inside a message, and only if you ask for them. See §7.
Pictures in your own signature. A signature written in another app usually shows its logo by linking to a picture on a website rather than carrying the picture itself. When yours does, Dumb fetches that picture so you can see your signature while you write. The request goes to whichever server hosts the picture — a web address you put there yourself — and carries your IP address, but no cookies and no stored credentials, and it says nothing about any message.
Unsubscribing from a mailing list, and only when you press the button. Bulk mail is required to say how to leave it, in a header — List-Unsubscribe — and the app reads that header rather than guessing at links in the page. Pressing Unsubscribe does one of two things, and never a third: it sends a single POST to the address the sender nominated, carrying nothing but the fixed text RFC 8058 specifies; or, where the sender asked to be emailed instead, it sends an ordinary message from your account, which you will find in your Sent folder. Neither happens straight away: the press is held for a few seconds with nothing on the network, and the receipt on screen carries an Undo for that long, so a press you did not mean tells the sender nothing at all. The request carries no cookies, no stored credentials and no cache. It goes only to an address on the public internet, never to one on your local network; it does not follow a redirect; and the reply is not downloaded or rendered. Where the sender offers only a web page, the app opens it in your browser and does nothing itself. Nothing about this passes through any server of ours.

Each request that goes through is noted locally, so that Settings → Rules → Lists you've left can tell you what you have unsubscribed from. That note never leaves the device, and the link on each row opens the sender's own website in your browser — it is not the unsubscribe address, and pressing it sends nothing.

Nothing else. No analytics endpoint, no crash reporter, no advertising network, no attribution SDK, no feature-flag service, no “anonymous usage statistics”, no AI service. Search runs locally against the on-device store; typing in the search field sends nothing anywhere. Summaries are made on the device.

6. What we, the developer, actually receive

Almost nothing, and none of it from the app:

App Store data from Apple. If you download Dumb from the App Store, Apple may show us aggregate, anonymised statistics (downloads, purchases, sessions, crash counts, and similar) through App Store Connect — and, if you have opted in under Settings → Privacy & Security → Analytics & Improvements → Share With App Developers, crash logs and performance diagnostics collected by iOS or macOS. This is Apple's collection under Apple's privacy policy, configured by you in system settings, not ours. We cannot identify you from it, and it never contains your mail.
Anything you send us directly. If you email privacy@dumb.work or support@dumb.work, we obviously have your message and address, and use them only to answer you. Please do not paste message contents into a support email unless it is necessary to explain the problem.

7. Tracking pixels and remote images

Most marketing email contains images loaded from the sender's own server — frequently a 1×1 transparent pixel whose only job is to tell the sender that you opened the message, when, and roughly where you were.

Dumb blocks all remote content by default. Opening a message fetches nothing from the sender. The app draws mail in one of two ways, and both refuse:

Designed messages are drawn by a web view, which enforces the block with a WebKit content rule list — an allowlist, installed before any markup is handed to it.
Everything else is drawn by the app's own renderer, which has no web engine behind it, and which fetches a picture only once the app's own check says you have allowed it.

You can allow pictures for one message (Show), for everything from one sender's domain (Always from…), or for all mail, with Load remote images in Settings, which is off until you turn it on. Doing any of these is a deliberate act, and it is worth knowing what it means: from that point the sender's server sees a request from your IP address, which is how open-tracking works. The request carries no cookies and no stored credentials. Your per-sender allowances are stored with the account and deleted with it.

