Privacy Policy

Draft. This text is a starting point and has not been reviewed by a lawyer. Replace the bracketed details and have it reviewed before you take payments.

Last updated: [date]. This policy explains what [Company legal name] ("HiddenAt") collects and why.

What we collect

• Account details: your email address, name (optional) and a hashed password.
• Forwarding addresses: the inboxes you ask us to forward to.
• Mail metadata: for each message, the sender address, the address it was sent to, the time, and what we did with it (forwarded, blackholed, bounced). This powers your dashboard.
• Billing: Stripe handles your card. We store your Stripe customer ID and subscription status, not your card number.
• Domain registration: if we register a domain for you, the registrant contact details you give us are sent to Amazon Route 53 and the domain registry. We don't keep a copy after registration finishes.
• Security logs: sign-ins, IP addresses and changes to your settings.

What we don't do

We don't read your email or keep copies of forwarded messages. We don't sell your data or show ads.

Who we share it with

Stripe (payments), Amazon Web Services (hosting, domain registration and DNS), and the inbox providers you forward to. We disclose data if the law requires it.

How long we keep it

Mail metadata is kept for [12 months]. Account and billing records are kept while your account is open and afterwards as tax law requires. Ask us to delete your account at any time.

Your rights

You can ask for a copy of your data, a correction, or deletion by emailing support@hiddenat.com.