Privacy Policy

The controller responsible for data processing on this website (skyboxmail.de), in the Skybox web app (app.skyboxmail.de), and in the Skybox apps for desktop, iPhone, and Android, within the meaning of the EU General Data Protection Regulation (GDPR), is:

Marty Stephan
Landauer Str. 53
66482 Zweibrücken
Germany
Email: hello@skyboxmail.de

• We run no advertising, no ad tracking, and no cross-site profiling — anywhere. We never sell your data or share it with third parties for their own purposes.
• This marketing website sets no cookies and runs no analytics at all.
• Your emails stay at your mail provider. Skybox fetches them live when you read them and does not store message contents, subjects, or attachments on our servers.
• We store what we need to operate your account: your email address, a password hash, and — encrypted — the credentials for the mail, contact, and calendar accounts you connect.
• The Skybox app does measure product usage, errors, and — with every piece of text that could be mail masked before it leaves your device — session replays, using PostHog on European servers. It is pseudonymous and stores nothing on your device. See “Product analytics, error tracking, and session replay” below; it is worth reading in full.
• If you use push notifications on your phone, the sender and the subject line of a new message travel through Google’s push service (and Apple’s on iPhone). That is unavoidable for mobile push — see “Push notifications” below for exactly what is sent and how to switch it off.

This marketing site sets no cookies, runs no analytics, and loads no resources from third-party servers — all fonts and assets are served from our own infrastructure. The analytics described further down apply to the Skybox app, not to this website.

The window on the home page is a live demo of Skybox, embedded from demo.skyboxmail.de — also our own server. It runs against fixed example data, has no account behind it, and analytics are switched off in that build.

Like almost every web server, ours writes technical access logs when you visit: your IP address, the date and time, the requested page, the referring page, and your browser's user-agent string. We use these logs solely to operate the site securely and diagnose problems (legal basis: Art. 6(1)(f) GDPR — legitimate interest). Log entries are deleted after 14 days at the latest.

When you create an account at app.skyboxmail.de, we process (legal basis: Art. 6(1)(b) GDPR — performance of a contract):

• Your name, email address, and password. The password is never stored in plain text — only a salted hash (scrypt).
• A verification code sent to your email address to confirm it, stored hashed and valid for 10 minutes.
• If you enable two-factor authentication: your TOTP secret and backup codes.
• If you sign in with Google or GitHub instead of a password: the name and email address those providers share with us.
• Session data: a session cookie valid for up to 7 days, together with the IP address and browser user-agent of each session. We keep these to secure your account (e.g. so you can recognize your active sessions); they are deleted when the session expires or you sign out.

Skybox is a client for accounts you already own. When you connect an account, we store what is needed to connect on your behalf:

• For Google and Microsoft accounts: OAuth access and refresh tokens.
• For generic IMAP/SMTP, CardDAV, or CalDAV accounts: server addresses, usernames, and passwords.

All of these credentials are encrypted at rest with AES-256-GCM. To be transparent: the encryption keys are held on our servers — they have to be, because Skybox needs to open connections to your provider for you. We use these credentials exclusively to provide the service you requested and for nothing else.

Message contents, subjects, headers, and attachments are not stored on our servers. When you open a mailbox or a message, Skybox connects live to your provider over IMAP, relays the data to your browser, and keeps nothing. Connections are held open in memory for up to 15 minutes so your mailbox feels fast, then closed. There is no server-side search index — searches run directly at your provider. The same applies to contacts and calendars: they are fetched from your provider when you need them.

Your browser keeps a local cache on your device so the app opens quickly: message list information (senders, subjects, dates), contacts, calendar entries, and your settings. Full message bodies and attachments are not persisted locally. This cache never leaves your device and is removed when you clear your browser's site data.

Emails often embed images hosted on the sender's servers, which senders can use to see when and from where you open a message. If remote images are enabled in your settings, your browser loads them directly from the sender, which reveals your IP address to them. You can block remote images under Settings → Messages → Remote Images; blocked messages are displayed without loading anything from the sender.

To see which parts of Skybox are actually used and to find breakage before you have to report it, the Skybox app sends usage events, error reports, redacted log lines, and masked session replays to PostHog (PostHog, Inc., San Francisco, USA), acting as our processor under Art. 28 GDPR. We use PostHog Cloud EU: the data is stored in Frankfurt am Main, Germany. This covers the web app at app.skyboxmail.de, the desktop app, the apps for iPhone and Android, and our own backend. The demo on our website is excluded.

