Clear answers, close at hand.

Connect a Google account

1. Open Northstar Mail and choose Add account.
2. Select Google and enter your Gmail address.
3. Turn on 2-Step Verification in your Google Account, then create a Google app password.
4. Paste that generated app password into Northstar to validate Gmail.
5. To add Calendar and People, choose the same account in Google's browser consent screen and review the requested permissions. You can also choose mail-only setup.

Never enter your normal Google account password into Northstar. The generated app password is a separate credential for Gmail's IMAP and SMTP connection. Google's browser sign-in is used for Calendar and People, not Gmail mail access.

Why Google asks for access

• Gmail app password: connects directly to Gmail to read, search, send, and change mail state. Current setup does not request a Gmail OAuth scope.
• Google identity: checks the account selected for optional Calendar and People access.
• Calendar: reads your owned calendar and lets you create or edit events. Guests may receive notifications when you add or change an event with attendees.
• Contacts: reads your Google contacts and lets you create a new one; Northstar does not edit or delete existing contacts.

Gmail is validated first using the app password. If you choose Calendar and People during setup, one Google browser consent requests identity, owned-calendar event, and contacts permissions. Mail-only setup remains available, and older accounts can request access later.

See the complete scope disclosure for the permission identifiers and data-handling details.

Google sign-in help

• Confirm the system clock and time zone are correct.
• Finish sign-in in the same browser window Northstar opened.
• Allow the browser to return to the temporary local callback on your PC.
• If access was denied, start again and review the permission screen.
• If a work or school administrator blocks third-party apps, ask that administrator about its policy.

If you cannot create an app password, check Google's app-password guidance. Some account configurations or administrators restrict this option.

Privacy and security basics

Provider content is processed locally in Northstar and is not uploaded to a TreeByte mail cloud. Local account settings, Gmail app passwords, and OAuth credentials are stored in your Windows profile; credentials are protected with Windows DPAPI.

TreeByte does not use Google user data for ads, sale, or AI training. Do not send passwords, authorization codes, OAuth tokens, or private message content in a support request.

Remote images in messages

When you choose to load remote email images, your PC contacts the sender's or image provider's server directly. That host can receive your IP address, request time, browser-engine information, and tracking identifiers contained in the image URL. Keep images blocked when you do not trust the sender.

WebView2 may cache remote-image responses or accept and send cookies under its browser rules. Removing any configured account clears this shared renderer data; cached images for remaining accounts may be downloaded again. If cleanup is interrupted, Northstar blocks remote images and retries before loading them again.