Privacy Policy

Overview

Mail.cx 是一項獨立營運的電子郵件接收服務。在本隱私權政策中，「我們」、「我們的」均指 Mail.cx 的營運方。mail.cx provides email workflow tools, developer inbox services, and related API functionality. We are committed to protecting your privacy and handling data responsibly. This Privacy Policy explains what information we collect, how we use it, how long we retain it, and how we protect it.

What We Collect

We collect only the minimum information necessary to operate, secure, and improve the service:

• Inboxes and email content — used to provide short-term email receiving and automatically deleted after expiration
• Registered account information — such as your email address and hashed password, used solely for authentication and account access
• API tokens — stored only as secure SHA-256 hashes and never in plaintext
• Server logs — including IP addresses, request timestamps, and limited request metadata, retained for a short period to detect abuse, troubleshoot issues, and maintain service security

What We Do Not Collect

• No advertising or tracking on inbox, email reading, dashboard, or login screens — these private-communication views never display ads and never load third-party advertising scripts
• No selling, renting, or sharing of your inbox addresses, email contents, account email, or API tokens with advertisers or any third party
• No collection of personal information beyond what you voluntarily provide or what is technically required to operate the service
• We are committed to data minimization — we collect only what is necessary to deliver and secure the platform

Data Retention

We retain data only for as long as necessary to operate the service and protect the platform:

• Inboxes, emails, and raw .eml files are automatically deleted after their retention period ends
• Revoked API tokens are permanently deleted after a limited retention period
• Server logs are retained only for a short period for abuse prevention, debugging, and security monitoring — automated deletion is applied wherever practical

Security

We use reasonable technical and organizational measures to protect the platform and stored data, including TLS encryption for data in transit, bcrypt hashing for passwords, and SHA-256 hashing for API tokens. No internet-connected service can be guaranteed to be completely secure, but we take appropriate steps to reduce risk and protect stored information.

Third-Party Services

Our infrastructure is hosted on server infrastructure providers and related technical services necessary to deliver the product. In limited cases, standard public DNS resolvers or other network services may be used for domain verification, email routing, security checks, or service operation. To keep the inbox service free, a limited set of marketing and content pages (the blog, About, Pricing, Help, How-it-works, API documentation, Contact, Privacy, Terms, 10 Minute Mail, and Email Generator) may display advertising from Google AdSense and its certified partners. These advertising services may use cookies and limited identifiers to deliver, measure, and personalize ads. The inbox, email-reading view, dashboard, login, and register screens never display ads and never load advertising scripts. See the "Advertising" section below for full details and opt-out information.

付款

Pro 透過我們的記錄商戶兼經銷商 Creem（Armitage Labs OÜ，愛沙尼亞）銷售。當你購買 Pro 時：

• Creem 在其結帳頁面收集你的姓名、電子郵件、帳單地址和付款資訊，並作為獨立的資料控制者依據 Creem 隱私權政策處理這些資訊。
• 我們從不接收或儲存你的卡號或其他付款憑證。
• Creem 只與我們分享提供你所購服務所需的資訊：其客戶、訂單和結帳識別碼（對於早前購買的訂閱，還包括訂閱識別碼和狀態）、購買與計費日期，以及支付金額。我們用這些資訊為你的帳戶開啟或關閉 Pro，並處理帳單和退款請求。
• 這些購買紀錄在你的帳戶存續期間保留，並隨帳戶一同刪除；發票和付款紀錄由 Creem 依稅法要求保存。

Cookies and Local Storage

mail.cx itself does not use tracking cookies for its core inbox functionality. To support authentication and product features, certain tokens, preferences, and session-related data may be stored in your browser using localStorage or similar browser storage mechanisms. This information is used only for the operation of the service and is never shared with advertisers. On the marketing and content pages listed in the "Third-Party Services" section, Google AdSense and its certified advertising partners may set cookies as described in the "Advertising" section. Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked for consent through a Google-certified consent banner before any advertising cookie is set.

Advertising

To keep the inbox service free for anonymous users, mail.cx displays advertising on a limited set of non-private pages. We use only Google AdSense, which is governed by Google's Publisher Policies and a Google-certified consent management platform.

• Where ads appear — only on marketing and content pages: the blog (/blog), About, Pricing, Help, API documentation, How-it-works, Privacy, Terms, 10 Minute Mail, Email Generator, and Contact.
• Where ads never appear — the inbox view, individual email reading view, dashboard, login, register, and any logged-in or private-communication screen. These pages do not even load advertising scripts.
• Third parties — Google and its certified advertising partners may use cookies and limited identifiers to deliver, measure, and personalize ads on the pages listed above. The list of certified partners is available through the Google Funding Choices consent interface.
• Consent — visitors in the European Economic Area, the United Kingdom, and Switzerland are shown a Google-certified consent banner before any advertising cookie is set. You can withdraw or change your consent at any time through the same banner.
• Opt-out — you can opt out of personalized advertising at https://www.google.com/settings/ads or by selecting non-personalized ads in the consent banner. Non-personalized ads may still be shown.
• Data boundary — mail.cx itself never shares inbox addresses, email contents, account email, or API tokens with advertising partners. The data available to advertising partners is limited to the standard web request metadata (such as IP address, user agent, and page URL) that their own scripts collect when loaded on marketing pages.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or security practices. When we do, the updated version will be posted on this page with a revised effective or revision date.