Legal
How Inboxies handles your data, and the agreement for using it, in plain words where we could manage it.
Privacy policy
This policy explains what Inboxies collects, why, who else handles it, how long it’s kept and what you can do about it. It covers the hosted service (the web app at inboxies.app and mail at @inboxies.email), the Inboxies apps, and this website, inboxies.co. We’ve written it to match how the software actually works today, and we name the gaps rather than paper over them.
Who we are
“Inboxies”, “we” and “us” mean the team that runs the hosted Inboxies service and this website. We decide how your data is used, so we’re the controller of it under laws like the GDPR. For anything in this policy, write to support@inboxies.email.
Inboxies is open source. If you use an install that someone else runs on their own Cloudflare account, that operator controls your data there and this policy doesn’t apply to it. See Self-hosted installs.
What we collect
Your account. Your username and address, your display name if you give one, a backup email outside Inboxies, and your password, stored only as a salted PBKDF2 hash. If you sign in with Apple or Google, we receive the name, email and profile picture that provider shares, plus an identifier for your account with them.
Your mail. Every message you receive and send: senders and recipients, subject, body, attachments, headers and the full raw message, along with drafts, folders, read and starred state, and the results of SPF, DKIM and DMARC checks. That includes mail from people who don’t use Inboxies but write to you.
What you set up. Mailbox settings, signature, forwarding and auto-reply, filters, your Screener decisions about senders, Reply Later, private email addresses and their labels, the people you share a mailbox with, and the assistant instructions you write.
Ask AI. Your conversations with the assistant and the drafts it prepares.
Devices and sessions. For each signed-in session we keep its IP address, browser or device description and expiry. If you allow notifications, we store your device’s push token.
Domains and payments. For a custom domain: the domain, its DNS records, who its admins are, and its subscription status. If you buy a domain, Stripe collects your card and billing details; we receive a customer identifier and the payment’s status, never your card number.
Support. What you send us by email or through the contact form on this site.
Security records. A log of significant account actions, such as an account being deleted or an admin assigning a mailbox, with who did it and when.
We don’t ask for your phone number, and we don’t collect your location, contacts or browsing history.
How we use it
- To run the service: receive, store, sort, search, display and send your mail, and keep your apps in sync.
- To protect you: check incoming mail for spam and spoofing, hold new senders in the Screener, block remote images until you load them, and limit sign-in attempts and sending.
- To run the assistant, as described in AI and your mail.
- To notify you about new mail, if you’ve allowed notifications.
- To set up and bill custom domains, and to email you about renewals and a domain’s service ending.
- To send account email: sign-in and reset codes, invitations and backup-email checks.
- To answer you when you write to us, and to investigate abuse or a security problem.
- To meet legal obligations, such as keeping payment records.
We don’t sell your personal data, we don’t share it for advertising, and there are no ads in Inboxies. We don’t use analytics, tracking or crash-reporting tools in the apps, the web app or this site.
Under the GDPR and UK GDPR, we rely on: performance of our contract with you for running the service and billing; our legitimate interests for spam protection, security and abuse prevention; legal obligation for tax and payment records; and your consent for notifications, which you can withdraw in Settings at any time.
Sign in with Google
If you choose Sign in with Google, or connect Google in Settings, Google shares your name, email address, profile picture and an account identifier with us. That’s all we ask for: the basic sign-in permissions (openid, email and profile). Inboxies gets no access to your Gmail, Drive, contacts or anything else in your Google account.
We use that information only to sign you in and to show you which Google account is connected. We don’t use it for advertising, we don’t sell it, and we share it only as Who else handles your data describes.
Inboxies’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
To stop using it, disconnect Google in Settings → Sign-in methods, or remove Inboxies from your Google account’s third-party connections. Deleting your Inboxies account erases the link, as described in How long we keep it.
AI and your mail
Inboxies uses AI models in three places:
- Spam check. Incoming mail that its headers don’t already settle is checked for spam by a small model, which reads the sender, the subject and the first 2,000 characters of the text.
- Draft replies. When mail arrives from a sender you’ve let in, the assistant reads that email and its thread to prepare a draft reply for you to review. It doesn’t draft for mail in the Screener, Spam, bulk mail, spoofed senders, or mail a filter files away or tells it to skip. Before drafting, the message and thread are checked for prompt injection.
- Ask AI. When you ask the assistant something, it can search and read your mail to answer, draft emails, mark mail read and move it between folders. It saves drafts; it doesn’t send.
