What it does
BlueMail documents tracker blocking, OAuth account authorization, PGP and S/MIME. Its security page distinguishes direct provider synchronization from optional mobile push relaying.
BlueMail says ordinary synchronization runs directly between the device and mail provider. For OAuth accounts, its security page says BlueMail does not receive the password. For password-only accounts, credentials remain on the device unless optional instant push is enabled, when encrypted credentials reach BlueMail’s servers.
On mobile, that optional push route uses a relay which the provider says reads notification information and deletes the message within seconds. The client separately documents PGP key creation/import, S/MIME and default tracking-pixel blocking. Account access, push notifications and message encryption are distinct choices.
Strengths
- PGP and S/MIME workflows are documented.
- Tracking-pixel blocking is described as enabled by default.
- The security page explains the optional push-relay workflow.
Best for
- People who want to compare mail-client notification behavior and encryption controls
Sources
- Security Center | BlueMail (Oct 26, 2026)