Privacy policy

The short version

We do not read your mail. We do not scan it to build a profile of you, we do not sell anything about you to anyone, and we do not train models on your messages. We keep the minimum needed to deliver mail, bill you and keep the service standing up.

What we hold

• Your mail. Messages, folders, attachments and contacts you store in the mailbox.
• Account details. The address you sign in with, a hashed password, your two step settings and the domains you have connected.
• Billing details. A customer record held by our payment processor. Card numbers never reach our servers.
• Operational logs. Connection times, IP addresses and delivery results, kept so we can chase a lost message or stop an attack.

How long we keep it

Mail stays until you delete it. Deleted mail sits in Trash for 30 days and is then removed. Daily snapshots are retained for 30 days. Operational logs are kept for 14 days and then discarded. If you close your account, mail and account records are deleted within 30 days and billing records are kept only as long as tax rules require.

Automated processing

Incoming mail passes through spam, malware and phishing filters on delivery. Remote images and tracking pixels are proxied or stripped so a sender cannot tell when or where you opened a message. This filtering is automatic. No person reads your mail unless you forward a message to support and ask us to look at it.

Who else sees anything

We use a small number of suppliers to run the service, including data centre operators, a payment processor and a transactional email provider for account notices. They only receive what they need for their part of the job and they are not allowed to use it for anything else. We do not sell or rent data, and we do not run third party advertising or analytics trackers on this website.

Legal requests

If we receive a valid legal order we will check that it is properly issued and narrow it wherever we can. Unless we are legally barred from doing so, we will tell you before we hand anything over, so that you have a chance to respond.

Security

Connections are encrypted with TLS in transit and mail is encrypted at rest. Two step sign in is available on every account and we recommend turning it on. Access to production systems is limited to the people who need it and every access is logged.

Your choices

You can export everything at any time over IMAP, in standard formats, without asking us. You can correct your account details from the settings screen, and you can ask us to delete your account and its contents by writing to support@ownermailbox.com. We will confirm once it is done.

Cookies

This website sets no tracking cookies. The mail application sets one cookie to keep you signed in and remember your interface preferences. There is nothing to opt out of because there is no third party collecting anything here.

Changes

If this policy changes in a way that affects you, we will send a notice to your mailbox before the change takes effect and post the new version here with a fresh date at the top.

Contact

Questions about this policy go to support@ownermailbox.com and a person will answer.