Privacy Policy

Ghostbox exists to protect your real inbox, so we try to collect as little as possible. This policy explains what we process, why, and the choices you have.

1. What we collect

When you use inboxes without an account

• Email you receive — sender, recipients, subject, body, headers, attachments and the raw message, stored only for your plan's retention period.
• A random guest identifier stored in a cookie, so you can see your inboxes again on the same browser.
• IP address of requests and of inbox creation, used for rate limiting and abuse prevention.
• Preferences (theme, username length, auto-refresh) stored locally in your browser.

When you create an account

• Google profile basics — email address, name, profile picture and Google account ID, received when you sign in with Google. We never receive your Google password.
• Account data — plan, API keys (stored hashed), webhooks, custom domains, inbox passwords (stored hashed), sign-in times and IP addresses.
• Payment records — plan, amount, status, chosen cryptocurrency and the payment provider's transaction ID. We never see or store your wallet's private keys; payments are handled by NOWPayments.

2. How we use data

• To deliver, display and automatically delete your email.
• To detect one-time codes and verification links in messages for your convenience (processed automatically, never read by staff).
• To operate accounts, plans, API access, webhooks and billing.
• To prevent spam, fraud and abuse, enforce our Terms, and keep the Service secure.
• To compute aggregate, anonymous statistics (e.g. total emails processed).

We do not sell your data, show ads, or use message content to build advertising profiles.

3. Legal bases (EEA/UK)

We process data to perform our contract with you (providing the Service), for our legitimate interests (security, abuse prevention, improving the Service), to comply with legal obligations, and with your consent where required (e.g. desktop notifications).

4. Retention

• Messages: deleted automatically when their retention period ends (24 hours on Free, up to 30 or 90 days on paid plans), or immediately when you delete them.
• Inboxes: deleted when they expire; guest inboxes can also be deleted at any time.
• Accounts: kept until you delete your account from the dashboard, which removes your inboxes, messages, API keys and webhooks.
• Payment records: kept as long as needed for accounting and legal obligations.
• Server and security logs: kept for a short period (typically up to 30 days).
• Backups: overwritten on a rolling basis (typically 14 days).

5. Sharing

We share data only with service providers needed to run Ghostbox, under appropriate safeguards:

• Google — sign-in (OAuth).
• NOWPayments — cryptocurrency payment processing.
• Our hosting provider — servers that store the database.
• Webhook endpoints you configure — receive message data you instruct us to send.

We may disclose information if required by law or a valid legal process, or to protect the rights, safety and property of users or the public.

6. Cookies

We use only essential cookies: a session cookie when you're signed in, a guest-ID cookie that links your browser to your inboxes, and a short-lived cookie during Google sign-in. We don't use advertising or third-party tracking cookies. Remote images in emails are blocked by default so senders can't track when you open their mail.

7. Security

Data is transmitted over HTTPS, API keys and inbox passwords are hashed, email HTML is sanitized and rendered in a sandbox, and access to production systems is restricted. No system is perfectly secure, so please don't use disposable inboxes for sensitive communication.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your personal data, and to object to processing or lodge a complaint with a supervisory authority. You can delete messages, inboxes and your entire account yourself at any time. For other requests, contact us at support@ghostbox.fun.

9. Children

The Service is not directed to children under 16, and we don't knowingly collect their personal data.

10. International transfers

Our servers and providers may be located outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

11. Changes

We'll post updates to this policy here and update the date above. Material changes will be highlighted on the website.

12. Contact

Privacy questions: support@ghostbox.fun.