What is sent:

• Your Skybox user ID once you are signed in — an internal identifier, not your name and not your email address. Events from a signed-out visitor are not tied to a person at all.
• Route patterns instead of URLs. A page view is recorded as, for example, /p/:profileId/mail/u/inbox. The identifiers in the real address — which profile, which mailbox, which message — are stripped out before an event leaves your device, including from referrer and “first page seen” properties.
• Product events with counts and flags only — that a message was sent, how many recipients it had, whether it carried an attachment, whether it was a reply; that an account was connected and with which provider; that a draft was saved, a message deleted, a send scheduled, a mailbox shared. Never a recipient, a subject, a file name, or any message content.
• Technical data your browser or app sends with any request: browser and operating system, app version, screen size, language, page-load and request timings, and your IP address, from which PostHog derives an approximate location. The IP address is not used to identify you.
• Errors and log lines: the type, message, and stack trace of an exception or crash, and the app’s own warning and error log lines — passed through a redactor that removes addresses, mailbox paths, and message identifiers first.
• Desktop app only: a random installation ID generated on your computer, plus app-level events such as launch, deep links, and notification clicks. It is not linked to your Skybox account and disappears when you uninstall the app.

Session replay — what it is and what we do about it. A replay reconstructs how the app behaved during a session, so a bug that is impossible to describe can simply be watched. In a mail client that is dangerous by default, because the screen is other people’s correspondence. So it is masked before anything leaves your device, and the masking is built the safe way round:

• In the browser and desktop app, every piece of text is masked and replaced by dots. Only text explicitly marked as app furniture — button labels, menu entries, headings we wrote ourselves — is released. Anything added to the app in future is masked until someone deliberately unmasks it.
• The message body is not recorded at all. It is excluded outright rather than masked, and replaced by an empty placeholder of the same size.
• Subjects, senders, addresses, folder names, profile names, and every text you type are masked. Attached images are not recorded.
• On iPhone and Android, replay is a series of screenshots (about one per second) in which images, text fields, and every element showing mail are blacked out.
• Network requests appear with their timings only. Neither their content nor their headers are recorded.

Masking is a mechanism, not a promise: it is code, and code can have gaps. We would rather say that than claim a guarantee. If you would prefer not to be recorded at all, write to us — see the objection route below.

What stays switched off everywhere: autocapture (which would ship the text of whatever you clicked — a subject line, a sender), heatmaps, dead-click and rage-click tracking, surveys, feature flags, advertising identifiers, and the analytics SDKs’ own console capture (our log lines go through the redactor instead).

In the browser and in the desktop window, nothing is stored on your device for this. The pseudonymous identifier PostHog uses lives in memory for as long as the page is open and is gone afterwards — no analytics cookie, no entry in local storage. That is why you meet no cookie banner in the app either. The apps for iPhone and Android, and the desktop app’s own shell, keep a random identifier in their app storage instead, because they have no page load to tie it to; it is not linked to your name or address and disappears when you uninstall the app.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a working product and in fixing what breaks. We do not use this data for advertising, profiling, or any decision about you. You can object at any time (Art. 21 GDPR) by writing to hello@skyboxmail.de; we will then delete the analytics records, logs, and replays tied to your account and exclude your user ID from further processing. PostHog is a US company and may access the European data for support purposes; that transfer is covered by the EU standard contractual clauses in our data processing agreement with them.

If you install the Skybox app on an iPhone or an Android phone and allow notifications, we tell you about new mail through Firebase Cloud Messaging (FCM), operated by Google (Google Ireland Limited, Dublin, for users in Europe) as our processor. On an iPhone, Firebase hands the notification on to Apple’s Push Notification service (APNs) — there is no way to deliver a push notification on either platform without the platform’s own service.

Please read this part carefully, because it is the one place where something about your mail leaves our servers. A notification about a new message contains:

• the sender’s name (or the account name), shown as the notification title,
• the subject line of the message, shown as the notification text, and whether it has an attachment,
• the address the message was sent to, so you can tell which of your inboxes it landed in,
• an internal link to the message (profile and message ID), the number of unread messages for your app icon, and your device’s push token.

The message body, its attachments, and the rest of your mailbox are never sent. But sender and subject do pass through Google’s — and on iOS additionally Apple’s — infrastructure, encrypted in transit but readable by them. Google states that it stores a notification it cannot deliver yet (phone off, no network) for up to 28 days and then discards it. Notifications about an account we had to pause, or a scheduled send that failed, contain only the account name and a short status text.

