Access scoped to an alias
IMAP tools use a separate app password for each alias. They can read and mark that alias’s messages as read, but cannot delete mail through IMAP. Replace or revoke access from the owner dashboard.
Privacy you can
put into practice.
Separate identities. Specific access. Clear retention.
Understand what PrivyMailbox protects, and how it works.
Protected connections
The website and IMAP endpoint use TLS with trusted certificates. Incoming internet email depends on the sending server’s transport capabilities. PrivyMailbox is a hosted email service, not an end-to-end encrypted mailbox; authorized service operations require access to message data.
Thoughtful email viewing
The dashboard sanitizes formatted email and blocks remote images by default. Opening external links or viewing forwarded copies in another email service is subject to that service’s privacy settings.
30-day live mail retention
Messages are removed automatically after 30 days. You can delete them earlier through the dashboard. Archived aliases keep their history under the same retention policy.
Seven-day recovery window
Recovery backups are encrypted before upload to offsite storage and retained for seven days. Deletion decisions prevent removed mail from returning through recovery after protection is confirmed. Backups may contain deleted content until their retention window expires.
Permanent address retirement
Deleting an alias reserves its address permanently, denies new logins and rejects new mail. Physical cleanup, active-session disconnection and recovery protection complete in the background. The dashboard reports pending work. Minimal retirement records persist to prevent reuse and resurrection.
Clear boundaries
Copies already forwarded to an external inbox, sender-held copies and data processed by third-party email providers follow their policies. No claim is made that aliases are invisible to websites or accepted by every service.
PrivyMailbox is an independent project in private preview. We do not claim independent security certification, a service-level guarantee or public SaaS readiness. For data handling details, read the privacy policy.