Privacy Policy

1. Two different roles

Mailcycle handles personal data in two capacities.

• As a controller for your account data: the information you give us when you create an account, pay us and contact support (see section 2). This policy describes that processing.
• As a processor for Customer Data: the mail your addresses receive and send, and the other content we store for you, such as the names and labels you give addresses and devices (see section 6 of the Terms). It belongs to you and we handle it on your instructions. If you use Mailcycle for a business or other organisation and data protection law applies to you, our Data Processing Agreement governs that processing and takes precedence over this policy for it. If you use Mailcycle only for personal or household purposes, data protection law does not apply to your own use of your mail, and we are responsible for how we handle it, as section 4 describes.

The controller for account data is Northlab Studios Ltd, registered in England and Wales, 167-169 Great Portland Street, London W1W 5PF, United Kingdom. It is registered with the Information Commissioner's Office as a data controller, registration number ZC258146.

2. What we collect

Your account

There is no sign-up form. Creating a Mailcycle account generates a twelve-word recovery phrase on your device and derives an opaque identifier from it. The complete account record we hold is:

• An account id: acct_ followed by 32 hexadecimal characters, derived from your recovery phrase. It is not linked to any identity.
• A public key used to check that you hold the phrase when you sign in, and, for accounts created before that key existed, a hash that served the same purpose. Neither can be reversed into the phrase or into your encryption key.
• A plan identifier and a creation date.

Using the account adds records linked to that id: your sessions (a hash of each token, when it was created and when it expires), any API keys (a hash of each key, its last four characters, its name encrypted on your device, when it was created, and when it was last used, rounded down to five minutes), any webhooks (the address it calls, in plain text because we have to call it, its signing secret, the events it wants, its name encrypted on your device, and whether it is working), a log of each webhook delivery (the event sent, which holds its type, ids and a time, and the response), a push token for each phone that allows notifications, your notification settings and muted addresses, an activity log of events such as a device pairing or a message sent, holding a kind, the ids involved and a time, and an audit history of changes to the account, such as a sign-in, an API key made or a device removed, holding the change, the id of the session, key, device or team member that made it, or that we made it, what it was made to, and a time. Neither holds an IP address or any content. On Fleet and above, activity older than 90 days is kept as a count of each kind of event per day, and device groups hold which devices are in each group, with the group's name encrypted on your device. If you use teams, we also hold who is in each team, the public key each member confirmed when they joined (and a copy of that key encrypted on the owner's device), which addresses each member holds and with what access, and each address's keys sealed on the owner's device to each member. We cannot open those keys, but we do know the membership.

We do not hold your name, your email address, a password, a security question, a phone number or a recovery contact. The only record of where an account came from is the partner record described under “Partners: preloaded phones, links and codes” below.

