Last updated: November 2, 2026
This policy explains what personal data InboxVue handles when you use inboxvue.com, why, and what rights you have. The short version: the email files you open are processed only in your browser and are never sent to us. We handle a small amount of other data, described below.
Who we are
InboxVue is an independent software product operated from Morocco. For anything related to privacy, including exercising your rights, email hello@inboxvue.com. We are the controller of the personal data described in this policy. More about us is on the about page.
Your email files
When you open an EML, EMLX, MSG, MBOX, winmail.dat or other file in InboxVue, the file is read and processed by code running in your browser on your device. Its contents, including messages, attachments, addresses, subjects and file names, are not transmitted to InboxVue's servers or to any third party, and we have no access to them. Exports are created in your browser and saved directly to your device. How it works describes the technical design.
If you turn on "Remember opened files on this device", copies of the files and a search index are stored in your browser's private storage on that device only. You can delete them at any time with "Clear local data" or by clearing your browser's site data.
Remote images inside emails are blocked by default. If you choose to load them for a message, your browser contacts the servers named in that email directly, as any email client would. Those senders may then see your IP address and that the message was opened.
Data we do process
Account and purchase data. If you buy InboxVue Pro, we store your email address, your billing option (monthly, yearly or lifetime), its status, start, renewal and end dates, and the order and customer identifiers supplied by our payment provider. We use this to provide the plan you paid for and to let you sign in. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Sign-in data. We send one-time sign-in links by email. We store a hashed version of each link token for 15 minutes, and a session identifier in a cookie on your device (iv_session) for up to 180 days so you stay signed in. Legal basis: performance of a contract.
Payment data. Payments are handled by Polar Software, Inc. (polar.sh), which acts as merchant of record. Polar collects your payment details, billing address and tax information under its own privacy policy. We don't receive your full card number.
Usage statistics. With your consent where required, we use Google Analytics 4 to understand which pages and features are used. We send events such as page views, the type and size range of a file opened (for example "MBOX, 100 MB–1 GB"), and whether an export succeeded. We never send file names, subjects, email addresses or message content, and we don't use advertising features or Google signals. In the European Economic Area, the United Kingdom and Switzerland, analytics cookies are only set after you accept them in the consent banner; until then, Google Consent Mode sends cookieless signals without identifiers. Legal basis: consent (Art. 6(1)(a)) where required, otherwise our legitimate interest in improving the product (Art. 6(1)(f)).
Support emails. If you email us, we keep the correspondence to answer you and to handle any follow-up. Legal basis: legitimate interest.
Server logs. Our servers and our network provider record technical data such as IP address, browser type and the pages requested, for security and to keep the service running. Logs are kept for no more than 30 days unless needed to investigate abuse. Legal basis: legitimate interest.
Service providers
| Provider | Purpose | Data involved |
|---|---|---|
| Polar Software, Inc. | Checkout, payments, tax, invoices, refunds (merchant of record) | Email, billing and payment data |
| Resend | Sending sign-in and purchase emails | Email address, email content we send |
| Google LLC (Google Analytics 4) | Usage statistics | Pseudonymous identifiers and events described above |
| Cloudflare, Inc. | Network delivery, security, DNS and routing of our support email | IP address, request data, support emails in transit |
| Our hosting provider | Running our servers and database | Account, purchase and sign-in data |
Some of these providers are located in or process data in the United States and other countries outside your own. Where the GDPR applies, transfers rely on the European Commission's adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified, or on standard contractual clauses.
We don't sell personal data, and we don't share it for advertising.
Retention
- Account and purchase records: for as long as your account exists. If you delete your account, we delete your email address and sessions; anonymized order records are kept for as long as tax and accounting rules require.
- Sign-in tokens: 15 minutes. Sessions: up to 180 days of inactivity.
- Analytics data: 14 months in Google Analytics.
- Support emails: up to 3 years after the conversation ends.
- Backups: overwritten within 14 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, and to withdraw consent at any time (for analytics, use the cookie settings link in the footer). You can delete your account yourself from the account page. For any other request, email hello@inboxvue.com; we reply within 30 days. You also have the right to complain to a data protection authority, such as the one in your country of residence or, in Morocco, the CNDP.
Children
InboxVue isn't directed at children under 16, and we don't knowingly collect their data.
Security
We use encrypted connections (HTTPS) throughout, store sign-in tokens only as hashes, use secure, HTTP-only session cookies and limit server access to what's needed to run the service. Because your email files never reach our servers, they can't be exposed by a breach of our systems.
Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll notify customers by email before they take effect.
Contact
Questions about privacy: hello@inboxvue.com, or see our contact page. Related documents: terms of service and refund policy.