Privacy policy
We keep as little as we can, we don’t read your mail, and we don’t sell or share data for advertising. This page says exactly what that means.
Last updated 9 November 2026
- No email, phone or name An account is a random number.
- No trackers No analytics, ads or third-party scripts.
- Servers in the EU OVH, in France.
- Delete it yourself One button in your account.
Who is responsible
- Who runs it
- An individual based in Poland
- Role
- Controller under the GDPR and the UK GDPR
- Servers
- OVH, France (European Union)
- Contact
- privacy@delitesco.net
What we store
Each item, why we have it, and how long it stays.
| What | Details | Why | How long |
|---|---|---|---|
| Account number | Only a one-way hash and the last 4 digits | To log you in | With the account |
| Account dates | When it was made, when paid time ends | To run the subscription | With the account |
| Two-factor secret | Encrypted, only if you turn it on | To check login codes | Until you turn it off |
| Logins | A hash of each session and its expiry | To keep you logged in | Until it expires or you log out |
| API keys | A hash, a name, when last used | For the extension and password managers | Until you revoke the key |
| Aliases | The address, and the site it was made for | To deliver your mail | Until you delete it |
| Forwarding addresses | The inboxes you add | To know where to deliver | Until you remove it |
| Activity list | Who wrote to which alias, when, and the result | It is the list you see | While the alias exists |
| Refused mail | Messages that bounce, fail sender checks or look like spam | So you can look at them | 7 days |
| Mail waiting to be delivered | A message that couldn’t be delivered yet | To try again | Until delivered or given up |
| Payment orders | Months, price, status, invoice number, and when you confirmed the payment terms | To add the time you paid for, and to refund it | With the account |
| IP addresses | Network part only for IPv6 | To slow down password guessing and sign-up floods | Under an hour |
| Mail server logs | Sending server, sender and recipient, result | To find and fix delivery problems | Rotated, kept short |
If you wrote to someone who uses delitesco, your address and message are handled the same way, for the same purpose: to deliver them. Write to us if you want yours removed.
What we never have
| What | Why not |
|---|---|
| Your account number | Only its hash is stored |
| The content of your mail | It passes through to your inbox |
| Your name, phone number or email at sign-up | Never asked for |
| Your payment details | Taken by our payment provider, never by us |
| Your email and name when you pay | A provider may ask for them for the receipt and tax. Its notices to us can contain them, and we read the order and keep none of it |
| Which pages you visit here | No analytics and no web server access logs |
Cookies and storage
No analytics, no advertising, no third-party scripts. Fonts come from our own server.
| What | What it does | How long |
|---|---|---|
| Login cookie | Keeps you logged in. HttpOnly and Secure, set only after you log in. | Until you log out or it expires |
| In-development notice | Remembers that you closed it. Stays in your browser. | Until you clear site data |
| Home screen suggestion | Remembers that you closed it. Stays in your browser. | Until you clear site data |
The browser extension
| It | What happens |
|---|---|
| Looks for email fields | Inside your browser. Nothing is sent. |
| When you press its button | Sends the site’s domain to delitesco, to find or make the alias. |
| What it keeps | A key you can revoke in Account → Security, and its settings in your browser. |
| What it never sees | Your account number. |
Why we use your data
We make no automated decisions about you and build no profiles.
| Purpose | What it covers | Legal basis |
|---|---|---|
| Running the service you asked for | Account, mail delivery and payments | Contract |
| Security and delivery | Limiting abuse, fixing delivery problems | Legitimate interests |
| Legal duties | If an authority legally requires it | Legal obligation |
Who receives it
We don’t sell data. Only these receive it.
| Who | What they get | Where and how |
|---|---|---|
| Payment providers | Your payment, made on the provider’s own page. We use NOWPayments for crypto and Creem for cards. Creem sells you the time as the merchant of record and holds your email, name, card details and country for the receipt and tax | Each provider’s own privacy policy applies |
| OVH | Everything we store, as our hosting provider | France. It doesn’t use it for itself |
| Your inboxes | The mail forwarded to the addresses you add | Those providers’ own policies |
We may disclose data if a court or another authority legally requires it. We hold very little, so there is little to hand over: no names, no mail, and no email address except your forwarding addresses. If you forward mail to an inbox outside the EU or the UK, that transfer is your choice.
How long we keep it
When paid time ends, this is what happens and when.
| When | What happens |
|---|---|
| Paid time left | Everything works. |
| Paid time ends | No new aliases and no replies. Mail keeps arriving. |
| After 14 days | Forwarding pauses. Senders’ servers keep retrying for a few days. |
| After 30 days | The account, aliases, forwarding addresses, settings, activity and payment records are deleted for good. |
| Never had paid time | Only the hashed number exists. It stays until you delete it. |
| You delete the account | Everything is deleted right away. |
Add time before the account is deleted and everything comes back. Afterwards nothing can be restored.
Your rights
In the EU and the UK. Most of them are buttons in your account.
| You can | How |
|---|---|
| See and take your data | Account → Download everything (JSON), Export aliases (CSV) |
| Correct it | Change a forwarding address or an alias’s settings |
| Delete it | Account → Delete account |
| Restrict or object | Write to privacy@delitesco.net |
| Complain | To a data protection authority (below) |
We know so little about you that we can’t tell which account is yours unless you log in, so please use your account for these. For anything else, write to privacy@delitesco.net; we aim to answer within a month.
To complain, contact the data protection authority where you live. In Poland that is UODO; in the United Kingdom it is the ICO.
The rest
- Security
- Account numbers, sessions and API keys are stored only as hashes, two-factor secrets are encrypted, and everything is served over HTTPS. If something puts your data at risk, we will say so on this site and in your account, since we have no email address for you.
- Children
- delitesco is not meant for children under 16, and we don’t knowingly make accounts for them.
- Changes
- If we change this policy in a way that matters, we will say so here and, where we can, in your account. The date at the top shows the latest version.