Privacy Policy

Thamer (Kuwait) operates SarabMail. Privacy questions go to support@sarabmail.com.

Paddle.com is the Merchant of Record for paid orders and is an independent controller of the payment data it collects at checkout. SarabMail does not receive full card numbers.

Guest inboxes: a random session cookie, the address, and the messages that arrive, including headers, body, and attachments, until the inbox expires.

API keys: a name you choose, a prefix, and a hash of the secret. The full key is shown once. We also store the plan, usage counters, webhook URL if you set one, and the inboxes the key created.

Messages exist so you can read them. We do not sell message contents, and we do not use them to advertise.

Rate limits store a coarse network bucket and a counter. Server logs may include the request path and IP address for a short time so we can operate and secure the service.

If you pay, we store the Paddle customer id, subscription id, price id, plan, status, and period end that Paddle sends to our webhook. Paddle stores the billing details it needs to charge you and issue receipts.

A guest or free inbox lasts about an hour unless the plan says otherwise. Plus keeps mail for up to 30 days. Permanent inboxes on Pro, Business, and Enterprise stay until you delete them or the plan ends.

When an inbox is deleted or expires, its messages and attachments are removed. Revoked API keys stay as a hash so an old secret cannot be reused by accident.

The site and API run on Vercel. The database is hosted Postgres (Neon). Inbound mail is received by Cloudflare Email Routing and a Cloudflare Worker, then posted to SarabMail. Attachments may be stored in Vercel Blob or an S3-compatible bucket. Paddle processes payments.

These providers process data only to provide the service. We do not sell personal data.

You can delete a guest inbox from the site, and an API inbox with the API. To ask about other data tied to an API key or a payment, write to support@sarabmail.com from an address we can match to the key prefix or the Paddle receipt. Abuse of someone else's inbox should go to abuse@sarabmail.com.