1. What we collect
- Account — your email address, your Telegram username (we use it to reach you about your account, payments and support; we do not check that it is yours), a password hash (never the password), the time you confirmed your email and your last sign-in.
- Billing — your balance and a ledger of every charge, refund and top-up. Crypto payments are processed by the payment provider; we store the payment reference and amount, not your wallet keys.
- Usage — the tasks you create (service, assigned address, timestamps, outcome), the IP address and user agent of your sessions and API calls, and API key metadata (label, prefix, last use). Raw API keys are stored only as a hash.
2. Received messages
The inboxes belong to MailOtp. While a task is open we read new messages in that inbox to find the one matching your chosen service. We store the matched message's sender, subject, extracted code or link and the plain-text body so we can show it to you in the panel and the API. Messages that do not match any task are not shown to customers.
3. Retention
- Message bodies: 7 days after delivery, then deleted. The code, sender and subject stay with the task record.
- Task records: 180 days, then deleted.
- Ledger entries: kept for the life of the account for accounting.
- Sessions: until you sign out or they expire; expired sessions are purged.
- Account: deleted on request (see section 7), after which the data above is removed within 30 days except what we must keep for accounting.
4. Cookies
Our own cookies are first-party and functional: mo_session (your sign-in), mo_theme (light or dark) and a short-lived mo_flash for one-time notices.
Our public pages — the home page, the service catalogue, the API documentation and these legal pages — can also load Google Analytics 4, which sets its own _ga cookies to count visits and see which pages people find useful. Analytics runs only if you accept it. Until you press Accept on the cookie banner nothing is requested from Google and no _ga cookie is created; if you press Reject, none ever is. Your answer is kept in a first-party cookie called mo_consent for 180 days so we stop asking — that one cookie is the record of your choice and is set either way. You can change your mind at any time with the Cookies link in the footer; withdrawing consent deletes the _ga cookies again. Analytics is never loaded inside your dashboard or on the confirmation and password-reset links, so the pages that carry your task, account or token details are never reported to Google — with or without consent. We do not run advertising or remarketing tags.
5. Sharing
We share data only with the providers we need to run the service: our hosting provider (servers and storage), the mailbox providers whose inboxes we operate, the payment provider for top-ups, and — only where you have accepted it — Google Analytics for the public-page statistics described in section 4. We do not sell data. We disclose data to authorities only when legally required.
6. Security
Traffic is encrypted with TLS. Passwords are hashed with Argon2id. Session tokens are stored as SHA-256 hashes. API keys are checked against a SHA-256 hash; an AES-256-GCM encrypted copy is also kept so you can reveal a key again in your panel. Mailbox credentials are encrypted at rest. Services run under a restricted system user with outbound network limits.
7. Your rights
You can view your data in the panel at any time, change your password, revoke API keys and sign out other sessions from Settings. To export or delete your account, contact us; we verify the request from the account's email address before acting on it.