Privacy Policy
Pre-launch draft. Mailboat is a file staging and transfer service — this policy reflects that: we hold data to complete transfers, then delete it.
Who we are
Mailboat (getmailboat.com) is the data controller for account data described below. Contact: [email protected].
What we collect — and what we deliberately don't
- Account data: your email address, password hash, and subscription/billing status.
- Transfer metadata: filenames, sizes, timestamps, checksums, and link activity (who uploaded, when downloads completed). This is what the delivery receipts and usage dashboard are made of.
- Usage & billing data: billable upload volumes, invoices, and payment references (card data is handled by our Merchant of Record and never reaches us).
- Service logs: standard operational logs for security and abuse handling.
We do not open or read the contents of your files, except for automated malware scanning — which runs on every upload and freezes detected files. We do not use your content, your recipients' activity, or your metadata to train AI systems, build profiles, or sell to anyone. This is a promise in our public pledge, not just this policy.
Retention — short by design
- Files: automatically deleted after the retention period — default 7 days, hard maximum 30 days. Deletion is real deletion.
- Transfer metadata: deleted with the account, cascading within 30 days of account deletion.
- Billing records: kept as long as tax law requires.
Subprocessors
| Provider | Purpose |
|---|---|
| Cloudflare (US/EU) | Object storage (R2), CDN, bot protection (Turnstile) |
| Hetzner (Germany/Finland/US) | Application hosting |
| Creem (Merchant of Record) | Payments, invoicing, tax handling |
An EU storage option places files in Cloudflare's EU region. A Data Processing Addendum is available on request via [email protected].
Your rights (GDPR & similar)
Access, rectification, erasure, portability, restriction, and objection. Email [email protected] and we will respond within 30 days — usually much faster. You may also complain to your local data protection authority.
Cookies
We use a minimal set of functional cookies (session) and Cloudflare Turnstile for bot prevention. No advertising or cross-site tracking cookies.
Children
The Service is not directed at children under 16.
Changes
Material changes to this policy are announced by email 30 days in advance. The current version always lives at this page.