Last updated
Privacy Policy
This policy explains what eForward ("we", "us") collects when you use eforward.com and app.eforward.com, why, and what you can do about it. The short version: we keep what the service needs to forward your mail, we do not read or store your messages, and we do not sell data or show ads.
1. What we collect
Account
Your email address and, if you sign in with Google, the identifier of your Google account. We ask Google only for your address; we get no access to your Gmail or anything else in that account.
Service settings
The domains you connect, the addresses and inboxes you create, their settings and your plan.
- Forwarded messages pass through our servers and go straight on to your inbox. We do not read or store their content.
- For each message we keep a delivery record (the sender, the address it was sent to, the time, and whether it was delivered, held or refused) for 14 days, so you can see what happened in the app and so we can trace problems.
- A message we could not deliver is kept for up to 7 days so you can read it in the app, then deleted.
- The addresses of people who write to you are kept so that you can reply to them from your inbox through your own address.
Technical data
When you sign in we record the IP address and browser used, together with the session, which expires after 30 days without use. Our servers keep request and mail logs for a short time to debug problems and prevent abuse.
Payments
Paid plans are billed through Stripe, which collects your card details under its own privacy policy. We receive and keep your subscription status and a customer reference; we never see card numbers.
Analytics
We measure how the website and the app are used with Plausible, running on our own server. It sets no cookies, does not identify you and does not follow you across sites; we see aggregate counts such as page views, referrers, countries and device types.
2. How we use it
- to run the service: forward mail, route replies, show delivery status;
- to bill paid plans and keep the records that tax rules require;
- to send service emails: sign-in links, inbox confirmations, alerts about your domains and addresses, billing notices (we send no marketing email unless you ask for it);
- to keep the service and the inbox providers we deliver to safe from spam and abuse;
- to answer your support requests.
Where European data protection law applies, we rely on our contract with you, on our legitimate interest in running a secure and reliable service, and on our legal obligations for billing records.
3. Cookies
The app sets one cookie to keep you signed in (30 days) and a short-lived one to show a message after an action. There are no advertising or third-party cookies, and the analytics set none.
4. Where your data is and who helps us
Our servers are hosted in the Netherlands, in the European Union. These providers process data for us:
- UpCloud (Finland): servers and storage;
- Cloudflare: network protection for the website and the app, not for mail, which reaches our mail servers directly;
- Google: sign-in, only if you choose it;
- Stripe: payments.
Forwarded mail is, by design, delivered to the inbox provider you chose (Gmail, Outlook or another), where their policies apply.
5. How long we keep it
- Account and settings: while your account exists. When you close it, we delete them within 30 days; billing records are kept as long as the law requires.
- Delivery records: 14 days.
- Undelivered messages: up to 7 days.
- Sign-in sessions: 30 days after last use.
6. Your rights
You can see and change your settings in the app. You can ask us for a copy of your data, to correct or delete it, or to stop using it in a certain way, by writing to [email protected]. If you are in the EU, the UK or another place with similar rules, you also have the right to complain to your data protection authority.
7. Security
Connections to the app, and between mail servers, use TLS wherever the other side supports it. Credentials the service holds are encrypted at rest, and access to the servers is limited to the people who run them. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.
8. Children
The service is not meant for people under 16, and we do not knowingly collect their data.
9. Changes
We will post updates here and email you about changes that matter before they take effect.
10. Contact
Privacy questions and requests: [email protected].