Information you give us

• Billing: if you buy a paid plan, we record the plan, amount, currency, payment provider, payment status, dates and the provider's own reference for the payment, plus a ledger of charges, refunds, chargebacks, credits and plan changes. You enter payment details on the provider's own checkout or in the App Store or Google Play, and we never receive them. The provider is given our payment reference and the plan, not your account id. A purchase in the iOS or Android app also carries a token derived from your account id, so that only your account can claim it. Polar, which takes card payments, asks for an email address at checkout for receipts and its customer portal. That address stays with Polar; we do not receive it. Paying by card, or through the App Store or Google Play, ties a real identity at that provider to a payment we can link to your account id. Paying in cryptocurrency usually does not.
• Support: whatever you include when you write to us. If you email us, we have your email address for that conversation; we do not attach it to your account. Requests sent from the app are encrypted on your device so that only you and our support team can read them. We store them linked to your account id, with the public key they are sealed to for you, the times they were sent, who sent each message, and whether they are open. When we reply, a phone with notifications on gets a push with fixed text that says there is a reply. We can also send a notice to your account, such as a notice about a breach, a suspension or your plan. It arrives in the same support inbox, with a push notification where a device has them on.
• Domains you bring: on plans that include custom domains, the domain name, its verification token and its DNS and routing status. The domain is set up with our hosting provider so it can receive mail, and with our fallback sending provider so that mail you send from it can still go out when the hosting provider cannot send it.
• Pairing a device: the device sends its platform and a device name so you can recognise it when you confirm the pairing, and a public key your app uses to hand it its keys. That key, and the secret your app seals to it, stay on the pairing record. An AI agent sends the name you gave it when you ran the pair command, or “AI agent”. No shared key exists at that point, so this name is held in plain text on the pairing record until the pairing is confirmed, then cleared. The name you give the device is encrypted. The app also sends a random id it keeps for that install, held on the pairing record until the pairing is confirmed. The device record then keeps only a hash of it together with your account id, so pairing the same install again replaces its old entry.
• Partners: preloaded phones, links and codes: some companies sell phones with the Mailcycle Worker app already installed, and their copy of the app carries a code naming that company. Others share a referral link (mailcycle.email/r/…) or give you their code to type in. Pairing such a phone records the company on the pairing record and the device record. If an account that has never paid first reaches us through a partner (by pairing one of its phones, by being made from its link, or by you entering its code at sign-up or in Settings within 30 days), we record that company against the account, with the date and which of those it was, and pay the company a share of the account's payments for the period we agreed with it. We may also add a partner by hand when a partner tells us they sent you. The code names the company, never you or the phone, and we keep nothing else about the link: not the page you came from, your address, or when you clicked it. When you arrive at sign-up from a partner's link, we add one to that partner's count of visits for the day, and keep only that count. A partner sees totals (visits, how many accounts they brought and where those stand, and what they earned), and on their monthly statements each payment with a short reference that is not your name, email address or account number. We never give a partner your personal data.
• If you are a partner: we hold your company's name, legal name and country, a contact, how you want to be paid and your payout details (such as a wallet address and network, or bank details), the payouts we make you and the statements we send, to run the partnership under our agreement with you and to keep the records accounting and tax law require. If we give you a private link to your own report, we keep only a scrambled fingerprint (hash) of it, so it cannot be read back from our records.

Information we collect automatically

• Device metadata: platform and status for each paired device, whether it is an AI agent and, for an agent, what it may send, plus a last-active time rounded down to five minutes, set by our servers when the device or agent makes a request. The names, tags and notes you give your devices are encrypted before they reach us. Drafts written on a paired device stay on that device and never reach us.
• Connection data: IP addresses are visible to our hosting provider while a connection is open, and are used for rate limiting and abuse prevention. We do not store them in our database as account history or join them to an account id.
• Live connections: while a paired device, a signed-in app or a program using an API key is open, it can hold a connection to us so it hears about changes at once, such as a device being removed, an address being assigned or new mail arriving. The connection is tied to the device or account id and carries event names and ids, never mail. Nothing about it is stored, and it ends when the connection closes.
• Rate limit counters: counts of recent requests, keyed by a SHA-256 hash of the IP address (for IPv6, of its /64 prefix) or of the account id. One row per limit per time window, not one row per request. An unsalted hash of an IP address can be matched by trying addresses, so we treat these counters as personal data. They are deleted within an hour of their window closing, and the longest window is 30 days.
• Service logs: a sample of one request in ten, with any errors it hit, and a timing trace of one request in a hundred, kept by our hosting provider. They can include request details such as the IP address. We do not log message content.
• Product analytics: none in the app. We run no analytics, no advertising and no cross-site tracking on app.mailcycle.email, whose addresses carry the identifiers of your email addresses and devices.
• Visit counting on the website, and only if you allow it. Our web analytics service then records the page you opened, the page that linked you to it, your browser, device type and country, and how long the page took to load. It sets no cookie, stores nothing on your device and cannot recognise you on a later visit. It is off until you allow it. See the Cookie Policy.

Information received on your behalf

Mail sent to your email addresses. Its sender addresses, subjects, bodies, headers and attachments are encrypted before storage to a key derived from your recovery phrase, which we never hold. What remains readable to us is the routing metadata: the recipient email address, the arrival time, the size, the number and size of attachments, whether it has been read, which folder it is in (inbox, sent, junk or trash) and whether it is starred, plus a hash of its Message-ID salted with the address's id, used only to turn away a repeat delivery of the same message. Message bodies and attachments are stored sealed in object storage and deleted with their message. For mail you send, we keep a copy in the address's Sent folder, with any files attached, sealed to the same key, and record whether it was sent from the app, an API key, a device or an AI agent. This is Customer Data and is covered by section 4.

