Privacy Policy

Last updated 8 October 2026

This policy explains what personal data Mailions ("we", "us") handles when you use the website, panel, mailboxes, webmail, sending API and public temporary inboxes, and what your rights are.

What we collect and why

  • Account data: your name, email address and a hashed password (or your Google account ID and profile picture if you sign in with Google). We use it to run your account and contact you about it. Basis: the contract with you.
  • Your domains and settings: domains, DNS records, DKIM keys (stored encrypted), mailbox names, aliases, filters, signatures and API key names (the keys themselves are stored only as hashes). Basis: the contract with you.
  • Mail content: the messages in your mailboxes, drafts and sent copies are stored on our mail server for you. We process them to deliver, filter spam and viruses, and show them in webmail. We do not read your mail except where needed to fix a problem you ask us about, or to investigate abuse or comply with the law.
  • Send logs: for mail sent through the API or webmail we keep the sender, recipients, subject, time and delivery outcome for 90 days, so you can see what happened and so we can investigate problems and abuse. Basis: the contract, and our interest in running a safe service.
  • Technical and security data: IP addresses and attempt counters used to limit sign-in attempts and abuse (kept for a short time, normally under a day), the session cookie that keeps you signed in, and logs kept by our server software.
  • Phone notifications, if you switch them on: the push subscription of your device, which is created by your browser and your platform's push service.
  • Messages you send us through the contact form or by email, so that we can answer them.
  • Analytics, only if you accept it in the cookie notice: anonymous usage statistics through Google Analytics, to improve the website. Basis: your consent, which you can withdraw at any time.

Public temporary inboxes

These are public by design. Anything sent to a public temporary address can be read by anyone who opens that address, and is deleted about 30 minutes after it arrives. Do not use them for personal or confidential mail.

Who we share data with

We do not sell personal data. We share it only with:

  • The recipients of your mail, and the mail servers that carry it.
  • Service providers who help us run the service, such as our hosting provider and, where enabled, Cloudflare for bot protection on sign-in forms, Google for "Continue with Google" and analytics, and the Google, Apple, Mozilla or Microsoft push services if you turn on phone notifications.
  • Authorities, when the law requires it or to protect the service and others from serious abuse.

How long we keep data

  • Account and settings: until you delete your account (you can do this yourself); then deleted unless the law requires us to keep it.
  • Mail: until you or the mailbox owner delete it, or the mailbox or domain is removed. Messages in Trash and Spam stay until deleted.
  • Send logs: 90 days.
  • Security counters and sessions: from minutes to a few days, then removed automatically.
  • Backups: copies kept for about 14 days, after which deleted data disappears from them too.

Cookies

We use one essential cookie that keeps you signed in and protects forms against forgery. It does not track you. Analytics cookies are used only if you accept them in the cookie notice; you can change your choice at any time with "Cookie settings" in the footer.

Security

Passwords are stored as slow, salted hashes; you can add two-factor sign-in with an authenticator app (its secret is stored encrypted); DKIM private keys are encrypted; connections use TLS; and access to the server is restricted. No system is perfectly secure, so use a strong, unique password.

Your rights

Depending on where you live you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to some processing, or to move it to another provider, and you can withdraw consent you gave. You can also complain to your data protection authority. You can download a copy of your data and delete your account yourself under Account > Your data (deleting also erases the mail stored in your mailboxes, and cannot be undone). For anything else, contact us below. We may need to confirm your identity first.

International transfers and children

Our providers may process data in other countries; where that is outside your region we rely on the safeguards the law provides. The service is not meant for children, and we do not knowingly collect their data.

Changes and contact

If we change this policy we update the date above, and tell you if the change is significant. Questions and requests: [email protected] or the contact form.