Privacy Policy

We collect the minimum data needed to run your email. We do not sell your data and we do not show you ads. We advertise on Meta and OpenAI a few times a year. During those campaigns our public pages carry that platform’s measurement pixel; the rest of the year they are switched off, and neither ever runs inside the signed-in app.

• Account information: your name and email address. Magic-link authentication means we do not store an account password.
• Email data: messages, attachments, headers, and delivery metadata required to provide the service.
• Domain and mailbox configuration: domain names, DNS status, mailbox addresses, and display names you configure.
• Billing data: Stripe customer identifiers and subscription status. Stripe processes payment details; we do not store card or bank details.
• Partner program: Affonso runs our partner program. Our marketing and sign-in pages load Affonso’s script from our own server. The script contacts Affonso only when you arrive through a partner’s link: it then sends Affonso, through our server, your IP address, the partner’s link, the referring page, and your browser’s user agent, and sets the affonso_referral cookie for 60 days. When you start a subscription, we pass that cookie’s value to Stripe. If you subscribe through a partner’s link or with a partner’s discount code, Affonso receives from Stripe the customer identifier, email address, and payments of that subscription, so it can credit the partner. If you are a partner, Affonso holds your name, email address, and the payout details you give it. Partners see the visits and the amounts paid through their own links and codes, never your name, email address, email content, or account data.
• Calendar location autocomplete: after you type at least three characters, Shipmail sends the address query, interface language, a session token, your approximate country, and your approximate location to Google Maps. The location is estimated from your IP address by our network provider, Cloudflare, and rounded to about 10 km before it reaches Shipmail; Google uses it to rank nearby places first. When you select a suggestion, we send its place ID and store the returned address with your event. We do not log or cache address queries or suggestion text. To prevent misuse of paid lookups, we retain hashed session tokens and place IDs, linked to internal user and organization identifiers, for up to five minutes.
• Audit and security logs: IP addresses, user agents, and actions performed in the dashboard or API for security and debugging.
• Analytics: limited pageview, product milestone, plan, count, boolean, and internal identifier data in PostHog. Sensitive inputs are masked and URLs are redacted. We do not send email content, prompts, generated drafts, mailbox addresses, API keys, payment details, support content, or secrets to PostHog. Session replays can show the domain names you configure.
• Advertising measurement: while a Meta ad campaign is running, if you arrive from one of our ads we store the Meta click identifiers, the IP address, the user agent, and the country of your sign-up request for up to 120 days, so we can report back that the sign-up, trial, or subscription happened. We send Meta a hashed form of your email address, name, country, and account identifier, along with the plan value. We never send your email content, mailbox addresses, or domain names. While an OpenAI ad campaign is running, the OpenAI pixel on those same pages sends OpenAI a hashed form of the email address you type into sign-up, so OpenAI can report that the sign-up came from one of our ads. It receives nothing else about you from us.
• Newsletter open and click tracking: when a customer turns on tracking for a newsletter, Shipmail records, on the customer’s behalf, when each recipient of that newsletter opens it (through a small image) and which of its links they click, with the network derived from the IP address and the user agent. We keep these records for as long as the newsletter’s recipient records. When the newsletter also appears in an Atom feed, clicks on its feed links are recorded with the link, the time, and the user agent, and with no identifier of the person who clicked; we keep them for as long as the newsletter.
• Newsletter subscriber country: when someone signs up to a customer’s newsletter, confirms the signup, or first clicks a link in a newsletter with tracking on, Shipmail stores, on the customer’s behalf, the two-letter country our network provider (Cloudflare) reports for that request, if the subscriber has none yet. We store only the country code, not the IP address, and keep it for as long as the subscriber’s record.
• Newsletter website visits: Shipmail counts visits to a customer’s newsletter website on the customer’s behalf, without cookies and without storing anything on the visitor’s device. For each visit we record the page, the referring site, and a visitor hash made from the IP address and the user agent with a random key that changes every day and is deleted after that day, so a visitor cannot be identified or followed from one day to the next. We never store the IP address or the user agent. We keep daily totals for up to 400 days. A customer may also add their own analytics provider to their website; that provider then processes visitor data under the customer’s responsibility.
• Never-email list: when a newsletter sent through Shipmail bounces because the address does not exist, or because the address is a spam trap, we add the address to one list that applies to every Shipmail customer, so no newsletter is sent to it again. The list holds only a keyed cryptographic hash of the address, a reason, the receiving server’s explanation with the address removed, and a date. An address that does not exist stays on the list for 180 days; a spam trap stays until we remove it. The list blocks newsletter and marketing sends only, never your mailbox mail. To ask whether an address is on the list or to have it removed, contact us.
• Email deliverability test: when you send a message to an address from our free deliverability test, we read it once to build the report and then delete the raw message, at the latest one day after it arrives. We keep the report for 7 days: the test results, the From and Subject lines, the domains and DKIM selectors that signed the message, and the IP address and name of the server that sent it. We never keep the message body, never forward the message, and never reply to it. If you run the test in the Shipmail app and ask to be notified, we also keep your device's notification token with the test until we send that one notification. If no message arrives, the token is deleted with the test, at most 7 days after the test address expires. A DMARC report you open in the Shipmail app is sent to our server to be read; we return the summary and do not keep the file or its contents.
• Crash diagnostics: Sentry receives crash reports from the production web app and from preview and production mobile builds. Mobile reports contain a generic error description, stack file and line locations, app version, build and environment, allow-listed non-unique device and operating-system details, and bounded operational tags. Mobile performance tracing and diagnostic breadcrumbs are disabled.
• Diagnostic limits: Sentry’s default collection of personal information is off. We do not set a Sentry user from your Shipmail account. Before a mobile event is sent, the app removes exception text, request data, user identity, email addresses, subjects, message bodies, arbitrary tags, unique device fields, and source-code context. The mobile app does not enable failed-request capture, screenshots, view hierarchy capture, session replay, or user-interaction tracing. The web app removes request bodies, cookies, query strings, and route identifiers before it sends error events.

