Privacy

Last updated November 11, 2026

What we don't keep

• Your messages. Message bodies, subjects and attachments are not stored. A message stays on our server only until your inbox accepts it, and is then deleted. That's normally a second or two. It takes longer only if your provider is temporarily unavailable, and never more than five days.
• Tracking. No analytics, advertising or tracking pixels, on this site or in the app. This site sets no cookies.

What we keep, and why

• Your account: your sign-in email and a hashed password, so you can sign in.
• Your mailboxes: the real addresses you add, so we know where to deliver.
• Your aliases and any notes you write on them.
• Contacts: the address and name of people who write to an alias, or that you write to from one, so replies route back correctly. You can block or delete them.
• Activity: for each message, when it arrived, which alias and contact it involved, and its spam score. Never its content. Deleted automatically after 30 days.
• Delivery log: a technical record of whether each message was delivered, deferred or rejected, including the addresses involved, so we can fix delivery problems. Visible only to maskmx administrators and deleted after 14 days.
• Access requests: if you request access, your email and any note, until we've replied.

How your mail is handled

Mail to an alias arrives at our server, is checked automatically for spam and forged senders, has its headers rewritten so the sender sees only the alias, and is sent on to your inbox. Replies work the same way in reverse. Connections to other mail servers are encrypted whenever the other side supports it.

To forward a message, our server has to process it, so maskmx is not end-to-end encrypted: like any email provider, the server handles messages in transit. That processing is automatic; no person reads your mail.

Who else is involved

• Our mail server, which we operate ourselves.
• Supabase, which hosts our database and sign-in, in the United States (Ohio). It stores the account, alias, contact and activity data described above.
• Let's Encrypt, which issues our security certificates. It receives no personal data.

We don't sell or rent data, and we don't share it with anyone for marketing. We disclose information only when the law requires us to, and only what is required.

Your choices

• Turn any alias off, or delete it, at any time. A deleted alias can never be reissued to anyone else.
• Block any contact from reaching you.
• Ask us to delete your account and everything linked to it, or for a copy of your data, by writing to [email protected].

Changes

If we change this policy, we'll update the date above and, for anything significant, tell account holders by email first.

Contact

Questions about privacy: [email protected].