Back to Security Hub
Data Minimization & Transparency
What do we log?
A complete, honest breakdown of every piece of data stored in our database versus what is never stored.
We practice strict Data Minimization under GDPR Article 5. We store only what is technically essential to route your messages.
What We Store in Our Database
To operate your account, we store minimal metadata in an encrypted MongoDB cluster:
- Account Email & Auth credentials (salted & hashed with bcrypt)
- Active alias addresses & virtual phone assignments
- Encrypted alias-to-inbox destination mappings (AES-256)
- Subscription tier & credit balance
- Ephemeral delivery counters (forwarded count, trackers stripped, timestamps)
What We NEVER Store or Log
The following data is strictly absent from our servers:
- Email bodies, message text, or raw HTML content
- Email attachments (streamed in-memory and discarded)
- Credit card numbers (handled securely by Stripe/Paddle/Chargebee)
- Web browsing histories or websites visited via the extension
- IP addresses of external senders who message your aliases
The Bottom Line
We don't want your data. What we don't have cannot be breached, subpoenaed, or leaked.
