Privacy Policy

MailHow LLC is the data controller for the personal data described here. The entity that decides what is collected and why, and the one you hold to account. Reach us at hello@mailhow.com for anything in this policy, including the rights listed below.

Your mail and account data are stored on servers we rent and administer in Germany, so this policy is written to the GDPR whether or not you live in the EU.

Your mail. Messages you receive and send are stored on our mail server so that you can read them. That is the product. They stay until you delete them or close your account.

Account data. Your account email address, a hash of your password (we never store the password itself), the domains you connect, your storage usage, and standard technical logs (connection times, IP addresses, delivery logs) kept for abuse prevention and debugging, retained for at most 30 days.

Sign-up details. When you create an account we record the country your sign-up came from (derived from your IP address), the site that referred you, the page you landed on, and your browser’s user-agent string. We use this to prevent fraud and abuse and to understand where sign-ups come from. It is never sold or shared, and you can request a copy or deletion at any time (see “Your rights” below).

DMARC reports for your domains. When you connect a domain, the DMARC record we suggest asks receiving mail servers (Gmail, Outlook and the rest) to send us their daily aggregate reports about that domain, and we show you the results. These reports describe mail claiming to be from your domain, including the IP addresses of any other services you send from, and of anyone spoofing you, but never message content, subjects, or recipients. We use them only to show you your own authentication results. You can switch this off per domain on the Domains page, and your domain stays fully verified either way.

Cookies. One session cookie that keeps you signed in. No analytics trackers, no advertising cookies, no third-party scripts on any page.

We do not read your mail except when strictly required to operate the service (e.g. automated spam filtering, or investigating a delivery failure you report). We do not sell, rent, or share your data with advertisers or data brokers. We do not train AI models on your mail.

Mail is stored on our servers at OVH (Germany, EU). The web application runs on Vercel, and account metadata (not message content) is stored in a PostgreSQL database on those same OVH servers (Germany, EU). Outbound mail leaves from a second OVH server, also in Germany. Encrypted offsite backups are held in Amazon S3 (eu-central-1, Germany). DNS for mailhow.com is served by Cloudflare. Each of these providers processes data on our behalf under their own data-processing agreements.

Honest caveat: email as a protocol travels between servers, and while MailHow uses TLS for every connection it can, delivery to and from other providers is only as private as those providers make it. Mail stored on our server is protected by access controls and per-account isolation; it is not end-to-end encrypted.

You can access all your mail at any time over IMAP or the web app (that is your export, in standard formats). Email hello@mailhow.com to request a copy of your account data, correct it, or delete your account. Deletion removes your mailbox, messages, and account records within 30 days, except minimal records we must keep for legal reasons. If you are in the EU/EEA, these are your GDPR rights to access, rectification, erasure, and portability; you also have the right to complain to your local supervisory authority.

Privacy questions: hello@mailhow.com. We will update this policy as the service evolves and announce material changes by email before they take effect.