Privacy Policy

The controller responsible for data processing on this website (skyboxmail.de), in the Skybox web app (app.skyboxmail.de), and in the Skybox apps for desktop, iPhone, and Android, within the meaning of the EU General Data Protection Regulation (GDPR), is:

Marty Stephan
Landauer Str. 53
66482 Zweibrücken
Germany
Email: hello@skyboxmail.de

• We run no advertising, no ad tracking, and no cross-site profiling anywhere. We never sell your data or share it with third parties for their own purposes.
• This marketing website sets no cookies and runs no analytics at all.
• Your emails stay at your mail provider. Skybox reads them from there and does not store message bodies or attachments on our servers. To keep the app fast, our servers do keep some information about your messages: dates, read status, sizes, and folder names while an account is connected, and subjects, senders, and recipients in a cache that expires after 24 hours. See “Your email content” below.
• We store what we need to operate your account: your email address, a password hash, and the encrypted credentials for the mail, contact, and calendar accounts you connect. The key to those credentials is held on our servers.
• Usage analytics and session replays in the Skybox apps are off until you switch on “Help Improve Skybox” on a device. If you do, they go to PostHog on European servers, and text that could be mail is masked in replays before it leaves your device. Our servers report errors and usage counts to PostHog independently of that setting. The desktop app sends no analytics. See “Product analytics, error tracking, and session replay” below; it is worth reading in full.
• If you use push notifications on your phone, the sender, the address it was sent to, the subject line, and any detected one-time code of a new message travel through Google’s push service (and Apple’s on iPhone). That is unavoidable for mobile push with content. See “Push notifications” below for exactly what is sent and how to switch it off.

This marketing site sets no cookies, runs no analytics, and loads no resources from third-party servers: all fonts and assets are served from our own infrastructure. The analytics described further down apply to the Skybox apps, not to this website.

The window on the home page is a live demo of Skybox, embedded from demo.skyboxmail.de, which is also our own server. It runs against fixed example data, has no account behind it, and analytics are switched off in that build.

Like almost every web server, ours writes technical access logs when you visit: your IP address, the date and time, the requested page, the referring page, and your browser’s user-agent string. We use these logs solely to operate the site securely and diagnose problems (legal basis: Art. 6(1)(f) GDPR, legitimate interest). Log entries are deleted after 14 days at the latest.

When you create an account at app.skyboxmail.de, we process (legal basis: Art. 6(1)(b) GDPR, performance of a contract):

• Your name, email address, and password. The password is never stored in plain text, only as a salted hash (scrypt).
• A verification code sent to your email address to confirm it, stored hashed and valid for 10 minutes, and, if you forget your password, a link to set a new one.
• If you enable two-factor authentication: your TOTP secret and backup codes, and, if you choose to trust a device, a token that lets that device skip the second step for 30 days.
• If you sign in with Google or GitHub instead of a password: the name, email address, and profile picture those providers share with us, and the sign-in tokens they issue.
• Session data: a session that expires 7 days after you last used the app, together with the IP address and user-agent of the device or browser that started it. We keep these to secure your account; a session record is deleted when you sign out on that device, when you delete your account, and otherwise within an hour of the session expiring.
• What you set up in Skybox: profiles, signatures, sender addresses and display names, settings, notification preferences and quiet hours (with your time zone), API keys and the apps you have authorized, and messages you scheduled to send later (see “Your email content”).

Our API server logs every request the apps make: the time, the requested address (which can contain a folder name, an attachment’s file name, or a search term), the response status, the originating page, and your IP address. We use these logs solely to operate the service securely and diagnose problems (legal basis: Art. 6(1)(f) GDPR, legitimate interest). They are deleted after 14 days at the latest.

Skybox is a client for accounts you already own. When you connect an account, we store what is needed to connect on your behalf, together with the account’s name, your sender addresses, and its folder settings:

• For Google and Microsoft accounts: OAuth access and refresh tokens.
• For generic IMAP/SMTP, CardDAV, or CalDAV accounts: server addresses, usernames, and passwords.

All of these credentials are encrypted at rest with AES-256-GCM. To be transparent: the encryption key is held on our servers. It has to be, because Skybox needs to open connections to your provider for you. Our servers decrypt the credentials whenever they open such a connection, and when you export your data (see “Retention and deletion”). We use these credentials exclusively to provide the service you requested and for nothing else.