8. Deletion, and how complete it is

Signing out of an account:

Revokes the grant at Google, for a Google account, so the credential stops working even where it is not ours to delete. If you are offline, the revocation is queued and retried the next time the app launches; the local teardown happens immediately either way. For any other account there is nothing to revoke: a password stays valid until you revoke it where you made it — for iCloud, at appleid.apple.com.
Deletes the refresh token or password from the Keychain, and closes the account's connections to its mail server.
Deletes the account's mail from the store. How completely depends on whether it was the last account:
- The last account: the store file and its -wal/-shm sidecars are removed from disk — unlinked, not merely emptied. A SQLite DELETE leaves freed pages legible in the raw file; removing the file is what closes that window.
- One of several: the file is still in use by the others, so the account's rows are deleted inside it, with SQLite's secure_delete on, which overwrites what they occupied with zeros. SQLite writes those zeros to its journal first and into the file itself at its next checkpoint, which it makes on its own as the app is used.
Removes the account's messages from Spotlight.
Empties the attachment folders, the picture cache and any summaries in memory — for every account, since none of them is filed by account.
When it is the last account, also deletes the widgets' file and sends your Apple Watch an empty inbox.

What signing out does not remove, so that you can:

Your signatures, which are filed under your email address and shared with your other devices through iCloud; removing them on one device would remove them from a device still signed in. Empty them in Settings → Sending → Signature.
Your recent searches. Use Clear recent searches on the search page.
Notifications already delivered. Clear them in Notification Centre.
The watch's copy, if the phone cannot reach the watch app at the moment you sign out. It is replaced the next time the phone reaches it.

For a Google account, you can confirm step 1 yourself at https://myaccount.google.com/permissions — Dumb should no longer be listed.

Deleting the app removes its container, and with it everything in the first table in §4 except what is in the Keychain. The operating system keeps an app's Keychain items after the app is deleted, where nothing but Dumb itself, reinstalled, can read them. Deleting the app also revokes nothing at Google. So the thorough way to leave is to sign out of each account first, then delete the app. Your signatures stay in your iCloud account either way, for your other devices.

Deleting the mail itself is a matter for your provider, not for us. Nothing you delete from your mailbox can survive in Dumb once it has synced, and nothing you delete in Dumb reaches back into your mailbox beyond the move to the Bin you asked for.

9. Retention

For as long as the app holds it on your devices, and not one moment longer. There is no server-side copy to expire, and no retention schedule to publish, because we hold nothing to retain.

10. Your rights

Under the GDPR, UK GDPR, CCPA/CPRA and comparable laws you have rights of access, correction, deletion, portability and objection. In Dumb's case these resolve unusually simply:

Against us: we hold no personal data about you, so there is nothing to access, export or erase. Write to privacy@dumb.work and we will confirm that in writing.
On your devices: exercise deletion directly, per §8.
Against your mail provider: your mail and profile are held by whoever provides your email — for Google, use https://myaccount.google.com/ and see the Google Privacy Policy; for iCloud, see Apple's privacy policy; for anyone else, their own.
For your calendar: the events Dumb shows belong to whichever account supplies them on your device — Google, iCloud, your employer. Manage them with that provider, and manage Dumb's access to them in your device's Settings.

We do not sell or share personal information, as those terms are defined under the CCPA/CPRA. We never have and the app has no mechanism to.

Where we do process the little described in §6, the legal basis is our legitimate interest in maintaining and supporting the app (GDPR Art. 6(1)(f)), or, for support correspondence, performance of your request (Art. 6(1)(b)).

If you believe we have handled your data improperly, you may complain to your national supervisory authority.

11. International transfers

Dumb transfers nothing to us, anywhere. Your device talks directly to your mail provider's servers, and where those servers process your data is governed by your agreement with that provider. Signatures kept in iCloud are held by Apple under your agreement with Apple.

12. Children

Dumb is not directed at children. It requires an email account, and your email provider's own minimum-age rules apply. Do not use the app if you are under 13, or under the minimum age of digital consent where you live (up to 16 in parts of the EU). We knowingly collect nothing from anyone, children included.

13. Security

The measures in §4 are the substance of it: least-privilege OAuth scopes, tokens and passwords in the Keychain and never in the database, the store excluded from backup and marked protected at rest, remote content blocked by default, encryption with TLS 1.2 or later on every connection, and a revocation on sign-out rather than a mere local delete wherever the provider allows one.