These models run on Cloudflare Workers AI: Kimi K2.5 for chat and drafts, and Llama models for the spam check, the injection check and tidying drafts. Your mail isn’t sent to any other AI company. Inboxies doesn’t train any AI model on your mail.
There’s no switch to turn the assistant off for a mailbox yet. To stop drafts for particular senders, lists or subjects, add a filter with “Skip auto-draft”. Mailbox owners can change how it writes in Settings → AI prompt.
Who can see your mail
- You, and the owners and members you share a mailbox with.
- Domain admins. On a custom domain, its admins can create, reassign and delete mailboxes on it, including assigning one to themselves, and can export every mailbox on the domain.
- Tools you connect. An outside AI tool you connect over MCP acts with your access and can read, send and delete what you can.
- Us. Mail isn’t end-to-end encrypted, so the people who run Inboxies can technically access stored mail, as with most hosted email. We don’t look at your mail except to fix a problem you’ve asked us to, to investigate abuse or a security incident, or where the law requires it.
Who else handles your data
We use a small number of service providers. They process data for us under their own terms and privacy commitments.
Cloudflare Runs everything: hosting, storage (Durable Objects, R2 and D1), receiving and sending mail (Email Routing and Email Service), the AI models (Workers AI), DNS for custom domains, and domain registration (Cloudflare Registrar). Stripe Payments for domains you buy: card details, billing address and invoices. We share the domain, your username, display name and price. Apple Sign in with Apple, and notifications to iPhone (the sender, subject and a short preview of a new email pass through Apple’s push service). Google Sign in with Google, if you link it. The web app loads its fonts from Google Fonts, so your browser connects to Google’s servers. Mail you send goes to its recipients and their providers, and forwarding sends copies where you’ve told it to. We may also disclose data when the law requires it, to protect people’s safety or our service from abuse, or to a successor if Inboxies is reorganised or sold, in which case this policy keeps applying to your data.
Where your data is
Your data is stored and processed on Cloudflare’s global network and isn’t pinned to one country or region, so it may be handled outside the country where you live, including in the United States. Where the law requires it, these transfers rely on safeguards such as the EU Standard Contractual Clauses in our providers’ terms.
How long we keep it
Mail and attachments Until you delete them. Deleting moves mail to Trash; deleting it from Trash, or emptying Trash, erases it. Trash and Spam aren’t emptied automatically. A deleted mailbox Its messages, attachments, settings, search index, private email addresses and assistant history are erased at once. A deleted account Your sign-in methods, sessions and memberships are erased, along with every mailbox you’re the only owner of. You’re removed from mailboxes that have other owners. .mbox exports 7 days, then the file is deleted. An export made before a mailbox was deleted lasts its 7 days. Sessions Up to 30 days without use, then they expire and are cleared. Codes and links Sign-in and verification codes last 15 minutes; password reset links last an hour. Both are stored hashed and cleared once expired. Invitations Cleared 30 days after they expire. A lapsed paid domain Mailboxes turn read-only when service ends. If the domain isn’t renewed, its mail is erased 30 days after the name is released, with reminders before that. Payment records As long as tax and accounting law requires. Security records The log of account actions is kept to investigate abuse and disputes. Server logs Short-lived operational logs, which can include email addresses, kept by Cloudflare’s logging and not used for anything else. Support messages As long as we need them to help you, in our support mailbox. Your choices and rights
- See and take your data. Your mail is in the apps. Domain admins can export every mailbox on a domain to .mbox from Admin → Export.
- Correct it. Change your backup email, password, sign-in methods and the name your mail is sent from in Settings, or write to support@inboxies.email to fix anything else.
- Delete it. Delete a mailbox in its settings, or your whole account in Settings → Account → Delete account, on the web or in the iPhone app.
- Control what reaches you. Keep new senders in the Screener, leave remote images blocked, turn notifications off, and sign out other sessions from Settings.
Depending on where you live, you may also have the right to access, correct, delete or port your data, to object to or restrict how we use it, and to withdraw consent. To use any of these rights, or to get a copy of data you can’t export yourself, write to support@inboxies.email from the address on your account. We’ll answer within the time the law sets, usually a month.
If you’re in the EU, the EEA or the UK, you can also complain to your data protection authority. Californian residents: we don’t sell or share personal information as the CCPA defines those terms, and you won’t be treated differently for using your rights.
Security
Connections to Inboxies use TLS, and Cloudflare encrypts stored data at rest. Passwords are hashed, codes and reset links are stored hashed, and sign-in, reset and sending are rate-limited. Email HTML is cleaned and shown in a sandbox where scripts never run.
