Privacy Policy

What GhstMail Does

GhstMail is an email alias service. You create disposable email addresses that forward incoming mail to your real inbox. Your real email address is never exposed to third parties.

Data We Collect

• Email address — used to create your account and as the forwarding destination for your aliases.
• Password — hashed with bcrypt before storage. We never store or see your plaintext password.
• Alias metadata — alias addresses, labels, active/inactive status, creation dates, and aggregate counts (emails received/forwarded). We do not store the content of forwarded emails.
• Filter rules — domains you choose to block or allow.
• Reply tokens — when someone emails one of your aliases, we store their address so that replying to the forwarded message can reach them without revealing yours. This is the sender's address, not the message. It is deleted when you delete the alias.
• Threading identifiers — the Message-ID of forwarded mail, so replies thread correctly in your mail client. An opaque identifier, not content.
• API keys — if you create one, we store its name, the scopes you granted, a displayable prefix, and a SHA-256 hash. We never store the key itself, which is why it is shown only once.
• Sending records — if you send mail through the API, we record which alias sent it, the recipient's domain, how many recipients there were, and when. We deliberately do not store the recipient's full address, the subject, or the body. The domain alone is what lets us enforce a sending quota; a full recipient log would be a record of who you talk to, which is the thing this service exists to avoid.
• Idempotency records — when an API client sends an Idempotency-Key, we keep the response to that request for 24 hours so a retry returns the original result instead of creating a duplicate. These responses can contain alias details. They are deleted after 24 hours.

Data We Do Not Collect

• We do not read, store, or log the content of your emails, including subject lines.
• We do not keep a list of who you correspond with. Received mail records the sender only for as long as the alias exists, and sent mail records the recipient's domain but never their address.
• We do not track your browsing history or web activity.
• We do not collect analytics, fingerprints, or telemetry.
• We do not use cookies for tracking or advertising.
• The CLI does not phone home. Its update check queries the npm registry, not us.

Chrome Extension

The GhstMail Chrome extension:

• Stores your authentication token locally using chrome.storage.local so you stay logged in.
• Detects email input fields on web pages to show the alias generation button. No page content is collected or transmitted.
• Communicates only with api.ghstmail.space to generate aliases and authenticate. No other external requests are made.
• Does not inject remote code or execute external scripts.

How Email Forwarding Works

When an email arrives at one of your aliases, our server parses it, rewrites the headers, and forwards it to your real email address. The email content passes through our server in transit but is never stored on disk or in our database. Reply tokens are generated to enable two-way communication without revealing your real address.

Sending From an Alias

If you use the API or CLI to send mail from an alias, the message goes out from our server, signed as your alias. The recipient sees the alias and never your real address, and their reply arrives back at the alias and forwards to you.

The message itself is not stored, before or after sending. We record only which alias sent it, the recipient's domain, the number of recipients, and the time, which is what enforces a per-account quota. Sending requires an API key you created with the messages:send permission, and no key has that permission unless you granted it explicitly.

Third-Party Sharing

We do not sell, rent, or share your personal data with any third party. We do not use your data for advertising, analytics, or creditworthiness purposes.

Data Retention

Your account data is retained as long as your account is active. Deleting an alias permanently removes it and all associated reply tokens, which means older forwarded messages can no longer be replied to through it. You can delete your account at any time, which removes all your data from our systems.

• Idempotency records — 24 hours, then deleted.
• Sending records — retained while the alias exists, and deleted with it. They hold a recipient domain and a timestamp, never an address or content.
• Revoked API keys — the row is kept, marked revoked, so you can see that a key existed and when it was last used. Only the hash is stored, never the key.

Security

Passwords are hashed with bcrypt. API keys are stored only as a SHA-256 hash, so a key cannot be recovered from our database, which is why we show it to you exactly once. All connections use TLS. DKIM signing is applied to forwarded and sent email. Dashboard authentication uses short-lived JWT tokens, and API keys carry scopes so a key can be limited to only what it needs.

Contact

For questions about this privacy policy, contact us at privacy@ghstmail.space.