We use a session cookie to keep you signed in. PostHog may use first-party browser storage to connect pageviews, sessions, and product events. While a Meta ad campaign is running, our marketing and sign-in pages load the Meta pixel, which sets the first-party _fbp cookie and, if you arrived from one of our ads, _fbc. Those record the ad click, not your activity inside Shipmail. The OpenAI pixel behaves the same way during an OpenAI campaign and sets the first-party __oppref cookie, which holds the click reference from the ad you arrived through. Outside campaign periods we set no advertising cookies, and no advertising pixel ever runs in the signed-in app. If you arrive through a partner’s link, Affonso’s script sets the first-party affonso_referral cookie, which holds that partner click for 60 days, and affonso_data, which holds details of the click. Some blog posts embed a YouTube video. Nothing from YouTube loads until you press play, and the player then loads from youtube-nocookie.com. From that point, YouTube may store data in your browser under its own privacy policy.

• Deliver and store your email.
• Authenticate you and protect your account.
• Process subscription payments through Stripe.
• Send transactional messages such as magic links, billing alerts, and security notices.
• Debug issues and investigate abuse.
• Measure which ads bring people to Shipmail while a campaign is running.
• Find and fix application crashes, hangs, slow starts, slow or frozen frames, and other reliability problems.
• Provide the optional Assistant after you explicitly enable it. To answer your requests, Shipmail sends your prompts and information needed to answer them—which may include relevant email content, names, email addresses, and calendar details—to OpenAI, our AI provider.
• Suggest calendar events from incoming mail. On paid plans, an open-source AI model that runs on Shipmail's own server in Germany checks the sender, subject, and text of new messages, and suggests an event when someone proposes a meeting. You can add or dismiss each suggestion. No person at Shipmail reads your messages for this. The model keeps no copy of them and is never trained on them, only Shipmail can reach it, and no outside AI provider sees your mail. Suggestions are on by default. An organization admin can turn them off for everyone by turning off AI features.
• When you connect an app such as ChatGPT or Claude, Shipmail shares data with it at your direction, within the permissions you approve. You can disconnect it at any time under Developer, Connections.

We do not use your email content for advertising, profiling, or training machine-learning models.

Sentry crash and performance diagnostics: we rely on our legitimate interests under Article 6(1)(f) GDPR to maintain Shipmail's security, reliability, and performance, subject to data minimization and balancing those interests against your rights.

Partner program: we rely on our legitimate interests under Article 6(1)(f) GDPR to attribute a visit and a subscription to the partner whose link or code was used and to pay that partner. Affonso acts as our processor.

Newsletter content check: we rely on our legitimate interests under Article 6(1)(f) GDPR to keep phishing, malware, scams and abuse out of the newsletters sent through Shipmail. OpenAI acts as our processor and never receives your subscribers. If the check holds a send, a person at Shipmail reads the held issue or welcome email to approve or reject it.

Optional Assistant: after you explicitly enable Assistant data sharing, we process your prompts and relevant email or calendar information, including names and email addresses, under Article 6(1)(b) GDPR to provide the feature you asked for. OpenAI acts as our processor. You can decline or withdraw permission at any time without affecting the rest of Shipmail.

Calendar suggestions from incoming mail: on paid plans, while AI features are on, which is the default, our own open-source model processes incoming messages under Article 6(1)(b) GDPR to provide the calendar feature. It runs on our server, so no outside AI provider receives your mail. An organization admin can turn AI features off at any time, which stops this processing.

