Privacy Policy

1. Who We Are

This page explains how we collect, use, disclose, retain, and protect personal data when you use DevMail.

DevMail is operated by Łukasz Lewandowski in Switzerland. Our processing is subject to the Swiss Federal Act on Data Protection (FADP).

Depending on the processing context and the people affected, this notice may be relevant under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

DevMail applies GDPR-aligned privacy and security controls as a baseline standard across the service, not only where the GDPR legally applies.

DevMail is built for development and QA inbox testing. It is not intended for sensitive, personal, or production communications.

2. What Data We Process

• Account data, such as your login email, password hash, plan, retention settings, and account timestamps.
• Mailbox data, such as generated inbox addresses, received email content, headers, sender/recipient metadata, timestamps, attachment metadata, and retained attachment files. Stored email content and attachments are encrypted at rest as part of our technical and organizational security measures.
• Security and technical data, such as session and authentication records, API-key metadata, limited request and device data, essential cookies, anti-abuse records, and short-lived logs.
• Billing, support, and compliance data, such as subscription status, external billing references, support or privacy request records, and records needed for accounting, security, or legal compliance.

Payment card details are handled by payment providers and are not stored by DevMail.

We use essential cookies needed for sign-in, security, and remembering your cookie preferences. With your consent, we also use Google Analytics 4 to measure visits to our home page, registration form, pricing, and documentation. We do not use advertising cookies or advertising personalization. Analytics does not track inbox or account-settings pages, form submissions, or account activations. We do not collect the contents of registration form fields for analytics. Page addresses sent for analytics contain only the listed public paths, without query strings or fragments. Referrers are limited to external website origins or those public paths on our own website.

Analytics data includes cookie identifiers, public page visits, session and engagement data, browser and device information, and approximate location. This data is not anonymous. We do not send account email addresses, mailbox addresses, message content, account IDs, or verification tokens to Google Analytics. Google receives your IP address to provide the service and derive approximate location. Google states that it does not log or store individual IP addresses from users in the EU, Switzerland, or the UK. For users elsewhere, Google states that it also uses IP addresses for service functions such as spam detection, does not associate raw IP addresses with user identifiers, and discards raw IP addresses after use. See Google's regional privacy information and IP address usage information.

3. Where It Comes From

We receive personal data from three main sources.

• Directly from you when you create an account, sign in, change settings, buy a paid plan, contact us, or make a privacy request.
• Automatically from your browser, device, and use of the service, including session cookies, request metadata, and security or anti-abuse signals.
• Indirectly from emails sent to generated inboxes by third-party senders or sending systems, including sender and recipient metadata, headers, message content, and attachments.

To create and use an account, you must provide the account data needed for sign-up and authentication. For paid plans, you must also provide the checkout and billing data required to complete the purchase and renewal flow.

4. Why We Use It and Legal Bases

We process personal data to run, secure, support, and, with your consent, understand use of DevMail.

• To provide account creation, authentication, inbox access, message retrieval, retention settings, account deletion, billing, and support. Our main legal basis for this is contract or steps taken before entering into a contract.
• To secure the service, prevent abuse, investigate incidents, enforce rate limits, maintain recovery copies, and troubleshoot reliability issues. Our main legal basis for this is our legitimate interests in operating a safe and reliable service.
• To comply with legal obligations, respond to valid legal requests, keep records required by law, and protect or enforce our legal rights. Our legal bases for this are legal obligations and, where appropriate, legitimate interests.
• Optional analytics relies on your consent. Refusing analytics does not affect access to the service. You can withdraw consent at any time using Cookie settings in the footer; this stops future collection and deletes this integration's analytics cookies. Withdrawal does not affect the lawfulness of earlier processing. Accepting our Terms or registering does not grant analytics consent. Changing your cookie choice does not itself delete data already sent to Google. You can contact us to request deletion of previously collected analytics data; we will assess the request under the applicable law. Analytics is not linked to your DevMail account, so account deletion and the account export do not automatically delete or include Google Analytics data.

If you do not provide the required account or billing data, we may not be able to create your account, authenticate you, or complete paid-plan purchase and renewal flows.

5. Who We Share It With and International Transfers

We share personal data only when needed to run the service, support users, or comply with law.

• Email delivery providers for transactional account emails.
• Billing and payment providers for checkout, subscriptions, renewals, and cancellations.
• Logging, monitoring, and support providers.
• Google Ireland Limited, as the provider of Google Analytics, receives optional analytics data when you consent.
• Infrastructure and storage providers that help us deliver the service and maintain short-lived disaster-recovery backups.
• Professional advisers, authorities, or other parties where disclosure is required by law.

