Who we are
inbox2 is a trade name of Sadiq Beheer B.V., a company registered in the Netherlands under KVK number [to confirm: KVK number], at [to confirm: registered address]. We are the data controller for everything described on this page, and you can reach us at privacy@inbox2.com.
We have not appointed a Data Protection Officer. We are not required to, given our size and what we process, and if that changes we will name one here.
Where your mail lives
inbox2 runs in two ways, and they give completely different answers to the question of who holds your mail. Read whichever one applies to you.
Accounts you connect yourself
Gmail, Outlook, Office 365, any IMAP server: the app on your device talks to that provider directly. Your messages, attachments, calendar events and contacts sync into a database file on your own disk, on your own machine. They never reach our servers. We have no copy to read, to lose, or to hand to anyone who asks.
There is one place our server appears in that path. Realtime delivery for Gmail and Microsoft works by the provider notifying us that something changed in your mailbox, and we then wake your device. That notification carries your email address and a change counter. It carries no mail. Token exchange and refresh also pass through our server, because the provider requires a client secret we cannot ship inside an app that anyone can decompile. We use those tokens to complete the exchange and hand them back to your device. We do not store them and we do not use them to read your mailbox.
Domains hosted on inbox2 MX
If you point your domain’s MX records at us, we are running your mail server. Messages, attachments, calendars, contacts and the routing rules for that domain live in our database, because a mail server that cannot see mail cannot deliver it. On paid plans a domain can be sealed with client-side encryption, after which the content we hold is ciphertext that our own staff and our own database cannot open. Sealing is per domain and it is off by default.
Server-side AI triage on paid plans sends message text to a classification provider, OpenAI by default, to sort mail into Spaces. That feature is off unless your organisation turns it on, and with it off no classification vendor is in the path.
Google account data
When you connect a Google account, inbox2 asks for these scopes and uses them for these things only:
| Scope | What it is for |
|---|---|
gmail.modify | Read your mail into the app, send what you write, and write back the actions you take: read and unread, star, archive, label, move, trash. |
calendar | Show your calendar, create and edit events, answer invitations, and read free/busy for the scheduling assistant. |
contacts.readonly | Complete addresses as you type and put a name and face against a sender. |
email, profile | Know which account you just connected and label it in the app. |
inbox2’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer your Google data to anyone, we do not use it for advertising, we do not sell it, and no human at inbox2 reads it. On-device AI features run models on your own hardware, so mail processed by them stays on the device.
You can disconnect the account at any time in the app, which deletes the local copy and the stored token, and you can revoke our access outright at myaccount.google.com/permissions.
Microsoft account data
A connected Microsoft or Office 365 account works the same way, through the Graph API, with the scopes Mail.ReadWrite, Mail.Send, Calendars.ReadWrite, Contacts.Read and User.Read. Same rule: the mail syncs to your device, we hold no copy, and we use the access for nothing except running the app in front of you. Revoke it at myaccount.microsoft.com.
This website
inbox2.com is a set of static pages on Cloudflare Pages. It has no forms and no login. Cloudflare terminates TLS and keeps short-lived request logs, including IP addresses, to serve the page and to stop attacks. Beyond that the only thing collecting anything is analytics, and only if you agreed to it.
The waitlist and signup forms live on mail.inbox2.com. Those take your email address, and they are protected by Cloudflare Turnstile, which checks that you are a person and sets its own short-lived cookie to do so. We use a waitlist address to send you an invitation and nothing else.
Cookies
No analytics cookie is written until you press Accept on the banner. Decline and none of the vendors below ever load. Change your mind either way from Cookie settings at the bottom of any page, which clears what was set and reloads the page.
| Name | Set by | What it does | Lifetime |
|---|---|---|---|
inbox2.analytics-consent.v1 | inbox2 | Remembers whether you accepted or declined. Stored in your browser, never sent to us. | Until you clear it |
_ga, _ga_* | Google Analytics | Counts visits and tells us which pages get read. IP addresses are truncated. | 2 years |
ph_*_posthog | PostHog | Product analytics: which pages and links people use on the way to downloading. | 1 year |
Both vendors are configured for EU-hosted collection. Neither is used for advertising, and we run no advertising or social tracking pixels on this site.
Why we may hold it
- Performance of a contract. Running the mail service you signed up for, including hosting mail for an inbox2 MX domain and keeping your account.
- Consent. Analytics cookies, and connecting a Google, Microsoft or IMAP account. Both are yours to withdraw at any time.
- Legitimate interests. Keeping the service up, blocking abuse and spam, and security logging. We have weighed these against your rights and kept the logging to what an operator needs.
- Legal obligation. Invoicing and tax records for paid accounts.
Who else touches it
We do not sell personal data and we have never shared it for advertising. These are the processors involved in running the service:
| Processor | What for | Where |
|---|---|---|
| Cloudflare | Edge TLS, this website, Turnstile on the forms | Global edge, EU entity |
| [to confirm: hosting provider] | The servers running the API, database and mail nodes | [to confirm: country and region] |
| OpenAI | Server-side AI triage, paid plans, off by default | United States |
| Apple, Google | Push notifications to phones (a wake-up signal, no message content) | Global |
| Stripe | Payment processing for paid plans | EU and United States |
A Google, Microsoft or Meta account that you connect yourself is your provider, reached from your device. We are not a processor in that path.
We will also hand over data where a Dutch court or a legally binding order requires it. Where the law lets us tell you first, we will.
How long we keep it
Mail on an inbox2 MX domain is kept until you or your administrator deletes it, or until [to confirm: retention period after account closure] after the account closes. Sessions expire after 30 days of inactivity. Push subscription leases are collected after 30 days. Audit logs are kept for [to confirm: audit log retention]. Analytics data follows the vendor’s own retention setting, currently [to confirm: GA and PostHog retention window].
For accounts you connect yourself, the retention question is answered by your own disk. Delete the app, or disconnect the account inside it, and the local copy goes.
Where it is processed
Our servers run in [to confirm: hosting country and region]. Transfers to processors outside the EEA, currently OpenAI and Stripe, run on the European Commission’s Standard Contractual Clauses. We do not yet offer EU-only hosting as a contractual guarantee, and we would rather say so here than let you assume it. If you need that guarantee, you can run the whole stack yourself: the apps are open source under the Apache 2.0 licence and the server is source-available under the Functional Source License (FSL-1.1).
Your rights
Under the GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable format, and withdraw any consent you gave. Write to privacy@inbox2.com and we will answer within one month.
Being honest about a gap: the self-service data export in the product is not finished yet, so a portability request today is handled by us by hand. If you are unhappy with how we handled anything, you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens.
How it is protected
Traffic runs over TLS. Passwords are hashed. Credentials in the app’s vault are encrypted with libsodium under a key we never hold, so a sealed domain gives us ciphertext we cannot open. Every organisation is isolated at the query layer, and cross-tenant access returns a 404 rather than a permissions error. Access to production is limited to the people who operate it.
Two things we will say plainly, because you would find out eventually. We do not yet run automated off-site backups of the hosted mail database, and full client-side encryption is a per-domain option on paid plans. Both are being worked on, and until they land, weigh them.
Found a security problem? Mail security@inbox2.com and we will answer.
Changes
When we change this policy we update the date at the top. If a change affects what we do with data you already gave us, we will email account holders before it takes effect.
Contact
Sadiq Beheer B.V., [to confirm: registered address], the Netherlands. privacy@inbox2.com for anything on this page, hello@inbox2.com for everything else.