Transparency
Every connection 1B Mail makes
1B Mail isn't open source, so here is the next best thing: a complete list of what it connects to, when, and what it sends — checked in the source code, not written from memory.
Checked in the source code of 1B Mail 0.4.0 for Windows and Linux and 1B Mail 0.2.5 / 0.2.6 for Android, on 29 October 2026.
The full list
Most of these happen only when you do something. The only regular ones are your own mail servers and, on Windows and Linux, a daily update check you can turn off.
Your mail servers
Always, while you use 1B Mail. On Android, every 15 minutes in the background, or instantly if you turn on Instant mail.
1B Mail talks IMAP and SMTP straight to your provider's servers — Gmail, Outlook.com, Yahoo, your company — over TLS. Nothing passes through 1Byte. Messages sent from Windows and Linux carry the header “X-Mailer: 1B Mail”, and on Android the app tells IMAP servers that ask its name and a version number.
Your provider's IMAP and SMTP servers (ports 993, 465, 587)Finding your server settings
Only when you add an account.
First, a built-in list of about 20 large providers: no request at all. Otherwise: DNS lookups (MX, SRV, TXT, CNAME) through your system's resolver; Mozilla's public provider database, which receives only your domain; your provider's own autoconfig file, which receives your full email address; and Microsoft's sign-in service with a placeholder address (x@your-domain), never yours. On Android, the provider's autoconfig file may also be requested over plain HTTP, and if nothing answers, the app opens test connections, without any password, to imap., mail. and smtp. of your domain.
autoconfig.thunderbird.net · autoconfig.(your domain) · login.microsoftonline.comSigning in with Microsoft or Google
Only if you choose to sign in this way.
Sign-in happens in your browser (on Android, Google uses Google Play services). The tokens go straight from Microsoft or Google to your device and are stored there. 1Byte never sees them.
login.microsoftonline.com · accounts.google.com · oauth2.googleapis.comUpdate check (Windows and Linux)
45 seconds after start and then once a day, if automatic updates are on (the default), or when you press Check.
A plain request for a small signed file, with “1BMail/0.3.8” as the user agent and nothing else. Packages are downloaded only when you choose to install, and their size and SHA-256 are checked against an Ed25519 signature. The Microsoft Store version doesn't check. On Android, updates come only from Google Play.
1bytesystems.com/mail/updates/v3/stable.json1Byte Account: encrypted sync and Pro
Only if you turn on sync or activate Pro with your account.
Sync uploads your account settings (addresses, server names, user names, signatures), labels and sidebar order, encrypted on your device with AES-256-GCM and a key made from a phrase only you know. Never passwords, sign-in tokens or any email. Activating Pro sends the device name, platform and app version; after that, a licence check at most once a week.
api.1bytesystems.comRemote images
Only after you press Show images, or for senders you trust.
Images are downloaded straight from the sender's server to your device: no proxy, no cookies, no referrer. Tracking pixels are removed and never loaded, even after Show. Android also has a setting to always load images; it is off by default.
The sender's image serversMoving accounts with a QR code
Only while the QR code is on screen (up to 10 minutes).
Your phone connects to your computer over your own network. Everything is encrypted (ECDH P-256 and AES-256-GCM), and both screens show a 6-digit code to compare. Passwords travel only if you choose so; Microsoft and Google sign-ins never do.
Your local network onlyOne-click unsubscribe
Only when you press Unsubscribe.
1B Mail sends the standard one-click unsubscribe request (RFC 8058) straight from your device to the sender of the newsletter.
The sender's unsubscribe addressWindows installer
Only while installing, and only if WebView2 is missing.
The installer downloads Microsoft's WebView2 runtime, which 1B Mail uses to draw its window. Most Windows 10 and 11 computers already have it.
Microsoft (WebView2)
What 1B Mail never does
- No analytics, no telemetry and no crash reporting: neither app includes Firebase Analytics, Crashlytics, Sentry or anything like them. Crash details stay in a file on your computer.
- No server of ours reads, stores or relays your email.
- No advertising or tracking libraries.
- No push notification service: Android checks your mail itself.
- No AI service ever sees your messages.
- No avatars, Gravatar, website icons or link previews are downloaded.
Check it yourself
Don't take our word for it. These tools show every connection a program makes.
Linux
OpenSnitch asks you about every new connection, program by program.
Windows
Resource Monitor (Network tab) or TCPView list 1B Mail's live connections, and Windows Defender Firewall can block any of them.
Android
A local firewall such as NetGuard or RethinkDNS logs every connection, app by app.
Things your operating system does on its own — such as WebView2 updates on Windows or Google Play services on Android — are outside 1B Mail. If you find a connection that isn't on this page, tell us at 1bytesystems@gmail.com and we will fix the page or the app. Privacy policy
Questions
Is 1B Mail open source?
No. That's why we publish this list, checked against the source code, and point you to tools that let you verify it on your own computer.
Why does setup send my address to my provider's autoconfig server?
It's the standard way providers publish their settings — the same method Thunderbird uses. It goes only to your own provider's domain, and only when you add an account. Mozilla's database receives only the domain.
Can I use 1B Mail with no connection to 1Byte at all?
Yes. Turn off automatic updates in the settings and don't use sync or account activation. Then 1B Mail only talks to your mail provider and, if you choose, to Microsoft or Google for sign-in.
What does the update check reveal?
Your IP address and the app version, as with any request to a website. No account, device ID or anything else is sent.
Try it yourself
Download 1B Mail for Windows or Linux, or get it on Google Play for Android.