Calendar location autocomplete: when you choose to use address suggestions, we process the typed query and your approximate location under Article 6(1)(b) GDPR to provide that feature. You can always enter a location manually instead.

Within Shipmail, only the people who operate the service have access to production systems. We access data only to operate the service, investigate issues you report, meet legal obligations, or deal with security incidents or abuse of the service. A person at Shipmail reads the content of your email only with your permission, when the law requires it, or to deal with an active security incident or abuse of the service.

• Stripe for payment processing.
• AWS SES for outbound email relay and AWS S3 for encrypted mail blob storage.
• Resend for our own transactional email, such as magic links, billing alerts, and security notices. It receives the recipient address, subject, and body of those messages. The email you send and receive in your mailbox does not go through Resend.
• Neon for PostgreSQL database hosting.
• Upstash for rate-limit counters and five-minute calendar-location authorization records. Rate-limit counters hold an account identifier, API key identifier, mailbox address, or IP address against a short window and expire within 24 hours. Location authorization records hold internal user and organization identifiers with hashed session tokens and place IDs.
• Cloudflare for edge network services and encrypted database backups in R2.
• Hetzner for hosting the application, the mail servers, and the calendar-suggestion model in the European Union.
• PostHog for analytics, feature flags, and masked session replay.
• Meta for advertising measurement during the ad campaigns we run. We send hashed identifiers and conversion events, never email content.
• Sentry, acting as our processor, for crash and performance diagnostics.
• Crisp for customer-support chat and related session data.
• Affonso, acting as our processor in Germany, for our partner program. It receives visits through partner links, and the Stripe data of subscriptions that came through a partner link or code.
• OpenAI for the optional Assistant after you explicitly enable Assistant data sharing, and for composer writing suggestions when you separately invoke that feature. The Assistant can send your prompts and relevant email or calendar information, including names and email addresses. For composer writing, the text you select, or your editable message when nothing is selected, is sent together with bounded instructions and up to two approved examples from your active Writing Style; quoted and forwarded content is excluded. OpenAI also runs an automated check of each newsletter issue's and welcome email's subject and content before it goes out, for phishing, malware, scams and abuse. It never receives your subscribers. OpenAI does not train on it and keeps it at most 30 days for abuse monitoring. OpenAI separately measures our advertising during the campaigns we run there, receiving hashed identifiers and ad-click events, never email content.
• Google Maps for optional calendar address suggestions, and Google Meet and Zoom for optional conferencing links that you connect.
• YouTube, through youtube-nocookie.com, for the videos embedded in some blog posts. A video loads only when you press play.

Each provider processes data only as needed to deliver its service. We do not share your data with anyone else.

If you use Continue with Google to sign in, Shipmail receives your Google account email address, name, and Google account ID and uses them only to sign you in. We store the email address as a login email and, for a new account, the name on your account. We do not store your Google account ID or any Google tokens, and we request no other Google permissions for sign-in.

If you connect Google Meet, Shipmail requests only the meetings.space.created permission to create meeting links. We do not request access to Gmail, Google Calendar, contacts, files, or existing meetings.

We receive the new meeting’s join URL and code and hold the OAuth tokens that authorize your requests. The link is attached only to the event, invitation, or booking confirmation you create.

OAuth tokens are encrypted at rest and Google communication uses TLS. Disconnecting Google Meet revokes and deletes the tokens immediately. Event links follow the event and account deletion rules.

We do not use Google user data to develop or train AI models or transfer it to third-party AI services. Our use complies with the Google API Services User Data Policy, including Limited Use requirements.

Google Maps processes location autocomplete queries under its own Privacy Policy. Shipmail sends only the fields described above and does not use an OAuth connection for address suggestions.

• Google Privacy Policy

Shipmail's core application, database, and mail infrastructure are hosted in the European Union, in Germany. We use EU regions for storage, delivery, analytics, and diagnostics where providers offer regional controls. Some services, such as payments or optional conferencing integrations, may process limited data under their own privacy terms. Email content and message metadata are encrypted at rest.

We keep data while your account is active. After account deletion, we delete it within 30 days; backups may retain it for up to 90 days. Audit logs may be kept longer for security purposes and can contain IP addresses, email addresses and domain names. Advertising-measurement records are deleted after 120 days.

Sentry crash and performance diagnostic events are retained for up to 30 days under our current Sentry plan.

You can export your data, correct your information, delete your account from the dashboard, or withdraw AI Assistant data-sharing permission in the mobile app under More, Account. Withdrawal stops your own Assistant requests to OpenAI; existing Assistant conversations remain readable. Calendar suggestions from incoming mail continue while AI features are on for your organization. An organization admin can turn AI features off for everyone from Assistant settings. Contact us if you need help exercising your data rights.

We may update this policy. Material changes will be communicated by email at least 30 days before they take effect.

Questions about your privacy? Email us at support [at] shipmail.to.