Privacy policy
What Hushymaily processes, how inbox access works, and how advertising consent is handled.
Scope and operator details
This policy describes the Release 1 software. The service operator must publish its legal name, contact details, applicable jurisdiction, and actual domain before a public launch. The placeholder hushymaily.com domain is not a claim of ownership.
Contact the operator through the contact form for privacy questions. Do not include verification codes or sensitive email contents in a support request.
Temporary inbox data
A hash-only allocation record prevents an issued disposable address from being assigned again. That reservation is retained indefinitely without an inbox access token or message content; it is separate from expiring inbox data.
The service processes incoming email addresses, sender metadata, subjects, MIME content, supported attachments, read state, and expiration deadlines. D1 stores indexed metadata and hashed access tokens. R2 stores message bodies and attachments.
Access expires after ten minutes by default and can be extended up to one hour from creation. Expiration blocks access immediately. Cleanup runs every five minutes in bounded batches; actual physical removal can take longer during a backlog or outage. Free inboxes retain these limits; premium inboxes start at 24 hours and can be extended up to seven days while subscribed. The orphan sweep removes old unindexed objects while protecting indexed content in active inboxes. Backups and provider retention must be configured and disclosed by the operator.
Browser, app storage and security data
Session storage holds the active inbox address and secret access token. Anyone with that token can access the active inbox. Local storage holds theme and advertising choices. These settings are separate from inbox credentials.
The native iPhone app in development stores its active inbox capability in the device-only Keychain. It can survive app restarts and may survive reinstallation until deleted or expired; it is not synced through iCloud. Appearance is stored in app preferences. Copy actions place an address or verification code on the system clipboard. The app does not send analytics or run advertising SDKs. A separate ephemeral web view handles an optional security check without receiving inbox credentials.
Support mail sent to contact@hushymaily.com is forwarded by Cloudflare Email Routing to the operator’s verified Apple iCloud mailbox. It is processed by those mail providers under their policies and may have different retention from the support form’s thirty-day report retention. Do not include private messages, access keys, passwords or verification codes.
The API uses the network IP supplied by Cloudflare to create a short-lived keyed rate-limit identifier. The application does not store raw IP addresses. Rate-limit records last at most two hourly windows, operational security events expire after 24 hours, and support reports expire after 30 days. Cloudflare and an external identity provider may process network metadata under their own policies.
Premium access and payments
Premium access keys remain in browser session storage and are hashed before storage in D1. A key authorizes the active workspace and billing portal. Mailbox capabilities are derived from it; the service does not store plaintext keys. Premium inboxes can remain active for up to seven days. Expired or deleted messages cannot be recovered.
Stripe-hosted Checkout and its billing portal process billing contact information, payment details, invoices and subscription management. This application does not receive card numbers. D1 stores Stripe customer/subscription identifiers, subscription state, paid-period deadlines, temporary checkout references and processed event IDs. Stripe retains billing records under its own policies and applicable obligations. Contact the operator for billing/privacy requests; do not send your key or email contents.
Advertising and consent
Public educational pages and the iPhone information page may use Google AdSense and an operator-configured certified consent management platform. Google and its advertising partners may use cookies, device metadata, network information, and public page information for advertising, frequency capping, fraud prevention, and aggregated reporting.
Non-personalized ads still use advertising technology and can require consent. No ad script or request is made until the configured CMP supplies explicit storage and Google vendor consent. Personalization defaults off and also requires explicit consent if the operator enables it. You can disable advertising from any advertising privacy panel. Private inbox and message documents never load ad scripts.
Authorized revenue reports contain aggregate ad unit metrics. Email addresses, subjects, message bodies, tokens, and verification codes are never included in advertising or analytics events. No product analytics or third-party AI processing is enabled in Release 1.
Service providers and requests
Cloudflare supplies hosting, email routing, database, object storage, optional challenges, and administrator access. The operator chooses the certified CMP and Google advertising account. Privacy and support contact: contact@hushymaily.com or the contact form. Provider regions, contracts, and international transfer terms must be reviewed for the production deployment.
You can delete active inbox data from the interface. Because the service has no visitor accounts, a request concerning a specific inbox requires proof of the active access capability. Expired inboxes cannot be recovered. Applicable legal rights depend on jurisdiction and do not remove legally required retention obligations.