For every connected mail account, our servers keep a connection to its inbox open at all times, including while you are signed out, so that Skybox can notify you about new mail and send scheduled messages on time. This stops when you remove the account.

Message bodies and attachments are not stored in our database. When you open a message, Skybox fetches it from your provider over IMAP and passes it on to your app. Connections to your provider are held open in memory for up to 15 minutes so your mailbox feels fast.

To show message lists quickly and keep them in sync across your devices, our servers do keep information about your messages:

• In our database, for each message in the folders Skybox has synchronized: its number within the folder, the date it was received, its flags (such as read or flagged), its size, whether it has attachments, and which conversation it belongs to. The conversation is worked out from the Message-ID and References headers, which we store only as keyed hashes. We also store the name and message counts of each folder. This is kept while the account is connected and deleted when you remove it.
• In a short-term cache: each message’s subject, the names and addresses in From, To, and Cc, its date, and its Message-ID, In-Reply-To, and References headers. Every entry expires 24 hours after it was written. The cache is saved to disk on our server so that it survives a restart.
• Messages scheduled to send later wait in a folder of your own mail account, not on our servers. We keep only the folder, the message’s number in it, and the time it is due, and delete that entry once the message has been sent.

There is no server-side search index. Mail searches run at your provider, and our server combines the results with the information above. Contact searches load your address book from your provider and filter it in memory without storing it. Contacts and calendars are fetched from your provider when you need them.

Verification codes. If “Detect Verification Codes” is switched on (Settings → Messages; it is on by default), the subject and text of messages you open, and of new messages under 256 KB that we are about to notify you about, are sent to a code-detection model that runs on our own servers, not with an outside AI provider. It returns any one-time code it finds. We keep that code in memory for 15 minutes so the app can show it with a copy button, and put it in the push notification. Neither the message nor the code is logged. When the setting is off, your mail is not scanned for codes.

On your device, the apps keep a local cache so they open quickly and work offline: message lists and headers, the full content of messages you have opened (up to about 64 MB), attachments you have opened (up to about 256 MB), and other data the app has loaded, such as contacts, calendar entries, and your settings. In the browser and the desktop app it lives in the browser storage (IndexedDB); on iPhone and Android in the app’s own database and cache folder. Skybox does not encrypt this cache itself; it is protected by your device’s own security. It never leaves your device and is deleted when you sign out, when you clear it under Settings → Account → Cache, when you clear your browser’s site data, or when you uninstall the app.

Emails often embed images hosted on the sender’s servers, which senders can use to see when and from where you open a message. New Skybox accounts block remote images by default: such messages are displayed without loading anything from the sender. If you switch remote images on under Settings → Messages → Remote Images, your device loads them directly from the sender’s servers, which reveals your IP address and the time you opened the message to them.

If you send a file as a download link, or an app you have connected (such as an AI assistant) uploads a file to attach it to a message, the file is stored on the disk of our application server; no external storage provider is involved. A file uploaded to be attached is deleted no later than 60 minutes after it was uploaded. A file sent as a link is kept until the expiry date you chose (30 days by default, at most 365 days) or until you delete it under Settings → Files; an upload that was never completed is deleted after 24 hours. Deleting your Skybox account erases these files as well, not just the records of them.

Anyone who has the link can open its download page, which shows the file name, its size, the expiry date, and your name and email address as the sender.

The download page carries a link to report the file to abuse@skyboxmail.de. When a file is reported, we use the report, the reporter’s email address, the file, and its record (including who sent it) to review the report and, where necessary, delete the file and act on the sender’s account. The legal basis is our legitimate interest in keeping the service free of unlawful content (Art. 6(1)(f) GDPR) and, where it applies, our legal obligation to act on notices of illegal content (Art. 6(1)(c) GDPR). We keep reports only as long as we need them to handle the case and document our decision.

You can share a connected mail account with another Skybox user by creating an invitation link. The link can be used once, within 7 days, by whoever has it, so pass it on only to the person you mean. Whoever accepts gets full access to that account in Skybox: they can read, send, move, and delete mail just as you can. They see your name and email address as the account’s owner, and you see who has access. You can revoke a share, and they can leave it, at any time.

To see which parts of Skybox are actually used and to find breakage before you have to report it, the Skybox web app, the apps for iPhone and Android, and our own servers send data to PostHog (PostHog, Inc., San Francisco, USA), acting as our processor under Art. 28 GDPR. We use PostHog Cloud EU: the data is stored in Frankfurt am Main, Germany.

