Privacy Notice

This notice applies to the mailbox service at myaddress.cc. MyAddress ID publishes a separate notice for sign-in and connected applications.

1. Controller and contact

The controller is Kequtech Innovations Kft., Paulay Ede utca 56, 4th floor, door 1, 1061 Budapest, Hungary. Privacy, account-closure and support requests may be sent to [email protected].

2. Information MyAddress processes

MyAddress processes:

• the account identifier supplied by MyAddress ID and local session records;
• generated addresses, labels, status, display preferences, notification choices and storage totals;
• message headers, sender and recipient addresses, subject, plain text, original HTML, attachments and delivery identifiers;
• read, important, trash, search and mailbox activity state;
• technical information needed for delivery and security, including request time, IP address, webhook metadata, errors and abuse signals; and
• legacy GetInbox information where an existing user previously completed the supported migration.

Mail content can contain personal or sensitive information about senders, recipients and other people. MyAddress receives that information from the account holder, another MyAddress user, an external sender or the sender's mail provider; those people may not have contacted Kequtech directly.

3. Purposes and legal bases

Account and mailbox information is processed to provide the requested mailbox, receive and display mail, send permitted messages, search and organise content, enforce storage limits and support deletion. The primary legal basis is performance of the service contract created by use of MyAddress.

Delivery metadata, rate controls and limited security information are also processed for Kequtech's legitimate interests in preventing abuse, deduplicating provider retries, diagnosing failures and protecting users and infrastructure. Information is processed where necessary to comply with law or establish, exercise or defend legal claims.

Providing a MyAddress ID account identifier is necessary to use the mailbox. Labels and ordinary preferences are optional. Incoming message content is determined by the people who send mail to an active address.

4. Sharing and providers

• MyAddress ID authenticates the account. Mail normally receives only its account UUID. When notifications are enabled, Mail can obtain the current active private email solely to deliver that notification and does not store it as a Mail profile.
• Railway hosts the application, PostgreSQL database and private attachment storage.
• Cloudflare provides DNS, reverse proxying and Email Routing that passes inbound raw mail to MyAddress.
• SMTP2GO delivers enabled mailbox notifications and the limited external replies permitted by the service.

Internal messages between MyAddress users are written directly to the Mail database and are not sent through SMTP2GO. MyAddress does not use mail contents for advertising, analytics or AI processing and does not sell personal information.

Some providers process information outside Hungary or the European Economic Area. Where required, Kequtech relies on an adequacy decision, the European Commission's standard contractual clauses or another lawful safeguard. Details are available on request.

5. Retention, trash and account closure

Active mailbox content is retained until the account holder deletes it, closes the account or the service must remove it for security or legal reasons. Deleted messages and addresses remain recoverable in Trash until the account holder chooses Delete forever or Empty trash.

Every account currently has a 100 MiB storage limit. When an account exceeds it, the daily retention process first permanently empties existing Trash, then moves enough unimportant and oldest messages to Trash to cover the excess. Those staged messages have a one-day recovery period before the next daily run can permanently remove them.

A user may close the account through support. Kequtech then deletes the active Mail account and its content, subject to short-lived recovery copies and information that must be retained for a legal obligation or claim. Provider backups expire on their ordinary backup cycles. Security records are retained only as long as reasonably necessary, ordinarily no longer than 12 months unless an incident or legal claim requires longer retention.

6. Cookies and local storage

MyAddress uses a strictly necessary host-only session cookie that expires after 30 days and short-lived OIDC cookies during sign-in. The selected visual theme is stored locally in the browser. There are no advertising or analytics cookies.

7. Security and remote content

Attachments are private and served through authenticated application access. Message HTML is sanitised for display, and remote images and CSS network loads are blocked by default. No online service can guarantee absolute confidentiality or availability; users should not treat an ordinary email mailbox as encrypted end-to-end storage.

8. Your rights

Subject to the GDPR and its limitations, you may request access, correction, deletion, restriction or portability and may object to processing based on legitimate interests. Requests can be made at [email protected]. You may complain to the Hungarian National Authority for Data Protection and Freedom of Information at naih.hu or to the supervisory authority where you live or work.

9. Age and changes

MyAddress is intended only for people aged 18 or over. Kequtech may update this notice as the service, providers or legal requirements change. The current version and date remain published here.