Cloudly Inbox (“we”, “us”) provides email on your own domain. We're based in California, in the United States. This policy explains what we collect when you use cloudlyinbox.com and your Cloudly Inbox mailbox, why, and what you can do about it.
There are two kinds of information here. Your mail (messages, attachments, contacts and calendars) is yours: we store it to provide your mailbox and don't read it, use it or share it for anything else. Account and website information is what we need to run the service, described below.
What we collect
When you join the waitlist
When you finish the sign-up form while Cloudly Inbox is on a waitlist, we receive:
- your name, and your business name if you give it
- the email address you give us to contact you
- the address you'd like, such as [email protected], and whether your domain is already registered
- the plan, billing period and number of mailboxes you chose
Nothing is charged, and no account is created.
When you create an account
- Your name, business name if you give it, and the email address you sign in with.
- Your account password, which we store only as a scrambled one-way hash. We can't see it.
- Your order: the address you chose, your domain, plan, billing period, number of mailboxes and whether you chose the free trial.
- Your IP address and approximate location (city, region and country) when you sign up, to help spot fraud and abuse.
When you pay
Payments are handled by Stripe. You enter your card on Stripe's payment page, and your card details go to Stripe, never to us. Stripe may also ask for your billing address, for tax. From Stripe we receive your customer and subscription references, your plan, whether payments succeed and when your plan renews or ends. Stripe's own use of your information is covered by Stripe's privacy policy.
When you set up your domain
To check that you own your domain and that its email records are in place, we look up its public DNS records. If you use one-click setup, your domain provider receives the records to add and asks you to approve them. We make a signing key for your domain (DKIM) so that mail you send can be recognised as genuinely from you.
Your mailbox
- Your mail, contacts and calendars are stored on our mail server so you can reach them from webmail and your mail apps. Incoming mail is checked automatically for spam. Nobody at Cloudly Inbox reads your mail, except when you ask us to help with a problem and give permission, or when the law requires it.
- Your mailbox password is stored by the mail server as a hash. The website also keeps a hash of it, so webmail can turn away wrong passwords before they reach the mail server.
- The mail server's logs record technical details of connections and deliveries, such as IP addresses, times, and sender and recipient addresses, to keep the service secure, enforce sending limits and fix delivery problems.
- Sending limits: if a mailbox reaches its daily sending limit, we're alerted with the address and the time, so we can spot a stolen password or spam.
When you use webmail
When you sign in to webmail, the website keeps your mailbox password encrypted for as long as you stay signed in (up to 30 days, or until you sign out), so it can fetch your mail for you. It's deleted when you sign out or the session ends. Webmail settings that mail apps have no place for, such as your VIPs and signature designs, are stored with your mailbox.
Profile pictures
If you add a profile picture in webmail, it's stored with your mailbox and shown next to your name to people you email who also use Cloudly Inbox. Webmail shows other senders' pictures by looking up their company's published logo (BIMI) or their Gravatar picture. We look these up from our servers, so senders and Gravatar never see your IP address, and we keep the results for a day.
When you send mail with read receipts
When read receipts are on, mail you send from webmail carries a tiny invisible image and, on the Pro plan, links that pass through our website first. When someone you wrote to opens the message or clicks a link, we record the time, whether it was a phone or a computer, and whether it looks automatic (such as Apple Mail loading images as mail arrives). We don't store their IP address or location. Only you, the sender, can see this, and it's deleted after 90 days. You can turn read receipts off for any message, or for all mail in webmail's Settings.
When you bring your old mail over
If you copy mail from another provider, we use the address and password (or app password) you give us for that account only to read your mail there and copy it into your mailbox. The password is kept encrypted, only while we copy and keep catching up on new mail, and deleted as soon as the move finishes or you stop it. Nothing is changed or deleted in your old account. Mail files you upload are stored only until they've been copied, then deleted. Contact and calendar files are read in your browser and added to your mailbox.
When you contact support
When you send a message from the support page, or email [email protected], we receive your name, your email address and your message. With messages sent from the support page, we also record your IP address and approximate location.
When you visit the website
The first time you visit from a browser, we record:
- the page you arrived on, and the site or campaign that sent you, if any
- whether you're on a phone, tablet or computer
- your browser's language
- your IP address, and the approximate location our hosting provider works out from it (city, region and country)
When you choose a plan's sign-up button, we record which plan and billing period you chose. We use these to understand where visitors come from and to spot abuse.
