1. What Data We Collect
We collect the following types of information:
- Account information: your name, email address, and hashed password when you create an account
- Contact data: the recipient details you upload or add through the API and forms, such as email addresses, names, and any custom properties you choose to store
- Email data: the messages you send through the Service, including subject and body, and the delivery events they generate, such as sends, bounces, complaints, opens, and clicks
- Usage data: basic analytics about how you use the Service, such as page views and feature usage
- Received email: messages that arrive at your receiving domains and inboxes, with their attachments
- Recipient activity: when a recipient opens an email or clicks a tracked link, the time and the browser's user agent
- Domain data: the domains you add and their DNS records
- Connected apps: when you connect an AI assistant such as ChatGPT or Claude, the app's name, the permissions you approved and a hashed access key
- Technical data: IP addresses and request details, used for security, rate limits and abuse prevention
- Payment data: if you subscribe to a paid plan, payment information is collected and processed by Stripe; we do not store your credit card details
2. How We Use Your Data
Your data is used to:
- Provide and maintain the Service
- Send email, process delivery events, and show account reports
- Process your subscription payments
- Send important account notifications (such as subscription changes)
- Detect spam, phishing and abuse of the Service
- Improve the Service based on aggregate usage patterns
We never sell your personal data, email content, recipient lists, or sending data to third parties. We never use your email data for advertising purposes.
3. Data Storage and Security
Your data is stored securely with encryption in transit (TLS/SSL). We follow industry best practices for securing web applications. Access to production data is restricted to authorized personnel only.
While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
4. Third-Party Services
We use the following third-party services:
- Stripe: for payment processing. Stripe collects and processes your payment information according to their own privacy policy. See stripe.com/privacy.
- Amazon Web Services: sends your email and stores received messages.
- DigitalOcean: hosts the Service and its database.
- DigitalOcean AI inference and Typesafe: help us screen new signups and review sending patterns for abuse. They receive account details and sending statistics with short samples, such as subjects and link domains, never full email bodies.
- Google: Google Analytics (see Cookies below), and Google Safe Browsing, which checks the links in outgoing emails against Google's list of unsafe sites.
- Cloudflare: bot protection on signup forms, custom link domains, and DNS setup when you choose one-click setup.
- RDAP registries: public registration data for the domain of a signup email address.
- AI assistants you connect: an app such as ChatGPT or Claude receives the data its tools return, such as emails, contacts, domains and delivery events, within the permissions you approved. The app's own privacy policy applies to that data.
- Authentication: we use secure session-based authentication. Passwords are hashed and never stored in plain text.
5. Data Retention
- Email content: the body of a sent email is deleted 30 days after it is sent. The record of the email (recipients, subject, status and delivery events) stays while your account exists.
- Received email: the raw copy of a received message is deleted after 30 days.
- Suspended accounts: emails are deleted 90 days after suspension. We keep the account's email address and a summary of what it sent, to stop repeat abuse.
- Deleted accounts: all data is permanently deleted within 30 days of your request.
6. Data Export and Deletion
You have the right to:
- Export your data: paid plan users can export their account and email activity data in CSV or JSON format from the settings page. Free plan users can request an export by contacting support.
- Delete your account: you can delete your account from the settings page or by contacting us at [email protected]. All your data will be permanently deleted within 30 days of your request.
- Access your data: you can view all data you have entered through the Service at any time.
- Disconnect apps: you can disconnect a connected AI assistant on the API keys page at any time, and its access stops at once.
7. Cookies
We use essential cookies to maintain your login session and remember your preferences. Session cookies are automatically deleted when you close your browser or sign out.
We also use Google Analytics to see which pages get used. It is on unless you decline it in the cookie banner, and declining stops it immediately and is remembered on that browser. We do not use advertising cookies, tracking pixels, or third-party marketing tags of any kind.
When you sign up or buy a plan or email credits, our server tells Google Analytics that it happened, with the random ID from its cookie and, for a purchase, what was bought and the amount. It never sends your email, name, account or IP address, and declining in the cookie banner stops this as well.
Unless you decline, we also keep a first-party cookie with the first public page you visited on this site (its address and campaign tag, never anything from your account) and the website that linked you here, for up to 90 days. If you create an account, we store that page and website with it, so we know which pages bring signups. Declining deletes the cookie.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.
9. Contact
If you have questions about this Privacy Policy or your data, please contact us at [email protected].