Privacy Policy

Last updated: October 4, 2026.

This policy describes how AgentAddress handles information when you use our website, API, HTTPS inboxes, inbound and outbound email, and saved task context.

Information we collect

We store address records, optional task identifiers, received HTTP event data and email content, message metadata, acknowledgement records, small JSON task context, contact verification records, and pending outbound messages. Verification codes are stored as hashes. Email attachments are represented by provider metadata. When an authorized owner downloads an attachment, we fetch its bytes from Resend and return them without storing the file. Access credentials are stored as hashes.

We also process technical information, such as IP addresses, request information, and usage counts, to operate the service, enforce limits, and prevent abuse. Creating an address does not require an account.

How we use and share information

We use information to receive and deliver events, maintain the service, troubleshoot problems, and protect against misuse. Service providers process information on our behalf, including Render for hosting, MongoDB for storage, and Resend for receiving email, sending authorized messages, and contact verification. Information may be processed in countries other than your own.

We do not sell your personal information. We may disclose information when required by law or when necessary to protect the service, its users, or others.

Website analytics and cookies

Public website pages use Google Analytics to understand visits and navigation. Google Analytics may use cookies and collect browser, device, and usage information. We do not intentionally send message content, read tokens, ingress URLs, or recipients as analytics events. Browser analytics are separate from API and MCP activity.

You can restrict cookies in your browser or use the Google Analytics opt-out browser add-on. See Google's Privacy Policy for its data practices.

Retention and deletion

Events are retained for 30 days. Reading or acknowledging an event does not delete it. Addresses have no expiry by default, but you can set an expiry when creating one or delete an address and its events through the authenticated API. Saved JSON context and verified contacts remain until replaced or deleted, or until the address expires or is deleted. Outbound idempotency records are retained for at least 24 hours, while feed events retain their normal 30-day window. Recovery receipts expire after 30 days. Aggregate operational usage counts can remain after deletion or expiry.

Infrastructure logs and provider-held copies may follow separate retention schedules. Do not use AgentAddress as your only archive.

Security and your choices

Protect your read token and secret-bearing inbox URL. Anyone with a read token can access and delete the associated address data. Lost credentials cannot be recovered. We use access controls and hashed credentials, but no service can guarantee absolute security.

Only submit information you are authorized to share. Depending on your location, you may have rights to access, correct, or delete personal information. For privacy questions or requests, contact the maintainer through the maintainer's GitHub profile. Do not post credentials or private message content in public issues.

Changes

We may update this policy by publishing a revised version here with an updated date.