FairEmail is an open-source (GPLv3), privacy-oriented Android email client (IMAP/POP3/SMTP, OpenPGP and S/MIME) developed since 2018 by Marcel Bokhorst and provided by his Dutch company FairCode B.V. (KvK 84355468, Dordrecht), distributed via Google Play, GitHub releases and F-Droid. Its privacy policy states that, apart from opt-in error reporting (since removed from the app per the FAQ), the app sends no data to the developer, that account and message data go only to the user's own email provider, that all data is stored on the device (default 30-day retention) and never sold, shared, profiled or used for advertising or AI training, and it publishes a complete table of the optional third-party services (DeepL, OpenAI, Gemini, VirusTotal, spam blocklists, Gravatar, etc.) that are all off by default. Caveats: OAuth sign-in for Gmail/Outlook necessarily runs through those providers and is unavailable in the F-Droid build; the Play version includes Google Play Billing whose logging endpoint the developer notes Google does not disclose; the project is effectively a single-maintainer effort funded by Pro-feature purchases and donations with no third-party audit; and in May 2022 Google's automated enforcement flagged the app as spyware over privacy-policy disclosures, the developer briefly pulled all his apps from Play, then rewrote the policy and returned. No breach or regulatory action involving FairEmail was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
[2024-06-02] · COLLECTION
FairEmail's privacy policy (last updated June 2, 2024) states that, except for error reports which are disabled by default, the app sends no data to the developer; that account information and message data are sent nowhere other than the user's own email provider; that data stored on the device is never sold, shared, profiled or used for advertising or AI training; and that stored personal data (names, addresses, messages, attachments) is retained on-device for 30 days by default and can be deleted by the user.
The Google Play listing's developer-provided Data safety section (app updated Jul 6, 2026, publisher FairCode B.V.) declares no data shared with third parties, that the app may collect 'Personal info, Messages and 4 others', that data is encrypted in transit and that data can't be deleted — the last reflecting that data lives on the device rather than a developer server, as the privacy policy explains.
The F-Droid listing for FairEmail (v1.2328, added Aug 10, 2026) shows no anti-feature flags and lists the build's permissions — network access, foreground services, find accounts on the device, read contacts, read and modify calendar events, read shared storage, run at startup, exact alarms, biometrics and wake lock — a broader but feature-explainable set (address auto-complete, calendar invitations, attachments, push sync) than a minimal client; F-Droid notes OAuth was not approved for its build.
FairEmail's funding is disclosed qualitatively on its Pro/donate page: convenience 'pro features' are unlocked by a Google Play purchase in the Play build or by a direct donation of €0.10 or more (PayPal, bank transfer, Bitcoin, Monero) for other builds; the developer states development took more than 8,000 hours and asks for at least €7. No investors, grants or revenue figures are published.
FairEmail's full source code is published under the GNU General Public License version 3, so anyone can inspect, build or fork the shipping application rather than relying on the developer's description of it.
Privacy Guides lists FairEmail as its Android recommendation on the email-clients page, whose minimum criteria require that apps for open-source operating systems be open source, that they not collect telemetry or offer an easy way to disable all of it, and that they support OpenPGP message encryption.
FairCode's company site identifies the provider of FairEmail (and NetGuard) as FairCode B.V., a Dutch private company registered under KvK number 84355468 with VAT number 863181417B01 at Van Doesburg-erf 194, Dordrecht, copyright Marcel Bokhorst (M66B); the FairEmail privacy policy names FairCode BV as data controller represented by managing director Marcel Bokhorst, who is also its data protection officer.
FairEmail's FAQ explains that OAuth sign-in for Gmail, Outlook/Office 365, Yahoo, Mail.ru and Yandex is handled via the quick-setup wizard through those providers' authorisation infrastructure, that Google approved OAuth for the official (Play/GitHub) builds only, and that OAuth is therefore unavailable in third-party builds such as F-Droid's — a dependency on provider identity systems and on Google's approval for the main login path.
FairEmail's product page states there is no data storage on third-party servers, no advertisements, and no analytics or tracking, with an optional Android backup — describing an architecture in which the developer holds no user dataset that could be shared.
FairEmail's privacy policy publishes a complete table of every service that can receive data and when: the user's email server (credentials, messages), Mozilla autoconfig (email domain during quick setup), and optional services all disabled by default — ipinfo.io, Spamhaus/Spamcop/Barracuda blocklists, DeepL, LanguageTool, VirusTotal, OpenAI, Google Gemini, Gravatar/Libravatar (GitHub build only), Have I Been Pwned, BIMI/favicons, and Google Play Billing (Play build), whose logging endpoint firebaselogging.googleapis.com the developer notes Google does not disclose. It states all sub-processors are disabled by default and data is sent only if explicitly enabled by the user.
Android Police reported on May 20, 2022 that Google's automated Play Store enforcement flagged FairEmail (500,000+ Play installs) as spyware — reportedly over contact/email-address handling in optional favicon and Gravatar/Libravatar features not covered by the then-current privacy policy — and that the developer, unable to get specifics from Google, pulled all his open-source apps from Play and announced he was quitting.
Android Police's May 25, 2022 follow-up reported that after a phone call Google clarified the issue was inadequate privacy-policy disclosure of which personal data could be sent to which servers and when; the developer rewrote the policy with those details, resubmitted the app to Play and GitHub, and stated the project would continue given community support.
F-Droid builds and signs FairEmail from the published source tarball for each version, giving independent build-from-source verification of the distributed binary; the app has been in public development since 2018. No third-party security audit, transparency report, bug bounty, breach or regulatory action involving FairEmail was found in this research.
FairEmail's FAQ states that automatic recognition of tracking images (web beacons) is on by default and can be disabled in the privacy settings, and that the app's only crash/error-reporting component — opt-in Bugsnag reporting with a random user ID and Bugsnag telemetry always disabled — was removed entirely in version 1.2273.
FairEmail's Google Play store description (mirroring the project README) states the app has no advertisements, no analytics and no tracking (with error reporting via Bugsnag described as opt-in), no Firebase Cloud Messaging and no data storage on third-party servers, and lists client-side anti-tracking features: confirming before showing images to prevent tracking, confirming before opening links, attempting to recognise and disable tracking images, and reformatting messages to prevent phishing.