Privacy Policy

Overview

mail.cx provides email workflow tools, developer inbox services, and related API functionality. We are committed to protecting your privacy and handling data responsibly. This Privacy Policy explains what information we collect, how we use it, how long we retain it, and how we protect it.

What We Collect

We collect only the minimum information necessary to operate, secure, and improve the service:

• Inboxes and email content — used to provide short-term email receiving and automatically deleted after expiration
• Registered account information — such as your email address and hashed password, used solely for authentication and account access
• API tokens — stored only as secure SHA-256 hashes and never in plaintext
• Server logs — including IP addresses, request timestamps, and limited request metadata, retained for a short period to detect abuse, troubleshoot issues, and maintain service security

What We Do Not Collect

• No advertising or tracking on inbox, email reading, dashboard, or login screens — these private-communication views never display ads and never load third-party advertising scripts
• No selling, renting, or sharing of your inbox addresses, email contents, account email, or API tokens with advertisers or any third party
• No collection of personal information beyond what you voluntarily provide or what is technically required to operate the service
• We are committed to data minimization — we collect only what is necessary to deliver and secure the platform

Data Retention

We retain data only for as long as necessary to operate the service and protect the platform:

• Inboxes, emails, and raw .eml files are automatically deleted after their retention period ends
• Revoked API tokens are permanently deleted after a limited retention period
• Server logs are retained only for a short period for abuse prevention, debugging, and security monitoring — automated deletion is applied wherever practical

Security

We use reasonable technical and organizational measures to protect the platform and stored data, including TLS encryption for data in transit, bcrypt hashing for passwords, and SHA-256 hashing for API tokens. No internet-connected service can be guaranteed to be completely secure, but we take appropriate steps to reduce risk and protect stored information.

Third-Party Services

Our infrastructure is hosted on server infrastructure providers and related technical services necessary to deliver the product. In limited cases, standard public DNS resolvers or other network services may be used for domain verification, email routing, security checks, or service operation. To keep the inbox service free, a limited set of marketing and content pages (the blog, About, Pricing, Help, How-it-works, API documentation, Contact, Privacy, Terms, 10 Minute Mail, and Email Generator) may display advertising from Google AdSense and its certified partners. These advertising services may use cookies and limited identifiers to deliver, measure, and personalize ads. The inbox, email-reading view, dashboard, login, and register screens never display ads and never load advertising scripts. See the "Advertising" section below for full details and opt-out information.

Cookies and Local Storage

mail.cx itself does not use tracking cookies for its core inbox functionality. To support authentication and product features, certain tokens, preferences, and session-related data may be stored in your browser using localStorage or similar browser storage mechanisms. This information is used only for the operation of the service and is never shared with advertisers. On the marketing and content pages listed in the "Third-Party Services" section, Google AdSense and its certified advertising partners may set cookies as described in the "Advertising" section. Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked for consent through a Google-certified consent banner before any advertising cookie is set.

Advertising

To keep the inbox service free for anonymous users, mail.cx displays advertising on a limited set of non-private pages. We use only Google AdSense, which is governed by Google's Publisher Policies and a Google-certified consent management platform.

• Where ads appear — only on marketing and content pages: the blog (/blog), About, Pricing, Help, API documentation, How-it-works, Privacy, Terms, 10 Minute Mail, Email Generator, and Contact.
• Where ads never appear — the inbox view, individual email reading view, dashboard, login, register, and any logged-in or private-communication screen. These pages do not even load advertising scripts.
• Third parties — Google and its certified advertising partners may use cookies and limited identifiers to deliver, measure, and personalize ads on the pages listed above. The list of certified partners is available through the Google Funding Choices consent interface.
• Consent — visitors in the European Economic Area, the United Kingdom, and Switzerland are shown a Google-certified consent banner before any advertising cookie is set. You can withdraw or change your consent at any time through the same banner.
• Opt-out — you can opt out of personalized advertising at https://www.google.com/settings/ads or by selecting non-personalized ads in the consent banner. Non-personalized ads may still be shown.
• Data boundary — mail.cx itself never shares inbox addresses, email contents, account email, or API tokens with advertising partners. The data available to advertising partners is limited to the standard web request metadata (such as IP address, user agent, and page URL) that their own scripts collect when loaded on marketing pages.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or security practices. When we do, the updated version will be posted on this page with a revised effective or revision date.