Where Your Mail Lives
What PressedMail stores in your WordPress database, how credentials are protected, and exactly what leaves the server.
PressedMail is a client, not a service. Your mail moves between your WordPress server and your provider, and the copy it keeps is a copy in your own database. Here is what that copy contains.
What gets mirrored
The message table holds what a mail list needs: sender name and address, recipients, subject, date, message and thread identifiers, read, starred, answered, draft, deleted and important flags, a short preview, attachment metadata, and label references. Not the message body.
Bodies live in a separate cache table, and that one is a preference. Cache email content is on by default per user, and each of you can turn it off and clear what is already stored. A host or site owner can force it off for everyone with a filter, no matter what individual users have chosen. Turn it off and reading a message fetches it live from IMAP each time.
Credentials
Account passwords and OAuth tokens are stored under AES-256-GCM in an authenticated envelope. The key is not your WordPress salt: it is derived by HMAC-SHA256 from a 32-byte random secret generated on your site at first use, and each purpose gets its own derived key, so the credential key and the image-proxy signing key are unrelated.
Decryption goes through one gatekeeper, every time. It requires you to be signed in, to be the user who owns the account, to have an unlocked mailbox if you use the lock, and to not be a switched-in session. Background sync is the single exception, and it runs in a context bound to exactly one account owner, writing only into that owner's mirror.
One user, one mailbox
An account belongs to the WordPress user who connected it. Cross-user access is refused outright, whatever the role. An administrator does not inherit a mailbox by being an administrator.
The audit log
Paid plans keep 365 days of connection, send and settings activity. Without a licence retention is zero, which means nothing is recorded at all rather than recorded and pruned.
Before any entry is written, metadata keys are matched against a pattern covering passwords, secrets, tokens, API keys, licence keys, prompts, raw values, headers, authorisation and OAuth material, plus message bodies and HTML. Matches are dropped. Secrets cannot end up in the log because they never get as far as the insert.
What actually leaves the server
Five things, and nothing else:
- Your provider. IMAP and SMTP, directly from your server. This is the mail itself.
- Licence checks to
curb.software. The payload is the action, licence key, product slug, site identifier, plugin version, site and home URL, WordPress version and PHP version. No mail, no addresses, no message content. - The Microsoft sign-in relay, only if you use it. Site URL, callback URL, a nonce, a one-time transfer code, and later the refresh token. The relay never sees passwords, bodies, attachments or mailbox contents.
- Your AI provider, only when AI is switched on and configured by an administrator. Subjects, senders, recipients, bodies, conversation context and your instructions can be sent. A phishing analysis sends a body excerpt of up to 2,000 characters and up to 12,000 characters of raw headers. Attachments are not transmitted.
- Remote image hosts, only for messages where you chose to show images.
No analytics service sees your mail. There is no PressedMail server holding a copy of it.
Getting rid of it
Removing a connected account deletes its stored credentials and its local mirror. WordPress personal-data export and erasure requests both cover PressedMail's local data. Uninstalling removes plugin data when the site owner picks the purge option. None of that touches what is still sitting on your provider.