Roost has no server. Your mail travels between your Mac and your mail provider, and nowhere else. Below is every other host the app connects to, when, and what it sends. You don’t have to take our word for it: the last section shows how to watch the connections yourself.
Your mail
Reading, sending, flags and drafts all go to your own provider over IMAP and SMTP, always encrypted (TLS). Roost never sends a password in the clear. Each inbox has its own pair of servers, for example:
imap.gmail.comandsmtp.gmail.comfor Gmail and Google Workspaceimap.mail.me.comandsmtp.mail.me.comfor iCloudimap.yandex.com,imap.zoho.com,imap.mail.yahoo.com,imap.aol.comand their SMTP twins- whatever server your own domain uses. Settings (⌘,) shows it under each inbox.
When it signs in, Roost tells the mail server its own name and version (the IMAP ID command; some providers, such as 163.com, refuse mail apps that don’t). Nothing about you or your Mac goes with it.
Signing in
Where a provider has its own sign-in, you type your password on their page, not in Roost. Roost gets a token back and keeps it in your Mac’s Keychain.
accounts.google.com,oauth2.googleapis.com: Google sign-in.api.login.yahoo.com: Yahoo sign-in.accounts.zoho.com(or your data centre’s, such asaccounts.zoho.eu): Zoho sign-in.oauth.yandex.com, andlogin.yandex.ruonce, to read which address you signed in with.roostmail.app/oauth: Yahoo, Zoho and Yandex only send you back to a web address, so their sign-in page lands on a small page here that hands the result to the app. It’s a static page; it stores nothing. The code it passes along is useless without a secret that never leaves your Mac (PKCE).
Adding an address Roost doesn’t know
To find the server settings for an unfamiliar domain, Roost looks up the domain’s mail servers through your Mac’s normal DNS, then asks autoconfig.yourdomain.com and Mozilla’s public Thunderbird list at autoconfig.thunderbird.net. Only the domain is sent, never your address or password.
Your licence
api.polar.sh, the licence service of Polar, our merchant of record. When you enter a key, Roost sends the key and your Mac’s name (so you can tell your Macs apart). After that it checks the key about once a week. The 14-day trial makes no connection at all.
Updates
roostmail.app/appcast.xml about once a day, to see if there’s a new version (through Sparkle, the updater most Mac apps outside the App Store use). When you install one, the signed download comes from roostmail.app too.
Company icons in the notch
When a sign-in code or mail from a company drops out of the notch, Roost shows that company’s icon. It asks the company’s own website: the home page at the address’s domain (polar.sh for mail from notifications.polar.sh), then the icon that page names, which may sit on the company’s own image host. That happens the first time the company writes, then at most once a month. The icon is kept on your Mac.
The request carries no cookies and nothing about you or the letter. Like any website, the company’s server sees your IP address. No other service is asked, so nobody else learns who writes to you.
Free mailboxes such as Gmail or iCloud get no icon, and neither does mail that DKIM or DMARC can’t prove came from its sender, so a fake “bank” never shows a bank’s logo. Turn icons off in Settings › Notch.
People in your Contacts show their photo instead. Roost reads it from the Contacts app on your Mac, once you allow it, and sends nothing.
Only when you ask
- Load images. Images in a letter come from the sender’s servers, which then know you opened it. That’s why they stay blocked until you click Load images (or turn on “Load images in all mail” in Settings).
- Unsubscribe. If a newsletter offers one-click unsubscribe, Roost sends that one request to the sender’s own link, with no cookies or saved logins attached. Otherwise it sends an email through your own provider, or opens the page in your browser.
- Links. A link in a letter opens in your browser. Roost doesn’t fetch it first.
What Roost never does
No analytics, no crash reports, no Roost account, and no copy of your mail on any server of ours. We don’t have one to put it on.
Suggested replies are written by Apple Intelligence on your Mac (macOS 26). The letter isn’t sent anywhere to write them, and you can turn them off in Settings.
Check it yourself
- Little Snitch or the free LuLu (from Objective-See) shows every connection Roost makes and lets you block any of them.
- In Terminal, with Roost open:
lsof -nP -i -a -c Roostlists its open connections right now.nettop -p $(pgrep -x Roost)keeps a live view. - macOS checks the app’s signature with Apple the first time you open it (Roost is signed and notarised). That check is macOS’s own, for every app, not something Roost does.
If you ever see Roost talk to a host that isn’t on this page, write to [email protected]. That would be a bug, and we’d want to know.