On our own servers we keep, per device, only the push token, the platform (iOS or Android), the time it last registered, and the badge number last sent. The row is deleted when you sign out, when you turn notifications off, when the platform reports the token as dead, and when you delete your account.

How to switch it off: deny or revoke the notification permission in your phone’s system settings, or sign out — in both cases the token is removed and nothing further is sent through Google or Apple. The web app in a browser and the desktop app use no third-party push service at all: they receive events directly from our server over the connection they already hold open, and any notification is drawn by your own operating system.

Legal basis: Art. 6(1)(b) GDPR — delivering a function you switched on — together with your consent to notifications given in the operating system’s permission prompt. Google and Apple are processors for delivery under their respective data processing terms; where they process data outside the EU/EEA, the transfer rests on the EU–US Data Privacy Framework or on standard contractual clauses. Android additionally requires Google Play services on your device, which processes a Firebase installation ID.

Besides the web app there is a desktop app (the same app in its own window) and apps for iPhone and Android. They talk to the same servers and process the same data as the web app, with three differences: the sign-in token is stored in your operating system’s secure storage rather than in a browser cookie; the local cache described above lives in the app’s own storage and is removed when you uninstall it; and mobile push works as described in the previous section. The mobile apps ask for a photo only when you set a contact’s picture, and read nothing else from your device.

If you use the in-app feedback form, your message is transmitted to our self-hosted feedback service together with your account email address, your browser's user-agent, and the page you were on — so we can respond and reproduce problems (legal basis: Art. 6(1)(f) GDPR). It runs on our own servers; no third party receives your feedback. Nothing is sent unless you submit the form.

We send you emails required to operate your account (e.g. verification codes). We do not send marketing email.

You can grant external applications — including AI assistants — access to your Skybox account via API keys or OAuth. Such apps act on your instructions and under their own privacy policies; you can revoke their access in the app at any time.

Skybox runs on servers operated for us by Digital Services Stephan (DSS-Net), Germany (dss-net.de), acting as our processor under Art. 28 GDPR. The servers are located in Germany.

Besides our host, these are the only recipients of personal data:

• PostHog, Inc. — product analytics and error tracking for the app, on PostHog Cloud EU (data stored in Frankfurt, Germany), as our processor under Art. 28 GDPR.
• Google (Google Ireland Limited / Google LLC) — delivery of push notifications to mobile devices via Firebase Cloud Messaging, as our processor under the Firebase data processing terms.
• Apple Inc. — delivery of the same notifications to iPhones via the Apple Push Notification service.

Where any of these processes data outside the EU/EEA (typically in the United States), the transfer rests on the EU–US Data Privacy Framework or on standard contractual clauses under Art. 46 GDPR.

When you connect a Google, Microsoft, or GitHub account, or sign in through them, those providers process your data as independent controllers under their own privacy policies, on the same transfer basis. These connections happen only at your initiative.

This website sets no cookies of any kind and stores nothing on your device — which is why you won’t find a cookie banner here.

The app uses first-party cookies that are necessary to operate it: a session cookie to keep you signed in (up to 7 days), short-lived cookies during OAuth sign-in flows, and a cookie remembering which sign-in method you last used. It also keeps the local cache described under “Your email content” in your browser, so the app opens quickly.

Everything stored on your device is therefore either necessary to run the app or is your own data, kept locally for your benefit. Analytics stores nothing at all — see the section above. We set no advertising cookies and no third-party tracking cookies anywhere, which is why the app has no cookie banner either.

Account and connection data is kept for as long as your account exists. You can delete individual connected accounts at any time — their credentials are removed immediately — or delete your entire Skybox account in the app, which removes all data we hold about you. You can also request deletion by emailing hello@skyboxmail.de. Server access logs are deleted after 14 days at the latest. Push registrations are deleted as described under “Push notifications”. Analytics and error records are pseudonymous and are deleted on request; they are not linked to your mailbox data.

You can export your data (Art. 20 GDPR) from within the app. Note that the export includes the decrypted credentials of your connected accounts so you can move to another client — treat the file accordingly.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21).

To exercise any of these rights, email hello@skyboxmail.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Mainz, Germany.

We will update this policy when the service changes and note the date of the latest revision at the top of this page.