Privacy
smails keeps as little as it can.
Your account
- From GitHub we keep your numeric user id, your username, your verified primary email address and when your GitHub account was created. Sign-in asks GitHub for read access to your email addresses and nothing else. We use the email to contact you about your account; we do not send marketing mail or share it.
- For each app you sign in to (the CLI, an MCP client), we keep a hash of its refresh token so you can sign it out from your account page.
- We count how many mailboxes you create each day, to enforce the free quota.
- Mail sent to your addresses is stored so your agent can read it: sender, subject and time in a database, the original message in object storage.
- After a mailbox expires (7 days) nobody can read its mail through smails. We do not promise to delete stored mail at a fixed time.
- Do not use smails for anything sensitive. Anyone who knows an address can send mail to it.
Not collected
No analytics scripts, no advertising, no tracking cookies. The only cookies are the sign-in session and short-lived ones used during sign-in.