Privacy Policy

What we store

• Account record: label, email, role, plan, and a hashed access key.
• Mailbox records: address, owning key, creation time, expiry, and message counters.
• Message content: headers, bodies, and attachments you received, until expiry.
• Operational logs: request id, endpoint, status, and IP for API calls, kept for troubleshooting.

What we do not do

• We do not sell or share message content with third parties.
• We do not use message bodies for advertising or model training.
• We do not send marketing mail to your addresses.

Why we hold it

• To deliver and display the mail you asked us to receive.
• To enforce plan limits, quotas, and rate limits.
• To investigate abuse reports and keep the service deliverable.

How long

Message retention is capped by your plan and by the per-address TTL. Expired messages and mailboxes are deleted by a scheduled purge; there is no archive and no restore. Account records persist until the account is removed.

Cookies

The panel sets a single session cookie so you stay signed in. It is httpOnly and, on HTTPS deployments, secure. There are no advertising or analytics cookies on this deployment.

Your choices

You can delete mailboxes and messages through the panel or the API at any time, and deleting a mailbox removes its messages. To remove your account and its records, write to the support address below.

Self-hosted note

This instance is operated by the party who deployed it, on infrastructure they control. That operator is the data controller for anything stored here, and is the right party to contact about access or deletion requests.