Privacy

Decoy forwards mail sent to your aliases to your real inbox, and sends your replies back out from the alias. It is built to keep as little as possible.

What we keep

• Your account id from sign-in, your plan, and your aliases with the labels, notes and websites you give them.
• Your real email addresses and the addresses of people who write to you, encrypted with keys held in AWS KMS and looked up only by keyed hash.
• Thirty days of activity per alias: when mail arrived, the sender's domain, and what we did with it. Subject lines only if you turn that on.

What we don't keep

• Message bodies. Each message is deleted as soon as it is forwarded, and after two days at most if forwarding fails.
• Anything for advertising. We don't sell or share data, and the app has no ad or analytics trackers.

Deleting

Deleting your account in the app removes your mailboxes, the addresses of people who wrote to you, your API keys and your profile. Alias addresses are retired, never reissued to anyone else.

Where it runs

On Amazon Web Services in the United States. Subscriptions are handled by Apple; we receive only whether your subscription is active.

Questions: use Help in the Decoy app.