Privacy Policy

When you create an inbox, our database stores:

• The randomly generated (or user-chosen) inbox address.
• A salted hash of the inbox password (we never store the password itself in plaintext).
• The timestamp the inbox was created.

When email is delivered to your inbox, we also store:

• The full content of the message (headers, subject, plain-text body, HTML body, attachments metadata).
• Sender address and display name.
• The recipient address (your HuskMail address) and delivery timestamp.

We may also passively log the standard HTTP request metadata that Cloudflare records on our behalf (IP address, user agent, timestamps) for security, abuse mitigation, and debugging. We do not maintain these logs ourselves beyond Cloudflare's default retention.

We collect anonymous, aggregate page-visit metrics on our own servers (page path, referring URL, browser family, country code derived from your IP address by Cloudflare, and how long the page was open). We do not store your IP address, do not set any cookies for this metric, and the per-visit identifier lives in your tab's sessionStorage and is discarded when you close the tab. These first-party metrics are never sent to Google Analytics, Meta, or any other third-party analytics tracker.

Separately, we load Google AdSense to display ads. Google may set its own cookies and process technical signals (IP address, user agent, ad interactions) on its own terms — see "Advertising" below.

• No name, phone number, real email, billing information, or identity verification.
• No third-party analytics that profile users across sites.
• No social-media tracking pixels.

Google AdSense is the only third-party SDK we load and it is used solely for serving ads (see "Advertising").

The HuskMail web app uses your browser's local storage to remember the inbox address, password, and authentication token of the account you are currently logged into. This is required for the Service to function and stays on your device. You can clear it by using your browser's clear-data feature or by clicking the "Burn this inbox" button.

Our own first-party tracking does not set cookies. Google AdSense, however, does set cookies on your browser to serve and measure ads; see "Advertising" for opt-out controls.

We process the data above only to:

• Deliver inbound email to the inbox you created and let you read it.
• Authenticate you when you log back in to an existing inbox.
• Operate, secure, and improve the Service.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable law and respond to verified legal requests.

We do not sell your inbox contents and we do not share email contents with advertisers. Inbox contents are never passed to Google AdSense.

To keep the core inbox free, HuskMail displays ads served by Google AdSense. Google is an independent data controller for the ads it serves and may use cookies, device identifiers, IP address, and ad-interaction signals to select, serve, and measure ads, including personalized ads where permitted.

We do not pass your inbox address, password, message contents, or any other account data to Google. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this and other websites.

You can manage or opt out of personalized advertising:

• Google's ad personalization controls: adssettings.google.com
• Cross-vendor opt-outs: aboutads.info/choices (US) and youronlinechoices.eu (EU)
• How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites

Inboxes are intended to persist for as long as they remain active. However, we reserve the right to delete any inbox and all messages it contains after a period of inactivity, typically 45 days. We may also delete inboxes earlier in response to suspected abuse, security incidents, operational needs, or legal requirements.

When you click Burn this inbox, the inbox and all its messages are immediately deleted from our database.

We rely on the following service providers to operate HuskMail:

• Cloudflare — hosting (Pages), API (Workers), database (D1), email routing, DNS, DDoS protection. Email and account data are stored in Cloudflare's infrastructure. See Cloudflare's Privacy Policy for their practices.
• Google AdSense — serves the ads displayed on the site. Google acts as an independent data controller for advertising cookies and ad-interaction signals. See Section 4a above and Google's privacy policy at policies.google.com/privacy.

We do not transfer your inbox contents or account data to any other processor for advertising, analytics, or profiling.

Depending on where you live, you may have the right to access, correct, delete, or restrict our processing of your personal data, and to object to certain processing.

Because HuskMail collects no identity information, we are usually unable to locate "your" data without knowing the inbox address. To exercise your rights, you can:

• Delete: click Burn this inbox in the account menu — this immediately deletes the inbox and all messages.
• Access: log in to your inbox in the web app to see all messages stored for it.
• Other requests: email [email protected] with the relevant inbox address and details. We may ask you to prove control of the inbox (for example, by logging in or completing a verification step) before acting on the request.

California residents have additional rights under the CCPA, including the right not to be discriminated against for exercising privacy rights. We do not "sell" or "share" personal information as those terms are defined under the CCPA.

HuskMail is operated on Cloudflare's global network. Your data may be stored and processed in data centers outside your country, including the United States. By using the Service you consent to this processing.

We take reasonable measures to protect your data: passwords are hashed and salted, transport is encrypted with TLS, and data is stored in Cloudflare D1. No system is perfectly secure. Because HuskMail addresses are intended to be short-lived and temporary, you should not use them for sensitive information.

HuskMail is not directed to children under 13 (or under 16 in some jurisdictions). We do not knowingly collect personal information from children. If you believe a child has used the Service, contact [email protected] and we will take appropriate action.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Service after a change indicates acceptance.

Privacy questions or data requests: [email protected]
Abuse and content reports: [email protected]