mailkit is a local Mac CLI. It is not a hosted mail service.

​
What mailkit stores

  • Gmail: a Google OAuth refresh token in your macOS login Keychain, plus which Google client minted it.
  • Outlook: a Microsoft OAuth refresh token in Keychain. Microsoft issues a new one on every refresh, so mailkit replaces the stored one each time.
  • Fastmail: an API token in Keychain.
  • Proton Mail: the Bridge mailbox password and a pinned Bridge TLS fingerprint in Keychain.
Access tokens are not saved. Each Gmail and Outlook call mints a short-lived one. Everything above stays on this Mac. mailkit talks only to your mail provider — Google, Microsoft, Fastmail, or Proton Mail Bridge on this machine. mailkit does not run a mail server. Message bodies are not sent to getman.ai.

​
What mailkit asks Google for

Read, organize, draft, send, and Gmail filters. Send still needs --yes and a human yes. There is no permanent delete.

​
What mailkit asks Microsoft for

Mail.ReadWrite, Mail.Send, User.Read, and offline_access. Read, organize, draft, and send. Send still needs --yes and a human yes. There is no permanent delete.

​
What mailkit does not do

  • Ads, resale, or credit scoring from your mail
  • Third-party analytics on mail bodies
  • Humans at mailkit reading your mail (this is software you run)

​
Revoke

mailkit auth remove you@gmail.com
Also remove mailkit at Google Account permissions, or for Outlook at Microsoft account apps (work accounts: ask your IT admin).