What leaves your computer

Tundra keeps your mail and calendar in a database on your own disk. Some things still have to leave: your mail travels to and from your provider, and a few small requests go out on their own. This page lists every one of them, taken from the code and checked again for each release, and shows how to confirm it on your own machine.

What leaves

Your mail and calendar go directly to Google, Microsoft, or your own IMAP, SMTP and CalDAV servers. There is no Tundra server in between, and no Tundra account to sign in to. Gmail and Outlook sign-in happens in your browser, and the answer comes back to a listener on your own computer.

Remote images load from the sender's image server when you open or hover a message, and the request comes from your own connection, so the sender can tell the message was opened. Tundra tries to skip images that look like tracking pixels, but it cannot catch them all, and some can load the first time you open a message. To stop all of it, switch on Settings → Mail → Block all remote images; you can still load pictures for one message or one sender.

AI requests go to the provider you chose, for the jobs you assign it. With LM Studio or Ollama on your own machine they stay on your machine. If you sign in with your ChatGPT account instead of using a key, the sign-in happens in your browser at auth.openai.com and the requests go to OpenAI's ChatGPT service at chatgpt.com. AI features stay off until you turn them on, during first-run setup or in Settings. Once AI is on, the default Balanced mode runs some light features in the background, such as thread summaries, learning your writing style from mail you send and checking your You owe list; you can switch each one off in Settings → AI & Automations.

Tundra checks GitHub for a new release at launch and every four hours. An update downloads and installs only when you click.

The public model price list comes from models.dev at launch and every hour, even with AI off. It is a plain download and carries nothing from your mailbox.

When you open the list of account types to add, or when Settings shows a Gmail account that needs reconnecting, Tundra reads a small file on GitHub (at most once every 10 minutes) that says whether its built-in Google sign-in is available.

To notice when your connection drops, Tundra looks up the name dns.google through your own network's DNS resolver: every 10 seconds on Windows and Linux, and after your Mac wakes. No connection is made to Google and nothing is sent.

Some requests happen only because you asked for them. One-click Unsubscribe sends a request to the mailing list's server. While you add an IMAP account, Tundra looks up its server settings at your provider's own autoconfig address, at autoconfig.thunderbird.net, and in your domain's mail (MX) records. When an AI task needs to read a web page, the request goes to that page's website or, if you added a Tavily key, to Tavily, which fetches the page for you. Installing a skill from GitHub downloads it from the repository you name, through api.github.com and raw.githubusercontent.com. Web search, MCP servers and calendar subscriptions go wherever you point them. Dictation stays on your computer with Apple's on-device speech on macOS; otherwise the recording goes to a speech-to-text model at one of your AI providers or to a transcription server you set up. Command-line AI agents you start in Tundra's Terminal send what they read to their own providers.

What stays

Your mail database stays on your disk: one SQLite database per profile, with its caches, in ~/.tundra-mail on macOS, %LOCALAPPDATA%\Tundra Mail on Windows and ~/.local/share/tundra-mail on Linux.

Your keys and tokens stay in the operating system's keychain, never in the database.

Nobody counts how you use Tundra. There are no analytics and no crash reporter. Remote images, described above, are the one way a sender can learn something about your reading.

The mail you send carries no tracking pixels, no read receipts and no "Sent with Tundra" line.

Your snippets, rules, notes and Journal live in the same local database.

Check it yourself

Start in Settings. Settings → AI & Automations shows whether AI features are on. Settings → Models lists every AI provider Tundra can talk to, and an empty list means none. Settings → Mail has Block all remote images, and Allow tracking pixels, which is off unless you switch it on.

Open the Journal (press ⌘K and type "journal"). It lists every change you or the agent made, with an undo where one exists, and changes that arrived from your provider appear as rows of their own. The Journal records actions, so use it to see what changed in your mail. For network traffic, use a firewall.

An outbound firewall shows each connection an app makes, by host name. On macOS, Little Snitch and LuLu do this; on Linux, OpenSnitch; on Windows, the firewall's outbound rules or a monitor built on them. Run Tundra for a day and you should see your mail provider, api.github.com, models.dev, raw.githubusercontent.com when you add an account, image hosts when you open mail with pictures, and your AI provider or localhost if you set one up (auth.openai.com and chatgpt.com if you signed in with ChatGPT). Tundra carries a built-in copy of the price list, so blocking models.dev does not stop AI features. Blocking the GitHub update check is also safe: Tundra keeps working and simply does not tell you about new versions. Neither check has an off switch in Settings yet.

To see where your passwords are, open Keychain Access on macOS and search for tundra-mail. On Windows, look in Credential Manager; on Linux, in your keyring app, such as Seahorse.

Your database is an ordinary SQLite file, data.db, in the folder above. Close Tundra, copy the file, and open the copy with any SQLite browser to see exactly what is stored.

To check what recipients receive, send yourself a message from Tundra and open it in another mail app's "show original" view. There is no tracking image, no X-Mailer header and no footer.

When this page changes

We re-read the code for this list before each release. When a release adds a connection, this page and the release notes say so. Questions go to info@tundra-mail.com.