Privacy Policy

Piped.email exists to keep your real email address private, so we collect as little as we can. This policy explains what we process, why, and your rights under the Philippine Data Privacy Act of 2012 (RA 10173) and the EU/UK General Data Protection Regulation (GDPR). The controller is Piped.email.

What we collect

• Account data: your account email, a salted hash of your password, your plan, and the destination inboxes and domains you add.
• Aliases: the addresses you create, your optional notes, which inbox each one delivers to, block rules, and counts of forwarded and blocked messages.
• Activity log: for each message to an alias, the time, sender address, outcome (forwarded, blocked, rejected, held, failed or replied) and any sub-address tag. Never the subject or body. Kept for 30 days.
• Messages in transit: the raw message is stored only while we forward it and deleted immediately after successful delivery, or after at most 7 days if delivery keeps failing.
• Reply routing: for each external sender who writes to an alias, a random reply address mapped to that sender's address, so your replies can be routed back.
• Billing: handled by PayPal. We receive your subscription status and plan, never your card details.
• Security data: IP addresses used for rate limiting and abuse prevention, kept only briefly, and a bot check (Cloudflare Turnstile) at signup.

Why we use it (legal bases)

• To provide the Service you signed up for (contract).
• To prevent abuse and keep our sending domains reputable (legitimate interests).
• To meet legal obligations, such as tax records for payments (legal obligation).

We don't sell your data, show ads, or use your mail to train anything.

Who processes it for us

• Cloudflare: hosting, database, email receiving and sending, bot checks.
• Amazon Web Services (SES and S3): receiving and sending for custom domains you connect.
• PayPal: subscriptions and payments.

These providers may process data outside your country. We rely on their contractual safeguards (such as Standard Contractual Clauses) for international transfers.

Retention and deletion

You can delete your account from Settings at any time. Aliases, domains, logs and reply mappings are removed within 24 hours. The alias addresses themselves are retired, not reissued, to prevent someone else from receiving mail meant for you. We keep minimal billing records as tax law requires.

Your rights

You can ask to access, correct, export or erase your data, object to or restrict processing, and complain to your data protection authority (in the Philippines, the National Privacy Commission). Contact privacy@piped.email.

Cookies

We use one essential cookie to keep you logged in. No tracking or advertising cookies.

Changes

If we change this policy materially, we'll email your account address before the change takes effect.