Inboxies doesn’t add end-to-end encryption, and no service is free of risk. If you find a security problem, write to support@inboxies.email with “Security” in the subject, or choose “Security report” in the contact form. If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.
Cookies and local storage
Inboxies uses one cookie: the session cookie that keeps you signed in to the web app. It’s strictly necessary, so there’s no cookie banner. This website sets no cookies at all.
Web app session cookie Keeps you signed in, for up to 30 days. Not readable by scripts. Web app local storage Your theme, text size and column widths, kept in your browser. This site’s local storage Your theme and text size, plus whether you paused the videos, kept in your browser. The iPhone app keeps a copy of your mail on the device for offline use and stores its sign-in token in the iOS Keychain. Deleting the app removes that copy.
This website and its contact form
inboxies.co has no analytics, no trackers and no third-party scripts, and its fonts are served from our own domain.
The contact form sends your name, email, Inboxies address (if you give one), topic and message, with the page you came from and your browser’s description, to support@inboxies.email as an email. The website doesn’t store it, and its logs record only whether a message was sent and its topic. Our support mailbox runs on Inboxies, so your message is handled like any other mail there, spam check included.
Children
Inboxies isn’t meant for children. You must be at least 13 to use it, or older where your country sets a higher age for consenting to online services (16 in some EU countries). If you believe a child has given us data, write to us and we’ll delete it.
Self-hosted installs
Anyone can run Inboxies on their own Cloudflare account from the source code. On a self-hosted install, mail and accounts live in that operator’s account, and we have no access to it. Their own privacy terms apply there.
Changes to this policy
When this policy changes, we’ll update the date at the top of this page. If a change materially affects how we use your data, we’ll tell you by email or in the app before it takes effect.
Terms of service
These terms are the agreement between you and Inboxies for using the hosted service (the web app at inboxies.app and mail at @inboxies.email) and the Inboxies apps. By creating an account or using the service, you agree to them, to the Acceptable use policy, and to how we handle data as described in the Privacy policy.
Your account
You need to be at least 13, or the minimum age for online services where you live, and able to make this agreement. If you use Inboxies for an organisation, you confirm you’re allowed to accept these terms for it.
Keep your password and devices safe, and set a backup email you control: it’s how you get back in and where we send renewal notices. You’re responsible for what happens in your account. Tell us at once if you think someone else got into it.
Addresses and usernames
An @inboxies.email address is yours to use while your account is active, but the domain stays ours. Some names, such as support, security, postmaster and abuse, are reserved. We may reclaim or rename an address that impersonates a person, a brand or Inboxies, that misleads people, or that infringes someone’s rights.
When an address is deleted, mail sent to it stops arriving. We may make a deleted name available again after a while.
Your content
Your mail, attachments and settings stay yours. You give us permission to store, process, copy, transmit and display them only as needed to run Inboxies for you: to deliver and send mail, search it, check it for spam, run the assistant and show it in your apps. That permission ends when the content is deleted, apart from copies kept for the periods in the privacy policy.
You’re responsible for what you send and store, and you confirm you have the right to it.
The assistant
Drafts and answers from the assistant are generated by AI. They can be wrong, incomplete or inappropriate, and they aren’t professional advice. The assistant saves drafts and never sends on its own. Read anything it writes before you send it: what you send is yours. The spam check and the Screener can also make mistakes, so look in Screener and Spam if you’re expecting something.
If you connect an outside tool over MCP, it acts with your access, including sending and deleting mail. You’re responsible for what it does.
Limits
To keep mail flowing and stop abuse, Inboxies sets limits. Today they include:
- Sending20 an hour, 100 a day per mailbox
- Largest message you send5 MiB, attachments included
- Largest message you receive25 MiB
- Filters50 per mailbox
- Private email addresses1,000 per mailbox
We may change these limits, and we’ll keep the current ones on the Support page.
Custom domains
You may only connect a domain you control. Connecting one moves its DNS to a Cloudflare zone that Inboxies runs, so Inboxies then manages all of its records, your website’s included. Check that the records your other services need are in the new zone; we’re not responsible for services outside Inboxies that stop working after the move.
Domain admins can create, reassign, export and delete every mailbox on their domain. If you add people to your domain, you’re responsible for telling them that, and for their use of it. Leaving is in Admin: export your mail, then choose Move DNS / Offboard and point the nameservers elsewhere.
Buying a domain
Price. A domain costs $20 a year, covering its registration and the Inboxies platform. A domain whose wholesale price is over $15 a year costs its wholesale price plus $10. You see the exact total before you pay. Prices are in US dollars, through Stripe, plus any tax that applies.
