Privacy Policy

1. Scope

This policy covers three things: the tinbox.dev website, buying a Tinbox license, and contacting us. It does not cover your own self-hosted Tinbox deployment. Tinbox is self-hosted software you run inside your own Cloudflare account; for that mail, contacts, and sending credentials, you are the data controller, not us. We never receive them.

2. What we collect when you browse tinbox.dev

Almost nothing. This site is static and self-hosted: no web fonts, no advertising or tracking pixels, and no third-party scripts except one — a privacy-friendly, cookieless analytics tool (Plausible) that counts page views and clicks in aggregate. It sets no cookies, stores no personal data, and doesn’t track you across sites or build a profile of you. A build test keeps every other external request out, so that’s the only thing that loads when you visit.

At most, the server and CDN that deliver the page keep standard, short-lived request logs (such as IP address and user-agent) for security and reliability, the way any web server does. We don’t use these to build a profile of you or to track you across sites.

3. The Tinbox software & your mail

There is no Tinbox server in the path of your email. When you deploy Tinbox, it runs on your Cloudflare account, and your messages, contacts, archive, and sending keys stay there. Your correspondence does not pass through, and is not stored on, any system we operate. The one exception is a message someone in your deployment explicitly reports as spam, which is sent to our shared classifier unless you turn that off — see §4 for that and for every other call a deployment can make to us.

Because of that, for the mail handled by your deployment you are the data controller and Tinbox is not a processor of it. How that mail is collected, used, and retained is governed by your own privacy practices and the agreements you have with your subscribers and contacts.

4. What your deployment can send us

Your mail, contacts, archive, and keys stay in your account. Beyond that, there are exactly three calls a deployment can make to us, and each one is listed here with its own switch. Nothing else is sent, and none of it is used for advertising or profiling.

• The version check — on, no identifiers. A best-effort check for a newer release. It reads a public version number and nothing else: no account identifiers, no telemetry, and nothing about you, your deployment, or your mail. Turn it off by setting TINBOX_NO_UPDATE_CHECK=1 in your environment.
• Spam reports — on by default. When someone in your deployment reports a message as spam, a copy of that message is sent to our shared spam classifier so filtering improves for everyone: the sender address and name, the subject, the authentication results, the spam score and reasons, the link hosts, and the message body (truncated). Recipient addresses are reduced to their domains, and the Message-ID is hashed. This applies only to messages a person explicitly reports — never to the rest of your mail. It is a checkbox under Settings → Security → Spam reporting, and unchecking it stops the sending entirely.
• Fleet diagnostics — off by default. An org admin can opt a deployment in to sending us bounded, redacted crash diagnostics so we can find and fix faults across deployments. There are two levels: aggregate (counts of errors by release, pipeline stage, and error code, plus a hashed fingerprint — no text, no stack traces, no identifiers) and detailed (also the redacted exception message, redacted stack trace, and route template). Neither level carries mail content, subjects, addresses, or contact records. It starts off, installing or upgrading never turns it on, and no other setting — spam reporting, your license, or managed hosting — implies consent to it. Aggregate counts cannot be selectively deleted per deployment and expire after 90 days; detailed incidents expire after 30, and a valid signed deletion request purges them before acknowledgement. It lives under Settings → Observability → Fleet diagnostics, and every change to it is recorded in an audit log that stays on your own database.

The monitoring providers you configure elsewhere in Settings → Observability — your Sentry, your PostHog, your OTLP collector, your Cloudflare account — are yours. Those signals go to you, not to us.

5. Information you give us directly

The only personal data we ever receive is what you choose to send us:

• License purchase. When you buy a lifetime license, we receive your name and email address so we can deliver the license and provide support. Payment is handled by a third-party payment processor: we never see or store your full card number.
• GitHub issues. If you open an issue or comment on GitHub, we receive your GitHub handle and whatever you write there. Please don’t paste secrets, real recipient data, or anything sensitive into a public issue.

6. How we use it

We use the little we collect only to fulfil your license, provide support, and respond to you. That’s the whole list. We do not sell your data, and we run no advertising or ad-tech: there are no trackers to feed.

7. Sharing

We share your information only where it’s genuinely needed to run the project:

• Our payment processor, to take a one-time payment for the license.
• GitHub, when you choose to interact with us there.

We do not share or sell your information to advertisers, data brokers, or anyone else.

8. Data retention

We keep purchase records (such as your name, email, and a receipt) for as long as needed to honor your lifetime license and to meet our legal and accounting obligations. Everything else is kept to a minimum and removed when it’s no longer needed. Public GitHub content lives on GitHub under its own retention.

9. Your rights

You can ask us to access, correct, or delete the personal data we hold about you, and we’ll honor those requests consistent with the GDPR, the CCPA, and similar laws, subject to records we’re legally required to keep. Because we hold so little, these requests are usually quick.

For the mail inside your self-hosted deployment, there’s nothing to request from us: you already hold and control all of it directly in your own Cloudflare account.

10. International users

We collect so little personal data that cross-border transfers are minimal, limited to delivering a license and responding to you via our payment processor and GitHub. The residency of your mail is wherever your Cloudflare account is configured to store it, which is entirely your choice.

11. Changes to this policy

If we change this policy, we’ll update the “Last updated” date above. Given how little we collect, we don’t expect material changes often; when one happens, it will be reflected here.

12. Contact

Questions about this policy, or want to exercise a right above? Reach us at hello@tinbox.dev. Please don’t include sensitive personal data in a public issue.