Legal
Privacy policy
What we store, why, how long we keep it, and who else can touch it. Written to be read rather than survived.
1. The short version
We host your email so that you can read it. We do not read it, train on it, sell it, or scan it to sell advertising. There is no version of this product where your correspondence is the thing being monetised — not a promise about our character, but the consequence of a business model where you pay us for hosting or you cost us very little.
The rest of this document is the detail, and the parts that are awkward are in the same size type as the parts that are not. §5 says what outlives a delete, §7 says what we can technically see, and §6 names every company involved rather than calling them industry-standard providers, and §8 is the one section you can act on rather than only read.
2. Who is responsible for what
The controller for the purposes of the GDPR is:
PCN Labs OÜ, registry code 17037148, Tornimäe tn 5, 10145 Tallinn, Estonia.
Full details, and the supervisory authorities, are in the legal notice. We have not appointed a data protection officer, because at our size the GDPR does not require one; requests go to privacy@pidgeon.ai and reach a person.
Two different roles, and the split matters.
- For your account and how you use the service — your address, your domains, your billing, the operational records in §3 — we are the controller. This policy is how we explain that processing.
- For the content of the mail in your account we are a processor acting on your instructions. We store it, index it so you can search it, classify spam, and hand it to your own code where you have told us to, and we do nothing else with it. If you are a business and the mail contains other people’s personal data, our data processing agreement is the Article 28 contract that governs it.
If you wrote to somebody who happens to host their mail here, we are processing your message on their behalf. Ask them, not us — we cannot identify their correspondence to you without reading it, which is the thing we are telling you we do not do.
3. What we store
Account. The email address you sign in with, your name if you give one, the workspace you belong to, the members you invite, and your sign-in history.
What you configure. The domains you add and the DNS records we check on them, the addresses you create and their type, routing rules, webhook endpoints, API keys and app passwords. Keys and passwords are stored hashed; the value itself is shown to you once and never again.
Mail. The messages sent to and from your addresses, with headers, bodies and attachments, because that is the service. Also a raw copy of each received message — the original bytes — for a short window, so that a parsing bug can be diagnosed and the message re-read correctly.
Operational records. An immutable event log of everything consequential: API calls, webhook deliveries and their response codes, sign-ins, hand-offs, domain verifications, deliveries and bounces. Provider notifications from our mail provider. Spam verdicts and trust scores. Rate-limit counters. Error reports when something in the product breaks.
Anti-abuse fingerprints. Sender addresses, recipient addresses and message fingerprints are kept as keyed hashes rather than as themselves, so the abuse model can recognise a pattern without our holding a readable list of who wrote to whom.
Billing, if you are on a paid plan: a customer record at Stripe, the subscription, and the invoices. Card numbers go to Stripe and never reach us.
Analytics and diagnostics. Whether sign-up completed, whether a domain verified — measured server-side, against an opaque identifier. Never what you do inside your mail.
4. Why, and on what legal basis
| What we do | Legal basis |
|---|---|
| Run the service: receive, store, show, search, send your mail | Article 6(1)(b) — performance of the contract |
| Sign you in and keep your session | Article 6(1)(b) |
| Verify domains, and check your DNS | Article 6(1)(b) |
| Call your webhooks and serve your API requests | Article 6(1)(b) |
| Send transactional mail — sign-in links, invitations, alerts | Article 6(1)(b) |
| Take payment and keep invoices | Article 6(1)(b), and 6(1)(c) for the accounting records tax law requires |
| Classify spam, score trust, enforce limits, investigate abuse | Article 6(1)(f) — keeping the service deliverable and usable for everyone |
| Secure the service, and report errors so they can be fixed | Article 6(1)(f) |
| Measure whether the product works | Article 6(1)(f) — see §9 |
| Answer a lawful request from an authority | Article 6(1)(c) |
| Establish, exercise or defend a legal claim | Article 6(1)(f) |
Where we rely on legitimate interests you can object under Article 21, and §11 says how. Nothing in this table relies on consent, which is deliberate: a service you cannot use unless you agree to be measured has not obtained consent, it has obtained a signature.