Cookies and your browser's storage
We don't use advertising or tracking cookies, and we don't build profiles of you across other websites. We use:
- Sign-in cookies: one keeps you signed in to your account and one to webmail, each for up to 30 days or until you sign out.
- A note in your browser's storage that recognises a browser that has visited before. Clearing your browser's site data removes it.
Things that stay in your browser
- The sample mailbox runs entirely in your browser on made-up data. Nothing you type or send there leaves your device.
- The address check asks public domain registration databases (RDAP) whether a domain is registered. The domain name you type is sent from your browser to those public services, not to us.
- Your billing choice (yearly or monthly) is kept for your visit so sign-up remembers it.
How we use it
- To provide your mailbox: storing, sending and receiving your mail, and setting up your domain.
- To charge for your plan, through Stripe.
- To email you about your account: confirming your order, telling you when your mailbox is ready and live, resetting your password, and telling you when your plan ends. These come from [email protected]. Stripe also emails you receipts, and reminders if a payment fails.
- To email you when Cloudly Inbox opens, if you joined the waitlist.
- To answer your support messages.
- To keep the service secure: spotting fraud, stolen passwords and spam, and enforcing sending limits.
- To understand how people find and use the website, so we can improve it.
- To meet legal obligations, such as tax records.
We don't sell your personal information, we don't share it for advertising, and we never use the content of your mail for advertising or to train AI models.
Who helps us run it
We use a small number of service providers, who handle information only to provide their service to us:
- Cloudflare hosts the website and its database (your account, orders and webmail sessions), and protects it from attacks. To deliver pages, Cloudflare processes technical information such as your IP address. Cloudflare's public DNS service answers our checks of your domain's records.
- Hetzner hosts our mail server in Germany, and Cloudflare R2 stores the content of its messages in Western Europe. Your mail, contacts and calendars are stored there, as are support messages and our emails to you.
- Stripe processes payments.
- Baseplate receives and stores the waitlist, sign-up, order, support and visit records described above, so we can read them.
- Your domain provider, if you use one-click setup, receives the DNS records to add to your domain.
Mail you send goes to its recipients' mail providers, as with any email. We may also disclose information if the law requires it, to protect the rights and safety of our customers or others, or as part of a sale or merger of our business, in which case this policy continues to apply.
Where it's stored
Your mail is stored in Germany and Western Europe. Account and website records are stored by Cloudflare, Stripe and Baseplate, which may process them in the United States and other countries.
How long we keep it
- Your mail is kept while your plan is active. If your plan ends, your mailbox and mail are kept for 30 days so you can save anything you need or restart the plan. After that they're deleted for good, along with the website's hash of your mailbox password.
- Your account is kept until you ask us to delete it. Records of payments are kept as long as tax and accounting laws require.
- Webmail sessions are deleted when you sign out, or after 30 days.
- Read receipts (opens and clicks on mail you sent) are deleted after 90 days.
- Waitlist details are kept until Cloudly Inbox opens and you've had the chance to sign up, or until you ask us to delete them.
- Support messages are kept for as long as we need them to help you.
- Visit records are kept only to understand trends over time.
Your choices and rights
- You can ask to see, correct, export or delete the information we hold about you, or to be removed from the waitlist, at any time.
- You can read and save your mail at any time with a mail app, including during the 30 days after a plan ends.
- You can cancel your plan from your account page whenever you like.
- If you live in California or another US state with a privacy law, you have these rights under that law, and we won't treat you differently for using them. We don't sell or share personal information as those laws define it.
- If you're in the European Economic Area or the UK, you also have the right to object to or restrict how we use your information, and to complain to your local data protection authority. We use your information to provide the service you signed up for, to meet legal obligations, and for our legitimate interests in keeping the service secure and improving the website.
- You can stop us recognising your browser by clearing this site's data in your browser.
To make a request, contact us using the support page. We may need to confirm it's you before acting on it.
Children
Cloudly Inbox is for businesses and is not directed to children under 13. We don't knowingly collect information from them.
Security
The website and mail server accept only encrypted connections from webmail and mail apps. Passwords are stored as one-way hashes, webmail keeps your mailbox password encrypted while you're signed in, and mail you send is signed for your domain. Email between mail providers is encrypted when the other provider supports it. No method of storing or sending information is completely secure, but we work to protect what you give us, and we'll tell you if a breach affects your information.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll tell you by email first.
Contact
Questions or requests about your privacy: use the support page, or email [email protected].