Prefer provider OAuth when it is available
OAuth sends authentication through the provider and gives the app a scoped, revocable token. It avoids placing the provider password into the email client's own sign-in form.
Review the permissions shown by Google or Microsoft. A full mail client legitimately needs permission to read, send, and organize mail, but the consent screen should match the features the app explains publicly.
Ask where tokens and passwords are stored
On macOS, Keychain is the expected system facility for secrets such as OAuth tokens, app passwords, SMTP passwords, and API keys. Plaintext configuration files or readable preference values create unnecessary exposure.
Unibox uses macOS Keychain for Google and Microsoft tokens, Yahoo app passwords, generic mail credentials, optional OpenAI keys, and sensitive subscription access state.
Separate local cache from a server-side mailbox copy
A desktop client normally caches some message information locally so switching accounts, searching, and reopening recent mail do not always start from zero. That local cache is different from uploading an entire mailbox to the app vendor's server.
Look for a clear explanation of cache location, size limits, account removal, and whether the vendor operates a central message store. Unibox keeps a bounded working cache on the Mac; its subscription service does not store mailbox content.
Treat AI as a separate data flow
AI summaries and reply drafting require sending some text to an AI provider. A trustworthy product should say whether AI is optional, what triggers a request, where the API key is stored, and whether attachments are included.
In Unibox, AI is off by default and uses the user's own OpenAI API key. Message text is sent only for an invoked action or enabled limited triage, and attachments are excluded.
Verify revocation, updates, and support
You should be able to disconnect an account locally and revoke OAuth access at the provider. Signed, notarized software and an update mechanism reduce the risk of running an outdated build. A public support and security contact gives users a path to report problems.
- Confirm the installer is signed and notarized for macOS.
- Confirm the app checks for authenticated updates.
- Locate the account-removal and provider-revocation instructions.
- Find a public privacy policy and security contact before connecting important mail.
Reject absolute guarantees
No email client can guarantee that an account will never be hacked. Security also depends on the Mac login, provider password, multi-factor authentication, device updates, attachments, extensions, and user decisions. Prefer concrete safeguards and disclosed boundaries over claims of perfect protection.
Questions about this workflow
Is OAuth automatically safe?
OAuth reduces password exposure and provides revocable access, but users should still review requested permissions, protect the provider account, and revoke apps they no longer use.
Does a local email cache mean the vendor stores my mailbox?
Not necessarily. A local cache on your Mac is distinct from a vendor-operated server archive. The privacy policy should explain both clearly.
Can AI features be private?
AI still requires a defined data flow to the AI provider. Privacy improves when AI is optional, requests are user-controlled, keys are protected, content is minimized, and attachments are excluded unless explicitly needed.
Sources and further reading
Provider behavior and security guidance in this article is grounded in primary documentation: