Privacy policy

Data we keep

• Account: email, display name and a hashed password (the original password is never stored); with Telegram sign-in, your Telegram ID and username.
• Transactions: top-ups, balance, rentals, purchases and balance history.
• Access logs for sign-ins and API calls: IP address, country, browser (user agent), endpoint, response code and time.
• Mail received at addresses you rent or in domain inboxes, with the extracted OTP codes and links.
• Messages you send to the support bot on Telegram.

How we use it

• To provide the service: assign mail, show OTP codes, deliver accounts, credit top-ups.
• Security: limit failed sign-ins, spot unusual access, block abuse.
• Support and reconciliation when there is a complaint.

Cookies and browser storage

• One httpOnly cookie keeps you signed in; scripts on the page cannot read it.
• Browser storage (localStorage) remembers the language you chose.
• No advertising cookies. Visit statistics come from Cloudflare Web Analytics, which sets no cookies.

Sharing

• We do not sell personal data.
• Cloudflare handles website traffic; Telegram handles messages and Telegram sign-in; banks or blockchain networks process top-up payments.

Protection

• All connections use HTTPS.
• Passwords are hashed; login details of email accounts sold are encrypted at rest.
• You can disable an old API key at any time by rotating to a new one.

Your rights

You can ask to see or delete your account data by messaging @mailsmmo_bot on Telegram. Some transaction records may be kept when needed for reconciliation or by law.