Last updated: 23 October 2026
The mailflow.sh website uses no tracking cookies and no advertising trackers. We count visits with Cloudflare Web Analytics, which sets no cookies and doesn't build a profile of you. If you buy a license or plan, Paddle, our Merchant of Record, collects your payment details, and we receive your name and email address to fulfill the order. If you leave your email for hosted MailFlow, we keep it to email you about that and nothing else. The MailFlow software itself is self-hosted. We never have access to your email data.
mailflow.sh and MailFlow are run by Matthias (MailFlow), New York, USA, who is responsible for the personal data described here. Contact: contact@mailflow.sh.
On the website (mailflow.sh): We do not use advertising trackers or tracking cookies. We use Cloudflare Web Analytics to count page views and see which pages and sites bring visitors. It sets no cookies, doesn't track you across sites and doesn't build a profile of you; we see only totals, never individual visitors. The site is hosted on Cloudflare, which processes your IP address and request details to deliver the site and protect it from abuse, and may set a short-lived security cookie to detect bots. Cloudflare keeps these logs under its own retention rules.
On purchase: When you buy a commercial license, a business license or a partner plan, Paddle processes your payment. We receive from Paddle:
We do not receive or store your card number, bank details, or full billing address. Paddle handles all of that. Paddle also notifies our website of each purchase, renewal, cancellation and refund; those notifications are logged with their transaction and customer IDs, but not your name or email address.
Supporter listing: A business license includes the option to list your company as a supporter. We only list a company after asking you and getting your yes, and we show only the name and logo you approve. You can ask us to remove the listing at any time.
Hosted MailFlow interest list: If you leave your email in the hosted MailFlow form, it is stored with Loops, the service we use to send those emails. The form is protected by Cloudflare Turnstile, which checks that a person is submitting it. We use your address only to email you about hosted MailFlow, such as asking what you need or telling you if it launches. If you joined before 23 October 2026, when the form promised one email when hosted MailFlow launches, that launch email is the only one you will get. Every email has an unsubscribe link, and you can ask us to delete your address at any time.
Support and partner agreements: If you take a business support plan or a partner plan, we keep the contact details and correspondence needed to provide it.
We share personal data only with the services named in this policy, and only to run MailFlow's website and sales. We never sell it, and we do not send other marketing emails.
MailFlow is self-hosted software that runs entirely on your own server. We have no access to your email accounts, messages, passwords, or any data stored in your MailFlow instance. You are the data controller for your own deployment.
We are based in the USA, and these services may process data in the USA and other countries. Where data from the EU, UK or Switzerland is transferred, it relies on the safeguards these providers offer, such as the EU-US Data Privacy Framework or standard contractual clauses.
Interest list addresses are kept until you unsubscribe or ask us to delete them, or until we close the list. Purchase records (name, email, transaction ID) are retained for as long as reasonably necessary to support your license and comply with tax and accounting obligations. You may request deletion by contacting us. We will remove your data unless retention is required by law.
You may request access to, correction of, or deletion of personal data we hold about you, object to how we use it, or ask for a copy, at any time by emailing contact@mailflow.sh. We will respond within 30 days. If you are in the EU, UK or Switzerland, you can also complain to your local data protection authority.
We may update this policy from time to time. Changes will be posted on this page with an updated date.
Privacy questions? Email contact@mailflow.sh.