Privacy Policy
Draft, 1 November 2026
1. Two roles
Your account. For the data about you as our customer, such as your sign-in address and billing, [legal entity] is the controller.
Mail you send. For the recipients and content of mail you send through us, you are the controller and we are your processor, acting on your instructions. If you are a recipient, please contact the sender first; we can also pass a request on, or stop mail to you, at privacy@lifetree.email. [A data processing agreement is to be attached.]
2. What we hold
- Account: your email address, account name, sign-in sessions, passkey public keys, and if you use it, the address Google confirms for you. We do not hold passwords, because there are none.
- Billing: plan, credit ledger, and a Stripe customer reference. Stripe holds your card; we never see it.
- Message metadata: sender, subject, size, lane, tags, timing, SES message id, and each status change with its reason.
- Recipients: a hash of each address, and the plain address and name unless you turn that off in Settings.
- Message bodies and attachments: held briefly so we can send, retry and show you a preview.
- Domains: names, DNS status, and DMARC aggregate report counts. A Cloudflare token you paste is used for that one request and is not stored.
- API keys: a hash of each secret, and a sealed signing key for signed requests.
3. How long we keep it
| Data | Where | Kept |
|---|---|---|
| Message bodies and attachments | Object storage (Cloudflare R2) | Deleted 24 hours after sending by default. You can choose 0 to 168 hours (7 days) in Settings. |
| Uploaded attachments not used | Object storage | 24 hours |
| Metadata, events and ledger | Postgres | 13 months, then reduced to aggregate statistics |
| Recipient address hash | Postgres | Permanently, so suppression and deduplication keep working |
| Plain recipient address | Postgres | With the metadata, 13 months. Optional: you can turn it off. |
| Server logs | Our hosts | 30 days. They contain no bodies, attachments or plain addresses. |
4. Why we use it
To deliver the Service, under our contract with you. To protect it, as a legitimate interest: bounce and complaint handling, abuse detection, and a shared list of addresses that hard-bounced, which is compared by hash across all accounts for 30 days. To bill you and meet legal duties. We do not sell personal data, use mail content for advertising, or train models on it.
5. Open and click tracking
Off by default. If a sender turns it on, a tracking pixel or rewritten links are used. Open tracking is inaccurate in both directions and we say so in the console.
6. Who we share it with
| Sub-processor | For |
|---|---|
| Amazon Web Services (SES) | Sending mail and returning delivery events |
| Cloudflare | Network edge, object storage, receiving DMARC reports |
| Stripe | Payments, as merchant of record through Link: your payment details, name and billing address go to Stripe under its own privacy policy |
| [Console hosting provider] | Serving the website. It holds no session or mail data. |
| Only if you choose Google sign-in |
We share data with authorities only when the law requires. Data may be processed in the United States. [Transfer mechanism to be confirmed.]
7. Cookies and browser storage
One httpOnly session cookie, and a short-lived one during Google sign-in. No advertising or analytics cookies. Compose drafts stay in your browser's local storage until you send or delete them; we never receive them, and no key is kept there.
8. Your rights
Depending on where you live, you may ask to access, correct, delete or export your data, or object to its use, by writing to privacy@lifetree.email. A sender can make an address unreadable everywhere we hold it from Settings, under Forget an address. The hash stays so that the address continues to be suppressed. You may complain to your data protection authority.
9. Security
Secrets are hashed or sealed, access to the console is passwordless, sensitive actions need a second confirmation, and traffic is encrypted. No system is perfectly secure; we will tell you without undue delay about a breach that affects your data.
10. Changes
We will announce material changes by email or in the console before they apply.