5. How long we keep it
Messages and attachments stay until you delete them. Everything else expires on a schedule, and the schedule is enforced by the same jobs and database rules the product runs on rather than by intention:
| Data | Kept for |
|---|---|
| Messages and attachments | Until you delete them |
| Raw originals of received mail | 30 days |
| Raw originals we could not parse cleanly | 1 year, under separate quarantine |
| The event log | 90 days |
| Notifications from our mail provider | 30 days |
| Product analytics | 30 days |
| Deletion records — that a message was deleted, and nothing about it | 30 days |
| Idempotency keys | 24 hours |
| Billing and invoices | As long as Estonian accounting and tax law requires |
Deleting a message erases its raw original too. A deletion record holds three things — the message’s id, the mailbox it was in, and when it went — so that a mail client which has been offline can be told a message is gone, rather than left to notice one stopped appearing. Nothing else: not the subject, not the sender, not the size.
Backups outlive all of those windows. Deleting a message removes it from the product immediately; an encrypted backup taken before the deletion still contains it until that backup rotates out. This is true of every hosted service, and anyone telling you otherwise is describing an architecture that does not exist. We do not restore a backup to recover deleted data on request, and a restore for disaster recovery re-applies deletions.
Deleting your account removes your domains, addresses, messages and operational records, subject to that backup window and to records we are required to keep for tax or legal reasons.
6. Who else touches it
Eight companies, each for one job, each named — with what it does, where it runs, and what it is prevented from seeing — on the subprocessor list. That page is the answer to this question and is kept current, with at least 30 days’ notice before anything is added to it.
Your mail is held in the European Union. Two transfers leave the EEA and both are named on that page: the United Kingdom, which has an adequacy decision, and the United States, covered by Standard Contractual Clauses.
Beyond those, we disclose data to nobody. Not to advertisers, not to data brokers, and not to a model trainer. If we are ever compelled by a valid legal order we will tell you, unless telling you is itself unlawful.
7. Encryption, and what we cannot promise
Mail is encrypted in transit and at rest. Mail between us and other providers uses TLS wherever the other side supports it, and we publish MTA-STS so that a sending server knows to require it.
It is not end-to-end encrypted, and this is a design decision rather than an omission. An API that hands your mail to your own code as plaintext, a spam classifier that reads a message to judge it, and a server-side search index that finds a word in a body all require that we can read the message. A product cannot offer those and also claim it is mathematically unable to see your mail.
So: assume we technically can, and hold us to not doing so. What stands behind that is the business model, the access controls, the audit log, and the fact that this reasoning is published rather than hidden. Anybody selling you end-to-end encrypted email with a full search index and a plaintext API is selling you one of those things.
8. Cookies
Two, and neither of them asks you anything, because neither of them is about you.
| Cookie | What it is for | Asks first | How long |
|---|---|---|---|
| Supabase authentication | Keeps you signed in, and rotates a short-lived token | No | The session |
sidebar_state | Remembers that you collapsed the sidebar | No | 7 days |
Both are strictly necessary and neither is shared with anyone: you cannot stay signed in without a session, and a preference you set is a preference. There is no advertising cookie, no third-party cookie, and nothing that follows you to another site.
There was a third, and a banner asking about it. pidgeon_aid was an
opaque random id that let us see a landing-page visit become a sign-up, and
because it persisted across visits and was linked to an account if you made
one, we asked before setting it rather than claiming an exemption we would
have had to argue for. On 14 October 2026 we moved site analytics to a
provider that measures the same thing without any cookie at all, so the id,
the record of your answer, and the banner that asked the question were all
deleted — along with the column in our own database that stored the id.
Nothing replaced them. There is now no question for a banner to ask, which is a better outcome than asking it well.
