Privacy policy
This page describes what Mailbirch actually stores. It is written against the running system rather than as boilerplate.
Your messages
Mail sent to your address is stored so it can be delivered to you, and stays until you delete it. Message contents are not scanned to build a profile or to choose advertising. Incoming mail passes a spam filter as it arrives; that filter reads the message in order to score it and keeps only statistical data, not the message.
Your account
We store the address, an optional display name, an optional recovery address you supply, your signature and interface preferences, and a bcrypt hash of your password. The hash cannot be turned back into the password by us or by anyone else.
Security records
Sign-ins, failed sign-in attempts, password changes, two-factor changes and administrative actions are recorded together with the IP address and browser user-agent that performed them. This is what lets an account holder spot access they do not recognise, and what feeds the automatic protection against password guessing. These records are kept for 180 days. Failed-attempt counters are discarded after a day.
Keeping sign-up to one account per person
When accounts are open for registration, a new account records three signals so that the same person cannot quietly create many: the IP address it was created from, a marker cookie set in the browser, and a fingerprint derived from browser characteristics such as screen size, time zone, language and graphics capabilities. All three are stored as one-way hashes — the original address and fingerprint are not kept — and exist only to refuse a second registration.
Cookies
__Host-mb_session— keeps you signed in. Required; there is no site without it.__Host-mb_actas— set only when an administrator opens another mailbox, and cleared when they leave it.__Host-mb_reg— a registration marker, described above.- Browser storage holds your theme choice.
None of these track you across other websites.
Advertising
The site carries advertising supplied by a third-party network. Those advertisements are loaded inside a sandboxed frame served from a separate origin, so the advertising code cannot read your mailbox, your session or the page around it. The network does set its own cookies and does collect the usual advertising signals — IP address, browser, and the page the advertisement appeared on — under its own privacy policy, which we do not control. Nothing from your messages is passed to it.
What we do not do
We do not sell personal data. We do not scan mail to target advertising. We do not share the account directory with anyone.
Deleting your data
Ask at postmaster@mailbirch.com and the account, its mail and its records will be removed. Backups holding a copy roll off within fourteen days.
Contact
Questions about this policy: postmaster@mailbirch.com. Abuse reports: abuse@mailbirch.com.