Privacy Policy & Security Commitments

Last updated: October 2026

1. Zero Credential Persistence

MailCode does not accept, store, or log plaintext passwords, session cookies, or raw IMAP tokens for third-party services. Connection to personal email accounts is exclusively established through official OAuth 2.0 PKCE providers with minimal delegated read-only scopes.

2. Treatment of Email Content

Email headers and text content are treated strictly as untrusted data. We sanitize and strip any client-side JavaScript, web tracking beacons, and pixel telemetry prior to rendering. No email bodies are used for advertising profiling or shared with third parties.

3. Synthetic Data Processing

Generated names and passwords are synthesized algorithmically in ephemeral memory. Passwords generated in the Password Generator are synthesized using your local browser's Web Cryptography engine (window.crypto) and are never transmitted to MailCode servers.

4. Data Revocation & Deletion

You may disconnect authorized mailboxes at any time in the Mailbox Manager. Disconnecting immediately revokes the server session token and flushes all active in-memory email caches.