Reply hashes for AI agents

When mail arrives at an address an AI agent holds, we store a SHA-256 hash of each address it could be answered at: the envelope sender, the From address and the Reply-To address, each salted with the message's id. When the agent replies, we hash the recipient the same way and check it matches, so a reply-only agent cannot write to anyone else. The hashes are personal data about the people who wrote to the agent. They are kept only for addresses an agent holds, cannot be read back as addresses, and are deleted with the message. Someone holding the database could use one to confirm a guess about who sent a particular message.

Paid feature use

For each feature only a paid plan includes, such as an API key, an AI agent or more addresses than the free tier allows, we record the last time your account used it. It is one date per feature, and it says nothing about what the feature was used for. We use it to decide refunds under our Refund Policy.

Information from other people

Anyone can report a Mailcycle address or account for abuse, without an account. A report holds its source type, the address or account id it names, the reason given, and how it was resolved. It holds nothing about the reporter unless they write it into the reason. If you report by email, we also have your email address for that conversation.

Administrative records

For each account we can record a suspension and its reason, notes, a rate limit tier, a retention cap, extra address allowance, a custom price, credits, refunds and past-due status. Every administrative action is written to an audit log holding the action, the target id, the reason and some detail, which for a suspended address includes the address. Administrative tools have no access to message content.

We do not buy personal data, and we do not sell it.

3. Why, and on what legal basis

Where we rely on legitimate interests, we have considered your rights and interests and concluded they are not overridden. You can ask us for that assessment.

4. Mail content

Mail received at your email addresses is yours, and it is encrypted.

• Inbound mail arrives at our servers in the clear, as email requires. Before anything is written to storage, the whole message is sealed to a public key belonging to that address. The matching private key is derived from your recovery phrase on your device.
• What we store is ciphertext. We hold no copy of the private key and no means of deriving one.
• Mail you send through the API, from a device or through an AI agent is the exception. It has to leave as plain text to reach an ordinary mail server, so it passes through our code and our hosting provider's mail sending service in the clear, or through our fallback sending provider when the hosting provider cannot send it. We do not log it. The copy kept in your Sent folder is sealed to the address's key before it is written, so what we store is ciphertext, as for received mail.
• AI agents. An agent you connect decrypts the mail at its addresses on the machine you run it on, and passes what it reads to the AI model provider you chose. That provider is not our subprocessor. It processes that mail for you, under your agreement with it and its own privacy policy, and we have no control over it.
• We cannot use it to train machine learning models.
• We cannot scan it for advertising.
• We cannot disclose the content of stored mail to anyone, including under a legal order, because we cannot open it once it is sealed.

No one at Mailcycle can read stored message content. There is no internal viewer and no escrowed key; production access shows only ciphertext. What we can access, and can therefore be compelled to produce, is set out in section 2: your email addresses, arrival times, sizes, plan and payment records. The encryption protects stored mail. Mail arriving or being sent is in the clear in our code for the length of that request, and we do not log it.

Opening mail discloses nothing to the sender. The app blocks remote content when it shows a message, so tracking pixels do not fire. Senders cannot learn that you opened their mail, when, from where, or on how many devices.

People who send mail to your email addresses are not our customers and have no direct relationship with us. You are responsible for having a lawful basis for the personal data that arrives at your addresses.

5. Who we share it with

• Nobody on behalf of your AI agents. We do not send mail to any AI model provider. Your agent does that, on your machine, to the provider you chose.
• Subprocessors: our hosting and infrastructure provider, a fallback mail sending provider and a push notification provider, which process data on our behalf under contract. Section 6 says where. A customer can ask us for their names at hello@mailcycle.email.
• Payment providers: Polar for card payments, NOWPayments for cryptocurrency, and Apple and Google for purchases in the app, when you buy through them.
• Our email provider, which holds the mailboxes for our mailcycle.email addresses, and so any email you send us.
• Professional advisers: auditors and lawyers, under confidentiality.
• Authorities: where we are legally required. We check that each request is lawful and challenge any we consider overbroad. Two practical limits apply: we can only produce what section 2 says we hold, which does not include message content or your identity, though for a paid account it does include the payment provider's reference; and because we hold no email address for you, “notifying you” means a notice to your account in the app, with a push notification if you have turned them on, which we will send unless we are legally prohibited from doing so.
• A successor: if Mailcycle is acquired or merged, subject to this policy continuing to apply. We will notify you before your data becomes subject to a different policy.

