Who we are
apumail is operated from Chile and reachable at support@apumail.com. "We" below means the apumail service; "you" means the account holder, and by extension the agents acting under your credentials.
What we store
Messages
The whole point of the service. For each message delivered to an inbox you control we keep the sender, recipient, subject, body (text and sanitized HTML), attachments, and the timestamp. We also record the IP address and HELO name of the sending server, because without that provenance we cannot tell an abuse report from a false one. Mail you send through apumail is mirrored the same way, along with its delivery outcome (delivered, bounced, or reported as spam) so you can see what happened to it.
SMS works identically for numbers you rent: sender, recipient, body and timestamp.
Account and credentials
If you sign in, we store the identifier and verified email address that notlogin gives us, plus the inboxes, domains, folders and phone numbers you own. Every token we issue — inbox tokens, account API tokens, session cookies — is stored as a SHA-256 hash, never in the clear. We cannot recover a lost token; you rotate it.
Operational records
Each authenticated API call records the IP address, user-agent and optional agent label that made it, grouped per inbox. This is what powers the "agents" view, and it is how you find out which of your agents did something. Rate-limit counters are held in memory and are not persisted.
Payments
Paid handles, domain inboxes and phone numbers are paid on Solana in USDC or $PROWL. We store the transaction signature so the same payment cannot be claimed twice. We never see or hold a private key, and the transaction itself is public on the Solana blockchain — that is a property of the chain, not something we chose.
Mobile app
The apu app additionally stores a push notification token per inbox so we can notify the device when mail arrives. A push notification carries only the sender and the subject line, never the message body — it renders on a locked screen and passes through Expo's servers, so the body is deliberately left out. Delete the app, or remove the inbox from it, and the token is discarded. Your tokens are held in the device's secure keystore (Keychain / Keystore), not in ordinary app storage.
The app has no analytics SDK, no advertising identifier, and no third-party tracker. It talks to apumail and to rogerthat, and to nothing else.
Who else sees it
We use a small number of processors, each for one job:
- Resend — delivers mail you send. It necessarily sees the messages you send, not the ones you receive.
- DeepSeek — powers the optional AI View. Only if you turn it on, and only for the inboxes you explicitly select, the content of that mail is sent to DeepSeek to produce the report or answer a chat question. Leave AI View off and no message ever leaves our infrastructure for it.
- Telnyx and SMSGlobal — carry SMS. A mobile carrier necessarily sees message content; that is how SMS works.
- Google Cloud — hosts the servers, the database and the attachment storage.
- Expo — relays push notifications to the app (sender and subject only, as above).
- notlogin — the identity provider, if you sign in.
We do not sell your data, we do not share it for advertising, and we do not use the content of your messages to train any model. We disclose data otherwise only when a valid legal demand compels it.
How long we keep it
- Free inboxes expire 24 hours after their last activity, and their mail and attachments are deleted with them. Reading an inbox resets the clock. This is automatic and not recoverable.
- Paid handles, domain inboxes and phone numbers live as long as they are paid for. After the paid year ends the inbox is suspended (it stops accepting and serving mail); if it is still unpaid after the grace period it is released and its mail is deleted.
- Deleting an inbox deletes its mail, attachments, webhooks, rules and push tokens immediately.
- Backups — encrypted database dumps and disk snapshots are retained for 30 days, so deleted data can persist that long in backups before ageing out.
Your choices
You can read, export and delete everything through the same API the agents
use — there is no data we hold that the API will not show you. Concretely:
GET /api/v1/account lists what you own,
GET /api/v1/inbox/:address returns the mail,
DELETE /api/v1/inbox/:address destroys an inbox and everything
attached to it, and the Settings screen does the same from the app or the
dashboard. To close an account entirely, or to ask what we hold, write to
support@apumail.com and we will action it
within 30 days.
Depending on where you live you may have statutory rights of access, correction, deletion, portability and objection (GDPR, CCPA, Chile's Law 19.628). The same address handles those requests.
Security
All traffic is TLS. Tokens are hashed at rest. Inbound mail is checked for SPF, DKIM and DMARC alignment and against public blocklists. Outbound send is rate-limited per inbox and per IP, and is disabled automatically for an inbox that starts bouncing or drawing spam complaints. No system is perfect; if you find a vulnerability, please write to support@apumail.com before disclosing it.
Children
apumail is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 13.
Do not put secrets in a temp inbox
A free inbox is provisioned with no signup and is intended for verification codes and signup mail. It is not a mailbox for anything you would be harmed by losing — it deletes itself — nor for anything you consider sensitive personal data. Use a paid handle or your own delegated domain for anything that matters.
Changes
If we change how data is handled, this page changes with it and the date at the top moves. Material changes will also be announced on the dashboard.