Draft: this text has not been reviewed yet and is not in force. mailbridge sends no invitations until it has been.

Privacy policy

This policy explains what the hosted mailbridge service at mailbridge.alohalabshq.com stores about you, why, for how long, and who else is involved.

Who is responsible

mailbridge is run by Aloha Labs ([to be completed by the owner: Aloha Labs' legal name, postal address and company registration number]), which is responsible for your personal data. Write to privacy@alohalabshq.com about anything in this policy.

What mailbridge does

mailbridge lets AI apps that you connect, such as Claude or ChatGPT, search, read, organize and, if you allow it, send email in the mailboxes you add. When an app asks for something, mailbridge signs in to your mail provider for you and passes the result to that app.

What we store

• Your account: your email address; whether you are invited, active or disabled; whether you are an administrator; when the account was created and when you last signed in; and any sending limits an administrator set for you.
• Signing in: a sign-in link is valid for 15 minutes and is stored only as a hash, with the address it was sent to. A sign-in lasts 30 days; sessions are stored as hashes too.
• Your mailboxes: the name you give each mailbox, its email address, server names and ports, login name and password, and when it last connected or failed. Passwords are encrypted (AES-256-GCM) with a key that belongs to your account alone, and that key is itself encrypted with a server key kept outside the database and outside the backups.
• Connected apps and tokens: each app's name and the web addresses it registered, which of your mailboxes it may use, whether it may send and to whom, and when it was connected and last used. Access tokens are stored only as hashes. An app's registration (its name and web addresses, not linked to a person) is removed by the hourly clean-up once it is more than 30 days old and no connection refers to it, including a disconnected one; deleting your account removes your connections at once.
• Activity log: for each request an app makes, the time, the connection, the tool (for example "search_emails"), the mailbox, whether it worked, and a summary of the request's parameters, such as search terms, folder names, message identifiers and, for messages sent or saved as drafts, the recipients and subject. Message bodies are never logged. Entries are deleted after 90 days. The Activity page shows you your own entries, without the parameter summary.
• Waitlist: the address and note you leave. Entries that are not invited are deleted after 180 days. When you are invited the note is deleted, and the entry is kept until your account is deleted.
• Limits: to prevent abuse, mailbridge counts requests per IP address and per account (sign-in requests, waitlist entries, app registrations) and mailbox sign-in checks; the counts for requests are held in memory and forgotten after at most an hour. Mailbox sign-in checks count for 10 minutes and are stored with your account number until the next hourly clean-up.
• Server logs: errors and security events, which can include IP addresses, account numbers, the names you gave your mailboxes and the technical text of unexpected errors (which can contain details from mail servers, such as addresses or folder names). mailbridge does not write passwords, access tokens or message bodies to the logs. Logs are kept to at most 50 MB per service, so the oldest lines are dropped first, and a service's logs are also removed when its container is replaced, which every update does for mailbridge. They are not part of the backups. Error reports emailed to the operator contain no personal data: only the kind of error, where in the code it happened and the time.

What we do not store

mailbridge never stores the content of your email: message bodies and attachments are fetched from your provider when an app asks for them, handed to that app, and not kept. There is no advertising, no analytics and no tracking, and we do not sell your data or share it for marketing.

Cookies

mailbridge sets two cookies, both needed for the service to work and neither used for tracking: __Host-mb_session keeps you signed in (30 days, or until you sign out), and __Host-mb_connect protects you while you connect an app (10 minutes). The pages load nothing from other websites.

Who else is involved

• Your mail provider (for example Google or Apple), which mailbridge signs in to with the details you gave. Its own privacy policy applies.
• The AI apps you connect receive the mail and information they ask for, within the mailboxes and permissions you chose. Their own terms and privacy policies govern what they do with it. You can disconnect an app on the Connections page at any time.
• Hetzner Online GmbH runs the servers and stores the encrypted backups, in data centres in Germany.
• [to be completed by the owner: the provider that delivers sign-in emails, and its country] delivers sign-in and invitation emails, so it handles your email address.
• Finding your mail settings: when you add a mailbox, mailbridge looks up your address's domain in public DNS, may fetch the mail settings the domain publishes (autoconfig.<your domain>), and may ask Mozilla's settings database at autoconfig.thunderbird.net. These lookups contain the domain only, never your full address.

Where your data is

mailbridge stores and processes your data in Germany, in the European Union. The mail providers and AI apps you choose may be elsewhere.

How long we keep it, and deleting your account

We keep your account data for as long as you have an account. Delete my account on the Account page removes your mailboxes, passwords, connected apps, tokens, sessions and activity from the live database at once. Encrypted backups are kept for 30 days, so copies of deleted data disappear from them within 30 days: deletion is complete within 30 days. To remove a waitlist entry, write to us.

Security

Connections to mailbridge and from mailbridge to mail servers are encrypted (TLS). Mailbox passwords are encrypted as described above. Backups are encrypted before they leave the server, with a key separate from the one that protects the passwords. Only the operator has access to the server.

Your rights

You can ask for a copy of your data, have it corrected or deleted, ask us to restrict or stop processing it, and receive it in a portable format. In the dashboard you can change a mailbox's password, remove a mailbox, disconnect an app and delete your account; for everything else, write to privacy@alohalabshq.com. You can also complain to a data protection authority, for example the one where you live.

Why we process your data

To provide the service you asked for (your account, mailboxes, connections and the requests your apps make), and in our legitimate interest in keeping the service secure and free of abuse (logs, limits and the activity log). We keep waitlist entries because you asked to be invited.

Children

mailbridge is not meant for anyone under 16.

Changes

We will email account holders before a material change to this policy takes effect.