Privacy policy
How InboxIt processes information. Last updated: 24 October 2026.
Operator
InboxIt is operated by DIGIGAP TECHNOLOGIES, a South African private company, registration number 2022/333237/07. Registered office: Thulamahashe, Bushbuckridge, Mpumalanga, 1365, South Africa. Contact hello@inboxit.wtf for privacy enquiries. Processing locations and the limits of our current controls are described below.
Information we process
We process account email addresses, profile names and optional photos; workspace memberships, domains, inboxes and API-key metadata; senders, recipients, message content, headers and attachment information; authentication, usage, delivery and security records. Contact forms collect your name, email, optional company, topic and message. A hashed connection address helps limit contact-form abuse.
Why we process it
We use this information to provide accounts and email services, deliver and receive messages, enforce workspace permissions and quotas, prevent abuse, answer support requests and maintain service reliability. Optional public-website analytics is controlled separately through Privacy choices. Contact us for information about the basis for processing your data and applicable international-transfer arrangements.
AI support assistant
When you choose to send a question, your messages and relevant public documentation are processed through Supabase Edge Functions and OpenRouter by the selected model provider. Do not include passwords, API keys or sensitive information. Chat history is held in page memory, not saved in browser storage. Provider processing and retention depend on their policies. The reply email and issue details entered in the Contact the team form are sent through our support email system, not to the AI. Chat text is included in support requests only when you choose to include it.
Optional website analytics
Only after you accept analytics, the website sends its public page path and page-load duration to InboxIt. It excludes query strings, referrers, visitor identifiers and email content. Counts and timing totals are aggregated by day and page. Network requests necessarily expose connection information to the serving infrastructure; the analytics dataset does not store visitor IP addresses. Operational security and delivery records are separate from optional website analytics.
Service providers and external links
Supabase supports authentication, database and encrypted backup storage. Google sign-in uses Google and Madnion. InboxIt mail infrastructure handles delivery and mailbox storage. These services process data needed for their roles. Fonts are served from this website. Social links do not embed social tracking widgets; visiting an external site is governed by that site’s policies. The deployed application and mail worker connect to Supabase through its eu-west-1 (Ireland) regional database pooler. Encrypted off-site backups use Supabase Storage in the same configured project; a separate Storage location guarantee has not been obtained. The application and Postal/Dovecot mail services run on our Namecheap VPS. Namecheap lists its VPS datacenter in Phoenix, Arizona, United States; this location is based on the provider’s published service information rather than a server-specific location attestation. Google authentication may involve international processing. We do not claim that data stays exclusively in South Africa. Contact us for current provider and transfer information; this notice does not guarantee region-exclusive processing.
Retention
The configured mailbox cleanup removes messages older than seven days on Free and 30 days on Build and Scale, through an hourly cleanup job scheduled at 17 minutes past the hour. The deployed cron schedule and recent invocations were verified; cleanup is not instantaneous at the retention boundary. Temporary inboxes become unavailable at expiry and are queued for cleanup; test-run records are scheduled for deletion after one day. These rules do not erase all delivery, outgoing, usage or security records. Optional website analytics is pruned to 90 days when a new event is recorded. Account, support, delivery and operational records currently lack a verified universal automatic deletion deadline. Contact us to request deletion; we assess related records and any lawful preservation needs individually.
Backup retention
The deployed backup job runs daily at 02:30 UTC with up to five minutes of scheduling delay. It retains seven daily, four weekly and three monthly Restic recovery points and uploads the encrypted repository to Supabase Storage. A recent successful backup and authenticated manifest retrieval were verified. Public and anonymous retrieval of that same manifest failed, and dedicated-identity access policies are installed. Off-site cleanup retains the latest 30 complete archives, not necessarily 30 calendar days. Each archive can contain older recovery points and unpruned data. Physical Restic pruning is a separate operator task; incomplete uploads remain for investigation. Therefore these counts are not a guaranteed final-erasure deadline. Backup deletion and restoration procedures must account for previously approved deletion requests.
Security and backups
Workspace access is enforced on the server. API keys are hashed and sensitive stored credentials are encrypted. Authentication uses HttpOnly cookies. Encrypted off-server backups support recovery. These safeguards reduce risk but cannot guarantee that every incident is prevented.
Your choices and requests
Use Privacy choices to accept or reject optional analytics. Rejection does not prevent account access or email service. Update your profile and revoke keys through Settings. Contact hello@inboxit.wtf for access, correction, export or deletion requests; identity and workspace authority may need verification. Self-service account export and deletion are not yet provided. South African privacy complaints may be raised with the Information Regulator at https://inforegulator.org.za/ . Contact us first if you would like help resolving a request. Rights may include access, correction, objection and deletion subject to applicable law; we do not promise deletion where lawful preservation is required. Send privacy requests to hello@inboxit.wtf so we can assess and respond to your request.
Changes and contact
Last updated 24 October 2026. Questions and requests: hello@inboxit.wtf.