6. International transfers

We are in the United Kingdom. Our database and file storage are located in Western Europe, where our hosting provider placed them; this is where they are, not a contractual guarantee of where they will stay. Its network is global: mail arriving for your addresses, and mail you send, is processed in the clear for the length of the request at whichever of its data centres handles the connection, which may be outside the UK, including in the United States. Push notifications go through our push notification provider in the United States; card payments through Polar in the United States; cryptocurrency payments through NOWPayments in the Seychelles; mail sent through our fallback sending provider when the hosting provider cannot send it is processed in the European Union; and in-app purchases through Apple and Google, in the United States and Ireland.

Where personal data goes outside the UK, we rely on the UK's adequacy regulations where they exist, including the UK Extension to the Data Privacy Framework for recipients in the United States certified under it, and otherwise on the ICO's International Data Transfer Agreement or the Standard Contractual Clauses with the ICO's Addendum. You can ask us for a copy of the safeguards we rely on at hello@mailcycle.email.

7. How long we keep it

You can shorten most of the windows below.

8. How we protect it

Message content is sealed to a key derived from your recovery phrase, which we never hold, as soon as it reaches us. Underneath that: TLS in transit, encryption at rest, device credentials in the platform keystore, and an audit log of every administrative action. There are no passwords in the system to protect. The full picture, including what we can still see, is in our security overview.

If a personal data breach happens, we notify the Information Commissioner's Office, and any other supervisory authority we are required to notify, without undue delay and within the time the law requires, unless the breach is unlikely to result in a risk to anyone. If a breach is likely to result in a high risk to you, we tell you without undue delay, with a notice to your account in the app and, where it affects everyone, on our notices page. We may also tell you about breaches we are not required to report.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing, to receive your data in a portable format, and to withdraw consent where we rely on it.

You can exercise most of these directly in the app:

• Access and portability. Settings → Export data downloads your addresses and messages, decrypted on your device.
• Deletion. Settings → Danger zone → Delete account removes the record, every email address, every message and every device from the live database immediately. You do not need to ask us, and we cannot delay it. What remains is listed in section 7: payment records and the billing ledger, audit log entries, hashes of retired addresses, any partner record, and the restore window. Deleting the account cancels a card subscription, but not one billed by the App Store or Google Play, and deletes any account balance: ask for money you paid into it before you delete, as the Refund Policy says. Step by step, and what to do if you have lost your recovery phrase: delete your account.
• Restriction. Lowering an address's retention window deletes anything already past the new limit straight away.

For anything else, email hello@mailcycle.email. We respond within one month of receiving your request. If a request is complex, or you send several, we may extend that by up to two further months, and we will tell you why within the first month. We will not charge you or degrade your service for asking.

If your request concerns mail received at a customer's email address rather than your own account, we will forward it to the relevant customer, who is the controller for that data.

If you are unhappy with how we have handled your personal data, tell us first at hello@mailcycle.email: we acknowledge complaints within 30 days and tell you the outcome. You may also complain to a supervisory authority: in the UK the Information Commissioner's Office, or the data protection authority where you live or work.

We do not sell personal information, or share it for cross-context behavioural advertising.

10. Children

Mailcycle is not directed at children. You must be 18 or over to create an account, and sign-up asks you to confirm it. We do not knowingly collect personal data from anyone under 18. If you believe we have, write to us and we will delete it.

11. Changes

We will update this policy as the service changes. Material changes are announced on our notices page and its feed before they take effect, and at least 30 days before if they change how we use personal data we already hold. The effective date at the top always reflects the current version.

12. Contact

hello@mailcycle.email
Northlab Studios Ltd, 167-169 Great Portland Street, London W1W 5PF, United Kingdom

Data protection officer: we have not appointed one, because the law does not require it for the processing we do. Write to hello@mailcycle.email with any privacy question.