Set up your account

You need two things: your email address, and the password you use with your mail provider. The server names, the port numbers and whether your provider also offers a calendar are things the app tries to work out for itself.

Start with your email address

1. Open the account list. On macOS that is Accounts in the sidebar; on Android, tap the mailbox name at the top of the screen. Then choose Add account….
2. Type your address and press Continue.

The app then spends a few seconds looking your provider up. It asks the standard places a provider publishes its settings: your own email domain, your provider's domain, an ordinary DNS lookup, and the Thunderbird project's public directory of provider settings. Only the domain is ever sent: example.com, never you@example.com. No password is involved either, because you have not typed one yet.

If nothing turns up within about ten seconds it gives up and offers you the form instead, with a line saying why. It never hangs.

When your settings are found

Check that the server names look like your provider's, type your password, and press Connect.

If a calendar was found too, "Also sync your calendar" is already ticked and the address it found is shown underneath. It reuses the password you are about to type, so there is nothing to enter twice. Untick it if you only want mail.

Some addresses never reach this screen, and that is correct:

• A Microsoft or Google address sends you to that provider's own sign-in page, in your browser. Your password is never typed into Allodia Mail & Calendar. What comes back is a token, stored in your device's secure storage.
• A provider that supports JMAP, such as Fastmail or a server you run yourself, asks for a password or an API token, whichever your server issues.

When the settings arrive over an insecure connection

A few providers still publish their mail settings over plain, unencrypted HTTP. The app will use them, but not quietly:

Connect stays disabled until you tick "I trust these settings." That is the whole point of this screen. Settings fetched over an insecure connection could have been altered on the way to you, and an altered server name is a server that receives your password.

So read the two host names before you tick it. They should be at your provider's own domain, the same one their support pages use. If they name something you don't recognise, don't approve it: go to Set up manually and type the servers your provider documents.

Settings found over HTTPS, or through a DNS lookup, never show this screen.

When nothing is found

You can also reach this form at any time with Set up manually. Choose the kind of account along the top, then fill in:

• Mail server: the name only, for example imap.example.com. No port number, because the app uses the standard secure one.
• Email and Password: the address, and the password or app-specific password your provider issued.
• Outgoing server, SMTP and Calendar server, CalDAV URL are optional. Leave SMTP empty and you can read mail but not send it; you can fill it in later.

Where your password goes

Into your device's own secure storage, which is the Keychain on macOS and the Android Keystore on Android, and not into the app's database.

The lookup runs once, when you add the account. Whichever server it found is written into that account's settings, so nothing re-resolves it afterwards, and the app checks the server's certificate on every connection from then on.

None of this involves Allodia: the app talks to your provider, and to nobody else. The full picture is in the privacy policy.