Saying that none of the "email data" is stored on your servers is a common way mail clients deflect from the real truth that people are interested in. Our email data traverses through your servers and is stored in memory is it not?

Additionally you have our access tokens correct? With those you have effective access to all of our email data. They are effectively a password. Worse actually since they bypass 2FA. If you leak those on accident or decide to use one from your home PC, you have access to all of our email data.

The statement "None of this email data is stored on DarwinMail's servers" remains technically true, but does not address the real scope security issue most users are worried about.

DarwinMail looks amazing and I'd love to use it, but until these questions above are answered or obviated via open-sourcing it, I don't think many users will be comfortable. My company admin policy explicitly denies your app for these reasons by the way:

"Error: admin_policy_enforced

Access to your account data is restricted by policies within your organization. Please contact administrator for more information."