9. Analytics, with the recording turned off
We measure whether the product works — did sign-up complete, did the domain verify — not what you do inside it.
- Session recording is not installed. On this product the screen is other people’s correspondence, so a replay tool would be exfiltration with a dashboard. It is not a masking problem, because the content is the thing that would be masked.
- Autocapture is off. Nothing records which buttons you press.
- Site analytics are cookieless. We use Plausible, which counts visits without a cookie, without a cross-visit identifier and without personal data, on EU infrastructure. Nothing it collects identifies you, which is why there is nothing to ask permission for.
- Our own product measurements are server-side, carry no visitor identifier at all, and record whether a step completed rather than who completed it.
- The mail client is excluded entirely.
- Error reports are stripped before they are sent: no cookies, no headers, sign-in tokens and secrets redacted out of URLs, your email address removed, and message content never included.
10. Signing in with Google or GitHub
Not yet available. When it is, this section will apply and its date at the top of this page will change.
If you choose to sign in with Google or GitHub, we will receive from them the email address on that account, its verification status, the account’s display name and avatar if it has one, and a stable identifier linking your Pidgeon account to theirs. We will ask for nothing more — no contacts, no calendar, no repositories, no ability to read or send mail from that account — and the permission screen is where you can check that rather than take our word for it.
We use what we receive to create and identify your account, on the basis of Article 6(1)(b). We will not post anything, and we will not import anything. Disconnecting the provider from your account settings leaves the account and your mail in place; a sign-in link to your address is always available as an alternative, so choosing a provider never becomes the only way in.
Google and GitHub are controllers of their own processing when you use them to sign in, and their own policies govern that.
11. What you can ask for
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it over in a portable form, or stop processing it where we rely on legitimate interests.
Write to privacy@pidgeon.ai. We answer within one month, and if a request is genuinely complex we will tell you inside that month rather than at the end of it. We will not charge you and we will not make you justify yourself.
You do not have to wait for us to export your mail. IMAP and SMTP are available on every plan including the free one, so any mail client can take a full copy with it, and there is a download in the application that streams the whole mailbox as a file. A product people stay with because leaving is painful is a product that has stopped having to be good.
If you think we have got something wrong, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority where you live. We would rather you told us first, but it is your right and not conditional on that.
12. Automated processing
Two automated systems make judgements about mail, and neither makes a decision with a legal or similarly significant effect on anyone within the meaning of Article 22.
- The spam classifier decides whether an incoming message goes to your inbox or your spam folder. You can see every message either way, move it, and train the outcome with a sender rule.
- Trust scoring sets how much a new account may send per day, below its plan’s allowance, and raises it as mail is accepted and not complained about. It affects sending volume, not access to your mail.
A person will review either one if you ask. Write to abuse@pidgeon.ai for a sending limit and hello@pidgeon.ai for anything else.
13. Children
Pidgeon is not for children. You need to be 18 to hold an account, which the terms say too. We do not knowingly collect personal data from a child, and if we learn that an account belongs to one we will close it and delete the data.
Mail addressed to an adult’s inbox may of course mention a child, as anybody’s correspondence might. That is the account holder’s content and we treat it as we treat everything else in a mailbox.
14. Security
What protects this data is described, in more detail than a policy usually carries, in the security section of our home page and in the security document published with the source. In short: no passwords to phish or leak, authorisation enforced as a database join rather than as a check somebody could forget, an immutable audit log, secrets that are write-only in the deployment, and encryption in transit and at rest.
Report anything you find to security@pidgeon.ai. We will not threaten you for it.
If a breach affects your personal data and is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and tell you directly where the GDPR requires it — and we will say what happened rather than that “an incident occurred”.
15. Changes
When this policy changes, the version date at the top changes with it. For a change that materially affects you we will email you before it takes effect, not after.
We keep this document in the same repository as the product, so a change to it arrives in the same review as the change that caused it. A privacy policy describing how the software used to behave is worse than no policy at all, because somebody will believe it.