The apps send nothing unless you agree. No event, log line, or replay, and not even a request for PostHog’s configuration, leaves an app until you switch on “Help Improve Skybox” under Settings → Account → Privacy. The choice is stored on each device separately, so a new device starts with it switched off. Switching it off again stops all sending from that device. The desktop app sends no analytics whatever the setting, and neither does the demo on our website.

What the web app and the mobile apps send once you have agreed:

• Your Skybox user ID once you are signed in: an internal identifier, not your name and not your email address.
• Route patterns instead of URLs. A page or screen view is recorded as, for example, /p/:profileId/mail/u/inbox. The identifiers in the real address (which profile, which mailbox, which message) are stripped out before an event leaves your device.
• Technical data: browser or device and operating system, app version, screen size, language, page-load and request timings, when the app is opened, backgrounded, installed, or updated, and your IP address, from which PostHog derives an approximate location. The IP address is not used to identify you.
• Errors and log lines: error reports and the app’s own log lines both pass through a filter that removes email addresses, links, message references, and access tokens. In an error report that covers the error message, the text in the stack trace, and the source lines around it; the values of local variables are dropped entirely, as are the breadcrumbs the analytics library would otherwise attach. The file names of Skybox’s own program code stay, because a stack trace without them says nothing. In a log line, attributes that name mail (a subject, a mailbox, a folder, a file name, a sender) are dropped by their name, and a mailbox path below INBOX is shortened. What the filter still cannot recognize is a folder name or a subject written into free text, so one can remain in a message. On iPhone and Android we are not certain that a crash caught by the operating system’s own layer passes through this filter at all.
• A session identifier sent along with the app’s requests to our server, so that a replay can be matched with our server’s log entries for the same requests.
• Session replays, masked as described below.

What our servers report, whether or not you have switched the setting on:

• Product events tied to your user ID, with counts and flags: that a message was sent, how many recipients it had, whether it had attachments, whether it was a reply; that a draft was saved, messages deleted, a send scheduled, a mailbox shared or a share accepted; that an account was connected or removed, including the host names of its mail servers.
• Error reports with the error message and stack trace, and the server’s warning and error log lines. Both go through the same kind of filter as in the apps before they are sent, which removes email addresses, the query part of links, and credentials. As with the apps, a folder name or subject can remain in them.

Session replay: what it is and what we do about it. A replay reconstructs how the app behaved during a session, so a bug that is impossible to describe can simply be watched. In a mail client that is dangerous by default, because the screen is other people’s correspondence. So it is masked before anything leaves your device, and the masking is built the safe way round:

• In the browser, every piece of text is masked and replaced by dots. Only text explicitly marked as app furniture (button labels, menu entries, headings we wrote ourselves) is released. Anything added to the app in future is masked until someone deliberately unmasks it.
• The message body is not recorded at all. It is excluded outright rather than masked, and replaced by an empty placeholder of the same size.
• Subjects, senders, addresses, folder names, profile names, and every text you type are masked. Attached images are not recorded. Tooltips are masked too wherever they repeat your own text, such as an attachment’s full file name, an account badge, or the accounts listed in a profile.
• In the browser, network requests appear with their timings and the kind of request only. Neither their content, their headers, nor the account, folder, and message identifiers in their addresses are recorded.
• On iPhone and Android, replay is a series of screenshots (about one per second). Images and text fields are hidden, and the screens that show mail, including the message itself, are covered as whole blocks. So are the settings screens, which would otherwise show your account’s email address, your mail accounts with their names and servers, a two-factor setup key and its backup codes, an API key at the moment it is created, and your signatures; on iPhone the folder picker is covered as well. A replay contains neither the app’s console output nor the addresses and timings of its network requests.
• Two things on Android are recorded as they are, for a user who switched the setting on, and we cannot currently cover them: the sheet of actions for a message or a contact, which shows a contact’s name and address and, on its move and copy pages, your folder names; and the folder picker, which shows your folder names. Both are drawn by a component the recorder’s masking does not reach. A screen’s title bar is drawn by the operating system, outside anything the app can mask, so a file or account name used as a title can appear in a replay on either platform.

Masking is a mechanism, not a promise: it is code, and code can have gaps, some of which are listed above. We would rather say that than claim a guarantee. If you would prefer not to be recorded at all, leave “Help Improve Skybox” switched off.

