Privacy Policy

Overview

Mail.cx 是一项独立运营的电子邮件接收服务。在本隐私政策中，“我们”、“我们的”均指 Mail.cx 的运营方。mail.cx provides email workflow tools, developer inbox services, and related API functionality. We are committed to protecting your privacy and handling data responsibly. This Privacy Policy explains what information we collect, how we use it, how long we retain it, and how we protect it.

What We Collect

We collect only the minimum information necessary to operate, secure, and improve the service:

• Inboxes and email content — used to provide short-term email receiving and automatically deleted after expiration
• Registered account information — such as your email address and hashed password, used solely for authentication and account access
• API tokens — stored only as secure SHA-256 hashes and never in plaintext
• Server logs — including IP addresses, request timestamps, and limited request metadata, retained for a short period to detect abuse, troubleshoot issues, and maintain service security

What We Do Not Collect

• No advertising or tracking on inbox, email reading, dashboard, or login screens — these private-communication views never display ads and never load third-party advertising scripts
• No selling, renting, or sharing of your inbox addresses, email contents, account email, or API tokens with advertisers or any third party
• No collection of personal information beyond what you voluntarily provide or what is technically required to operate the service
• We are committed to data minimization — we collect only what is necessary to deliver and secure the platform

Data Retention

We retain data only for as long as necessary to operate the service and protect the platform:

• Inboxes, emails, and raw .eml files are automatically deleted after their retention period ends
• Revoked API tokens are permanently deleted after a limited retention period
• Server logs are retained only for a short period for abuse prevention, debugging, and security monitoring — automated deletion is applied wherever practical

Security

We use reasonable technical and organizational measures to protect the platform and stored data, including TLS encryption for data in transit, bcrypt hashing for passwords, and SHA-256 hashing for API tokens. No internet-connected service can be guaranteed to be completely secure, but we take appropriate steps to reduce risk and protect stored information.

Third-Party Services

Our infrastructure is hosted on server infrastructure providers and related technical services necessary to deliver the product. In limited cases, standard public DNS resolvers or other network services may be used for domain verification, email routing, security checks, or service operation. To keep the inbox service free, a limited set of marketing and content pages (the blog, About, Pricing, Help, How-it-works, API documentation, Contact, Privacy, Terms, 10 Minute Mail, and Email Generator) may display advertising from Google AdSense and its certified partners. These advertising services may use cookies and limited identifiers to deliver, measure, and personalize ads. The inbox, email-reading view, dashboard, login, and register screens never display ads and never load advertising scripts. See the "Advertising" section below for full details and opt-out information.

付款

Pro 通过我们的记录商户兼经销商 Creem（Armitage Labs OÜ，爱沙尼亚）销售。当你购买 Pro 时：

• Creem 在其结账页面收集你的姓名、邮箱、账单地址和支付信息，并作为独立的数据控制者依据 Creem 隐私政策处理这些信息。
• 我们从不接收或保存你的卡号或其他支付凭证。
• Creem 只与我们共享提供你所购服务所需的信息：其客户、订单和结账标识（对于早前购买的订阅，还包括订阅标识和状态）、购买与计费日期，以及支付金额。我们用这些信息为你的账户开启或关闭 Pro，并处理账单和退款请求。
• 这些购买记录在你的账户存续期间保留，并随账户一同删除；发票和付款记录由 Creem 按税法要求保存。

Cookies and Local Storage

mail.cx itself does not use tracking cookies for its core inbox functionality. To support authentication and product features, certain tokens, preferences, and session-related data may be stored in your browser using localStorage or similar browser storage mechanisms. This information is used only for the operation of the service and is never shared with advertisers. On the marketing and content pages listed in the "Third-Party Services" section, Google AdSense and its certified advertising partners may set cookies as described in the "Advertising" section. Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked for consent through a Google-certified consent banner before any advertising cookie is set.

Advertising

To keep the inbox service free for anonymous users, mail.cx displays advertising on a limited set of non-private pages. We use only Google AdSense, which is governed by Google's Publisher Policies and a Google-certified consent management platform.

• Where ads appear — only on marketing and content pages: the blog (/blog), About, Pricing, Help, API documentation, How-it-works, Privacy, Terms, 10 Minute Mail, Email Generator, and Contact.
• Where ads never appear — the inbox view, individual email reading view, dashboard, login, register, and any logged-in or private-communication screen. These pages do not even load advertising scripts.
• Third parties — Google and its certified advertising partners may use cookies and limited identifiers to deliver, measure, and personalize ads on the pages listed above. The list of certified partners is available through the Google Funding Choices consent interface.
• Consent — visitors in the European Economic Area, the United Kingdom, and Switzerland are shown a Google-certified consent banner before any advertising cookie is set. You can withdraw or change your consent at any time through the same banner.
• Opt-out — you can opt out of personalized advertising at https://www.google.com/settings/ads or by selecting non-personalized ads in the consent banner. Non-personalized ads may still be shown.
• Data boundary — mail.cx itself never shares inbox addresses, email contents, account email, or API tokens with advertising partners. The data available to advertising partners is limited to the standard web request metadata (such as IP address, user agent, and page URL) that their own scripts collect when loaded on marketing pages.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or security practices. When we do, the updated version will be posted on this page with a revised effective or revision date.