Some providers may process personal data outside Switzerland or the EEA, including in the United States, depending on service configuration and provider infrastructure.

Where cross-border transfer rules apply, we use the lawful transfer basis or safeguard required by the applicable law. You can contact us for more information about the transfer basis relevant to your request.

Google Analytics is provided by Google Ireland Limited under the applicable Google Analytics terms and Google data processing terms. Google and its affiliates may process analytics data outside Switzerland or the EEA, including in the United States. Google describes its use of applicable Data Privacy Framework certifications and Standard Contractual Clauses in its international transfer information. Contact us for information about the safeguards applicable to our account. See also how Google uses information from sites that use its services.

6. How Long We Keep It

Mailbox content and attachments follow the plan-based retention setting. Free accounts are retained for 7 days. Pro accounts default to 7 days and can use any whole-day period from 1 through 21 days.

Account profile data is generally kept until account deletion, unless some data is removed earlier for operational reasons such as stale unverified-account cleanup.

Free-account profile, mailbox, generated inbox, and API access data may also be deleted earlier if a free account remains inactive for 60 consecutive days, measured from the last successful login or API-key use. We may try to notify you before deletion, but advance notice is not guaranteed.

Authentication, session, verification, rate-limit, and similar anti-abuse records are kept only for short-lived operational periods.

Billing, support, privacy-request, accounting, compliance, and legal records are kept as long as reasonably needed for those purposes.

Short-lived disaster-recovery backups may temporarily contain deleted or expired data until the rolling backup set rotates out.

You can request immediate account deletion from the in-app Danger Zone. This removes your local account profile, generated inbox identity, mailbox emails, and API-key records from active systems and ordinary retention stores. For active paid subscriptions, deletion may be blocked until cancellation is confirmed.

The essential cookie devmail_analytics_consent remembers your choice, its date, and the consent notice version for 180 days. Optional analytics cookies _ga and _ga_<identifier> distinguish visitors and maintain session state. They expire after 180 days and their lifetime is not renewed on subsequent visits. Google Analytics user-level and event-level retention is configured to two months without resetting retention on new activity. Aggregated reports are not subject to that same retention period.

You should not treat DevMail as an archive or system of record.

7. Your Rights and California Notices

Depending on your location and the applicable law, you may have rights of access, correction, erasure, restriction, objection, portability, and complaint. You may also ask how your personal data is processed.

DevMail offers a self-service JSON export of currently retained account and mailbox data from the Privacy & Data settings page. This export is not a historical archive. It includes account details, plan and retention settings, mailbox usage, retained messages, attachment metadata only, billing subscription summary, and API-key metadata. It does not include secrets, internal-only records, attachment binaries, or data already deleted by retention or account actions.

If your personal data appears in an email sent to a generated inbox and you are not the account holder, you can still contact us and we will assess the request under the applicable law. We may need to verify identity before fulfilling a request, and we may limit or refuse a request where permitted by law.

California residents can also contact us to exercise rights to know, access, correct, delete, and receive a portable copy of personal information, subject to legal exceptions. We will not discriminate against you for exercising applicable privacy rights.

For the last 12 months, our California notice is as follows: we collected identifiers, account records, mailbox content, attachment metadata, internet or network activity information, billing records, and support or compliance records; we collected them from you directly, from your use of the service, from billing and support interactions, and indirectly from emails sent to generated inboxes; we used them to provide and secure the service, process billing, support users, comply with law, and protect our rights; and we disclosed them for business purposes to email delivery, billing/payment, logging/monitoring, infrastructure/storage, and legal or regulatory recipients. With consent, we also collect analytics identifiers and website activity on the listed public pages, to understand public-site use and disclose that data to Google as our analytics provider.

DevMail does not sell personal information and does not share personal information for cross-context behavioral advertising.

8. Security, Changes, and Contact

We use reasonable technical and organizational measures to protect personal data, but no system can be guaranteed 100% secure.

Stored email content and attachments are encrypted at rest as part of our technical and organizational security measures. This helps us protect personal data and strengthen the security of the service.

If we become aware of a personal data breach affecting DevMail data, we will document it, assess notification duties, and notify authorities or affected individuals where required by the applicable law, including under the Swiss FADP and GDPR where relevant.

We may update this Privacy Policy from time to time. If we make a material change, we will update the date at the top of this page.

You can contact us at privacy@devmail.space with privacy questions or requests. You can also use this contact point to exercise applicable data protection rights. Depending on your location, you may also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where applicable, another competent data protection authority.