What stays switched off everywhere: autocapture (which would ship the text of whatever you clicked, such as a subject line or a sender), heatmaps, dead-click and rage-click tracking, surveys, feature flags, and advertising identifiers.

On your device: in the browser, only your choice itself is stored (in local storage). The pseudonymous identifier PostHog uses lives in memory for as long as the page is open and is gone afterwards; there is no analytics cookie. The apps for iPhone and Android, once you have agreed, keep a random PostHog identifier and events not yet sent in the app’s storage. Signing out or switching the setting off replaces the identifier, and uninstalling the app removes it. The desktop app stores only your choice.

Legal basis for what the apps send: your consent, Art. 6(1)(a) GDPR, which you give by switching on “Help Improve Skybox” and can withdraw at any time by switching it off, without affecting the lawfulness of processing before that. Legal basis for what our servers report: Art. 6(1)(f) GDPR, our legitimate interest in operating a working product and in fixing what breaks; you can object at any time (Art. 21 GDPR). In either case you can write to hello@skyboxmail.de; we will then delete the analytics records, logs, and replays tied to your account and exclude your user ID from further processing. We do not use this data for advertising, profiling, or any decision about you. PostHog is a US company and may access the European data for support purposes; that transfer is covered by the EU standard contractual clauses in our data processing agreement with them.

If you install the Skybox app on an iPhone or an Android phone and allow notifications, we tell you about new mail through Firebase Cloud Messaging (FCM), operated by Google (Google Ireland Limited, Dublin, for users in Europe) as our processor. On an iPhone, Firebase hands the notification on to Apple’s Push Notification service (APNs). There is no way to deliver a push notification on either platform without the platform’s own service.

Please read this part carefully, because it is the place where the most about your mail leaves our servers. A notification about a new message contains:

• the sender’s name (or address), shown as the notification title,
• the address the message was sent to, so you can tell which of your inboxes it landed in,
• the subject line of the message, shown as the notification text, with a paperclip symbol if it has attachments,
• a one-time code, if one was detected in the message (see “Your email content”), at the start of the text and as a separate field,
• the name of the folder, an internal link to the message (profile, account, and message number), the number of unread messages for your app icon, and your device’s push token.

The message body, its attachments, and the rest of your mailbox are never sent. But the details above do pass through Google’s infrastructure (and on iOS additionally Apple’s), encrypted in transit but readable by them. There is currently no setting that sends notifications without this content. Google states that it stores a notification it cannot deliver yet (phone off, no network) for up to 28 days and then discards it. Notifications about an account we had to pause, or a scheduled send that failed, contain only the account’s name, for a paused account its address, and a short status text.

On our own servers we keep, per device, the push token, the platform (iOS or Android), the time it last registered, the badge number last sent, and a public key the app generates (used only by self-hosted Skybox installations for encrypted delivery, not by our service). We also keep your notification settings per account, including quiet hours and your time zone. The device record is deleted when you sign out, when the app finds that you have taken the notification permission away, when the platform reports the token as no longer valid, and when you delete your account.

How to switch it off: turn notifications off for an account under Settings → Notifications, or set quiet hours; nothing is then sent for that account, or during those hours. Signing out removes the device’s registration entirely. Denying or revoking the notification permission in your phone’s system settings also ends it: the next time the app starts or comes back to the foreground, it tells our server to forget the device, and nothing further is handed to Google or Apple for it. Until that moment, a notification already on its way can still be passed on. Allowing notifications again registers the device again. The web app in a browser and the desktop app use no third-party push service at all: they receive events directly from our server over the connection they already hold open, and any notification is drawn by your own operating system.

Legal basis: Art. 6(1)(b) GDPR (delivering a function you switched on), together with your consent to notifications given in the operating system’s permission prompt. Google and Apple are processors for delivery under their respective data processing terms; where they process data outside the EU/EEA, the transfer rests on the EU–US Data Privacy Framework or on standard contractual clauses. Push delivery requires the Firebase component in the app, which processes a Firebase installation ID, and on Android additionally Google Play services on your device.

Besides the web app there is a desktop app (the same app in its own window) and apps for iPhone and Android. They talk to the same servers and process the same data as the web app, with these differences: the sign-in token is stored in your operating system’s secure storage rather than in a browser cookie (on Linux without a keyring, the desktop app does not store it at all); the local cache described above lives in the app’s own storage; mobile push works as described in the previous section; and the desktop app checks downloads.skyboxmail.de, our own server, for updates, which transmits your IP address. The mobile apps access your photos or camera only when you attach a photo or set a contact’s picture, and your files only when you pick one to attach, and read nothing else from your device.

