Oct 5, 2026

Privacy

What the hosted site keeps, and what it never sees.

This applies to webmail-mcp.ariesiitd.com. webmail-mcp is an independent student project. It is not an official IIT Delhi service.

Sign in

DevClub tells us your Kerberos id, and the name and email on that login. That step does not include your webmail password.

The mail password

You type it on this site. We check it with IIT Delhi mail. A wrong password is not saved. A right one is stored encrypted on our server, for that Kerberos id. The assistant never sees it. Don't type it into ChatGPT, Claude, Gemini, Cursor, or any other chat.

The address

After mail is connected, you get one private URL. Anyone with that URL can read and send your mail. Don't put it in a group chat, a screenshot, or a repository. We keep a hash of the token. The page shows the full URL once, so you can copy it.

Your mail

The assistant can read mail, search what you sent, draft, and send when you say send. It can read a PDF that came with a message. It will not attach a password file or a key. We don't sell your mail, and we don't use it to train a model.

Logs

The server keeps a log of actions, including sends, so they can be looked up later. That log does not store your password or the raw token.

If you don't want us to hold the password

Run it yourself. The code is open source. On your own computer, the password stays there. How to self-host.