Skip to content

Privacy and data

Rowsend keeps your data on your computer. This page explains how, in more technical detail than the privacy policy, which is what Rowsend commits to.

On your computer

Section titled “On your computer”
  • Contacts. A copy of the users Rowsend syncs from your database. It can always be rebuilt from your database.
  • Campaigns, templates, segments, topics and your brand.
  • Credentials. Your database login and email provider keys, encrypted with your system keychain. They never go into plain settings or logs, and AI agents connected over MCP never see them.
  • Unsubscribes, bounces and complaints, pulled from the companion.

None of this is sent to Rowsend.

What reaches Rowsend

Section titled “What reaches Rowsend”

For the trial and your license, the app checks in when it starts and about every six hours after. Rowsend’s servers get:

  • a random id the app creates for your computer, stored only as a one-way hash;
  • a one-way hash of the hardware id, so reinstalling doesn’t restart the trial (the hardware id itself never leaves your computer);
  • your license key when you activate one, with a name for the activation taken from your computer’s name. The key goes to Dodo Payments to activate; Rowsend keeps a hash of it and Dodo’s license id.

Rowsend publishes its releases on GitHub. To check for updates, the app asks GitHub for the latest version when it starts and about every six hours. GitHub sees your IP address, as it does for any download. The request carries nothing else about you or your data.

That’s all, unless you use Rowsend Cloud.

The companion

Section titled “The companion”

The companion sends your email and records what recipients do. Wherever it runs, it holds:

  • each recipient’s address and message until it’s handed to your provider
  • unsubscribes, bounces and complaints
  • images you upload

On your computer or your own server, that stays with you. On Rowsend Cloud, Rowsend stores it for you.

What Cloud keeps

Section titled “What Cloud keeps”
  • Your account: your email, plus name and picture from GitHub or Google. Sign-in sessions last at most a day. Each connected computer gets a token, stored only as a hash. Cloud doesn’t keep the access tokens GitHub or Google issue.
  • Sending: a message is deleted once it’s handed to your email provider. The recipient’s address, delivery status and the provider’s message id stay 30 days, so late bounces still match.
  • Unsubscribes, bounces and complaints, undone unsubscribes from the preferences page, your topics’ names, and your uploaded images and their file names: until you delete the project or the account.
  • Usage: emails sent and image storage per month, for fair use.

Credentials. Your email provider credentials are held in Cloud’s memory only while your computer is sending, and for about 30 seconds after, and never written to disk. The exception is a project where you turn on sending while your computer is off: Cloud then stores that project’s credentials encrypted with a key unique to the project, which is itself encrypted with a key only Cloud’s server holds. Turning it off, signing out or leaving Cloud deletes them.

Backups. Cloud’s database is backed up continuously, with daily snapshots kept for 7 days.

Your recipients

Section titled “Your recipients”

You’re responsible for having permission to email the people in your database. Rowsend helps you keep it: every campaign has an unsubscribe line and your mailing address, bounces and complaints stop further email, and contacts only come from your own users. See Mailing address and footer tags.

Rowsend doesn’t track opens or clicks.