Registration. We register the domain through Cloudflare Registrar, in the Cloudflare account Inboxies runs, with WHOIS privacy on. While it’s with us you can unlock it and get its transfer code from Admin, to move it to another registrar.
Renewal. Your subscription renews every year until you cancel. We charge about 60 days before the registration expires and email your backup address 7 days before each charge. If a charge fails, or you cancel, we turn off the domain’s auto-renewal.
Cancelling. A domain admin can cancel, change the card and see invoices from the domain’s Subscription card in Admin on the web (Manage billing), or write to us. Cancelling stops the next renewal; the domain and its mail keep working until the paid period ends. Deleting your account doesn’t cancel a subscription.
Refunds. If we can’t register the domain you paid for, because someone else took it first, we cancel the subscription and refund you in full automatically. For anything else, write to support@inboxies.email. Nothing here limits refund rights you have under the law where you live.
When a domain’s service ends
If a domain’s subscription ends, its mailboxes turn read-only: people can still sign in, read and export, but nothing is sent or received. For a domain we registered, you can renew at the normal price for about 40 days after the registration expires. After that, Cloudflare releases the name, about 75 days after expiry, and the domain’s mail is erased 30 days after the name is released. We email the domain’s owner and admins at their backup addresses before each of these steps. Accounts aren’t deleted.
The service
Inboxies is changing quickly. We may add, change or remove features, and some, like the iPhone app on TestFlight, are in beta. The personal address and connecting your own domain have no charge today. If we ever start charging for something you already use, we’ll tell you in advance, and you can leave before it applies.
Inboxies relies on Cloudflare, Stripe, Apple and Google, and their outages can affect it. We don’t promise the service will always be available or free of errors.
Open source
The Inboxies source code is available under the Apache License 2.0 at GitHub. That license governs the code; these terms govern the hosted service. The Inboxies name and logo aren’t licensed for use on your own install.
Suspension and ending
You can stop using Inboxies and delete your account at any time from Settings.
We may suspend or close an account, an address or a domain that breaks these terms or the acceptable use policy, puts others at risk, or where the law requires it. Where it’s reasonable, we’ll tell you first and give you a chance to fix the problem and export your mail. If we ever shut the hosted service down, we’ll give at least 30 days’ notice so you can take your mail with you.
Disclaimers
Inboxies is provided “as is” and “as available”. To the extent the law allows, we disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. Email can be delayed, filtered or lost, so don’t rely on Inboxies as the only copy of anything important, or for emergencies.
Limitation of liability
To the extent the law allows, Inboxies isn’t liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, data or goodwill. Our total liability for any claim about the service is limited to the greater of what you paid us in the 12 months before the claim and US$50.
Nothing in these terms limits liability that can’t be limited by law, such as for fraud, or for death or personal injury caused by negligence, or removes rights you have as a consumer.
Indemnity
If you use Inboxies for a business and your use of it, or content you send, leads to a claim against us, you agree to cover our reasonable costs of that claim. This doesn’t apply to consumers where the law doesn’t allow it.
Changes to these terms
We may update these terms. We’ll change the date at the top of this page and, for material changes, tell you by email or in the app at least 30 days before they apply. If you keep using Inboxies after that, the new terms apply; if you don’t agree, you can delete your account.
Disputes
If something goes wrong, write to support@inboxies.email first and we’ll try to sort it out. If we can’t, the courts where you live may hear your claim, and you keep the protection of consumer law where you live. If any part of these terms can’t be enforced, the rest still applies.
Acceptable use policy
Inboxies is for your own mail and your team’s. Don’t use it to:
Send spam
Send unsolicited bulk or commercial email, buy or rent lists, or send to people who haven’t agreed to hear from you. Inboxies isn’t a newsletter or marketing tool, and the sending limits reflect that.
Deceive people
Phish, impersonate someone, forge headers, or pretend to be Inboxies, a company or a public body. Don’t use private email addresses to defraud anyone or get around a ban.
Harm others
Send malware, harass or threaten people, or send or store anything illegal, including material that sexually exploits children, which we report to the authorities.
Abuse the service
Get around limits, for example with many accounts; probe, scan or attack Inboxies or its users; access an account or mailbox you weren’t given; resell addresses; or use the assistant to generate abusive mail.
Break the law
Infringe someone’s copyright, trademark or privacy, or break anti-spam and data protection laws such as CAN-SPAM and the GDPR.
Reporting abuse
If an Inboxies address is sending you spam, phishing or abuse, write to support@inboxies.email with “Abuse” in the subject and include the message with its headers. We may remove content, limit sending, or suspend accounts that break this policy.