What we keep, and what we don't.

• Account details. Your name and email address, used to sign you in (we send magic links; there are no passwords) and to contact you about your account.
• Product news. Now and then we email customers about what's new in Postboi. You can say no when you sign up, and every one of these emails has an unsubscribe link; you can also switch them off or on under Account. We keep your answer, and when and where you gave it. These are separate from sign-in links, invites and the notifications you choose, which you get either way.
• Session data. IP address and browser user agent for active sign-in sessions, used for security.
• Send log. For every email sent through the service we log the sender address, recipient addresses, subject line, delivery status (sent, bounced, complained) and the message body. The body is stored to power the message preview in your dashboard; it stays inside your account's log, and is deleted on your retention schedule or with your account. Beyond that it is only read to check for abuse, as the subprocessor list describes.
• Form submissions. Messages posted to your hosted form endpoints are processed the same way as sent email: rendered, delivered to the team member you chose, and stored in your send log. Submissions are spam-checked (and rate-limited) before anything is stored or sent.
• API keys. Stored as one-way hashes; we cannot read them back.
• Usage and billing. Monthly send counts, your plan, and Stripe customer and subscription identifiers. Card details go directly to Stripe and never touch our servers.
• Custom domains. Domain names and DNS verification records you add for sending.

When you send email through Postboi, you are responsible for having a lawful basis to contact your recipients. We process their addresses and your messages on your behalf, solely to deliver mail, track delivery status, keep your log, and catch abuse (bounces, complaints, and a check of a new team's first sends for phishing). For that data you're the controller and we're your processor, on the terms of our data processing addendum.

We use a small number of processors, only for what the service needs to function:

Until you accept cookies, analytics runs in cookieless consent mode and sets nothing. We do not sell your data or share it with anyone else.

We use a session cookie to keep you signed in (strictly necessary), a cookie on the sign-in page that remembers your answer about product news until your account is created, and, only with your consent, Google Analytics cookies to understand how the site is used. You can decline these in the cookie banner and the site works identically.

tempboi.email and the tempboi for Chrome extension give you a temporary email address with no account. Here is everything they handle.

• The mail sent to your address: its sender, subject, text, HTML, attachments and the codes and links we read out of it, so we can show it to you. It is kept only until the inbox expires (a day at most without a Postboi account) or you delete it, and then deleted with the inbox, usually within a minute. We don't read it.
• The inbox's key: we store only a hash of it. The key itself stays in your browser or the extension.
• A salted hash of your IP address when you create an inbox, to limit how many one connection can make. We don't store the address itself.
• A push subscription, only if you turn on notifications, so we can tell your browser when mail lands. It is deleted with the inbox. A notification carries a title and a line about the message, and never the inbox's key.
• The sender's picture: when mail arrives we look up the sender's domain for a verified logo (BIMI, over Cloudflare's DNS), and the page shows the sender's Gravatar, which your browser fetches from Gravatar using a hash of the sender's address. The extension doesn't fetch Gravatars.

The extension keeps your current inbox, its key, the messages it has fetched and your settings in your browser's own storage. It talks to tempboi.email and nothing else, unless you point it at another server in its settings. It doesn't read the pages you visit: when you ask it to fill a field, it writes your address or code into that field and nothing more. There are no analytics in tempboi.email or in the extension, and none of this is sold or shared beyond what is described here.

The content of the mail you send and receive, its bodies and attachments and the webhook deliveries that carried it, is kept for as long as your team chooses in Settings, from 7 days to as long as your account is open, and 1 year if nobody has chosen. Then it's deleted. The record of each message (who, when, the subject and how delivery went) is kept while your account is active, to power your message log and to prevent abuse, and so are form submissions, which are your records. If you delete your account, we remove your personal data, keeping only what we must for legal, billing or anti-abuse reasons.

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email support@postboi.app and we'll sort it out. You can also complain to the ICO (ico.org.uk).

If this policy changes materially we'll note it here and update the date above. Questions? support@postboi.app.