We send you emails required to operate your account: verification codes and password reset links. They are sent through a mail server operated by our host (see “Hosting and recipients”). We do not send marketing email.

You can grant external applications, including AI assistants, access to your Skybox account via API keys or OAuth. We store a record of each key and each authorized app, with its name and the permissions you granted, so you can see and revoke them. Such apps receive the mail, contact, and calendar data their permissions allow when they act on your instructions, and process it under their own privacy policies. You can revoke their access in the app at any time.

Skybox runs on servers operated for us by Digital Services Stephan (DSS-Net), Germany (dss-net.de), acting as our processor under Art. 28 GDPR. The servers are located in Germany. This includes our database, the short-term message cache, stored files, the code-detection service, and the mail server that sends our account emails.

Besides our host, these are the only processors that receive personal data:

• PostHog, Inc.: product analytics, error tracking, logs, and session replay, on PostHog Cloud EU (data stored in Frankfurt, Germany), as our processor under Art. 28 GDPR.
• Google (Google Ireland Limited / Google LLC): delivery of push notifications to mobile devices via Firebase Cloud Messaging, as our processor under the Firebase data processing terms.
• Apple Inc.: delivery of the same notifications to iPhones via the Apple Push Notification service.

Where any of these processes data outside the EU/EEA (typically in the United States), the transfer rests on the EU–US Data Privacy Framework or on standard contractual clauses under Art. 46 GDPR.

The providers of the mail, contact, and calendar accounts you connect, and Google or GitHub when you sign in through them, process your data as independent controllers under their own privacy policies. The same applies to people you share an account with, to anyone you give a download link, and to apps you authorize. All of these receive data only at your initiative.

This website sets no cookies of any kind and stores nothing on your device, which is why you won’t find a cookie banner here.

The web app uses first-party cookies that are necessary to operate it: a session cookie to keep you signed in (expiring 7 days after you last used the app), short-lived cookies during OAuth and two-factor sign-in, a cookie remembering which sign-in method you last used, and, if you choose to trust a device during two-factor sign-in, a cookie valid for 30 days. In local storage it keeps your display preferences and your analytics choice, and in IndexedDB the local cache described under “Your email content”.

The desktop and mobile apps keep your sign-in and two-factor tokens (and, on phones, the key for push notifications) in the operating system’s secure storage, and your preferences and the local cache in their own app storage. The PostHog identifier described above is stored only on iPhone and Android, and only after you switch on “Help Improve Skybox”.

Everything stored on your device is therefore either necessary to run the app, your own data kept locally for your benefit, or stored because you agreed to it. We set no advertising cookies and no third-party tracking cookies anywhere.

Account data, connection data, and the message information described under “Your email content” are kept for as long as your account exists. You can remove individual connected accounts at any time, which deletes their credentials and the message information we hold for them immediately; entries in the short-term cache expire within 24 hours. You can delete your entire Skybox account in the app under Settings → Account, which deletes your account, sessions, connected accounts, settings, shares, and device registrations from our database, and erases the files you still had stored with us: files you sent as a link, and files a connected app had uploaded to attach. You can also request deletion by emailing hello@skyboxmail.de.

Other retention periods:

• Access logs of this website and of our API server: 14 days at the latest.
• Verification codes for your email address: 10 minutes. One-time codes detected in your mail: 15 minutes.
• Sessions, with the IP address and user-agent they recorded: 7 days after you last used the app, then deleted within the hour.
• Unused share invitations: 7 days.
• Files uploaded to be attached: 60 minutes at the latest. Files sent as links: until they expire (at most 365 days) or you delete them.
• Push registrations: as described under “Push notifications”.
• Analytics records, logs, and replays in PostHog are pseudonymous and are not removed automatically when you delete your Skybox account; we delete them on request.

You can export your data (Art. 20 GDPR) from within the app, after confirming your password or a two-factor code. The export contains your profiles, signatures, settings, and connected accounts with their server settings and sender addresses. For accounts that sign in with a password, it includes that password in plain text so you can move to another client, so treat the file accordingly. Tokens for Google or Microsoft accounts are not included.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

To exercise any of these rights, email hello@skyboxmail.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Mainz, Germany.

We will update this policy when the service changes and note the date of the latest revision at the top of this page.