No system is perfect, and a client-side app is only as private as the device it runs on. Use a passcode, keep the OS updated, and turn on Advanced Data Protection if you use iCloud Backup for anything at all.

14. Apple “Privacy Nutrition Label” summary

For the App Store's data-collection questionnaire, Dumb's answer is Data Not Collected in every category. The app collects no data, links no data to your identity, and uses no data to track you across apps or websites owned by other companies.

15. Changes

Version 1.3 — 17 September 2026. Nothing about what Dumb does with your data changed. Version 1.2 described less than the app does, and in a few places said something the app does not do. This version corrects that:

§5 adds the unsubscribe paragraph, and §4 its row. They were written for version 1.2 but missing from the page published on 1 September, though the app could already unsubscribe from a mailing list that day. Version 1.2 also called its list "two exceptions" and then listed three.
§2 lists every library in the app. It named only GRDB. The app also includes the libraries it uses to speak IMAP and SMTP, all from Apple's open-source projects.
§3 and §5 describe accounts other than Google — iCloud Mail, Fastmail, Yahoo and any IMAP server — which version 1.2 did not mention.
§5 lists every host. Added: those mail servers; Google's host for your account photo; iCloud key-value storage, which carries your signatures; the App Store; and pictures linked from your own signature. It also corrects §3's statement that no request is made for your name and photo after sign-in, and §5's suggestion that sender marks can be turned off — they cannot.
§4 lists every copy kept outside the store — Spotlight, notifications, widgets, the Apple Watch, signatures in iCloud — as well as the search history and the picture cache, and describes the summaries made on your device. Version 1.2 said everything was in the store file and the Keychain, and put signatures in the store file.
§7 describes both renderers correctly. Only the web view uses a WebKit content rule list; the app's own renderer checks in its own code.
§8 says what sign-out actually removes. The store file is removed only when the last account signs out; otherwise the account's rows are deleted inside it. It now also lists what sign-out leaves behind, and says that deleting the app leaves its Keychain items.

Version 1.2 — 1 September 2026. Dumb stopped asking Google for calendar access. Three things changed, and all three are in this document:

The permission list in §3 is three scopes where it was four. calendar.readonly is gone and nothing replaces it.
The calendar screen now reads the calendars already on your device, through the operating system, and can create, change and delete events — which the old read-only permission did not allow. §3 says what that means.
www.googleapis.com/calendar/v3 is gone from §5. The app makes no network connection of its own for the calendar at all.

Version 1.1 — 27 August 2026. Dumb moved from Gmail's REST API to the IMAP and SMTP protocols. Three things changed as a result, and all three are in this document rather than only in the app:

The permission Dumb asks for is now https://mail.google.com/ instead of gmail.modify. That permission is wider, and §3 says exactly how, why, and what Dumb does and does not do with it.
The app connects to imap.gmail.com and smtp.gmail.com instead of gmail.googleapis.com. §5 is the complete list, as before.
Nothing about where your mail is stored changed, and nothing about who can read it changed. There is still no server, still no analytics, and still nothing that leaves your device.

If this policy changes materially, the new version will be published at https://www.dumb.work/privacy with a new effective date, and — where the change affects how your data is handled — surfaced in the app or in the App Store release notes. Continuing to use Dumb after a change means you accept it.

16. Contact

privacy@dumb.work — privacy questions, data requests, and anything in this document you think is wrong. If that address bounces, write to hello@s25.studio.

S25 Studio Pty Ltd, Suite 1501, Level 15, 9–13 Castlereagh Street, Sydney NSW 2000, Australia.

Dumb is an independent application. It is not affiliated with, endorsed by, or sponsored by Google LLC, Apple Inc. or any other email provider. Gmail, Google Calendar and Google are trademarks of Google LLC; Apple, iCloud, iPhone, iPad, Mac, Apple Watch and Apple Vision Pro are trademarks of Apple Inc.; other names are trademarks of their respective owners.