Inbox.Cheap
INBOX.CHEAP POLICIES

Privacy Policy

Effective date: November 1, 2026

Inbox.Cheap is operated by Huahao Technology Co., Ltd. (English translation of the registered Chinese name: 华昊科技有限公司). Unified Social Credit Code: 91370830MA3THGN44R.

Business address: Huaru Industrial Park, Zhongdu Subdistrict, Wenshang County, Jining City, Shandong Province, China.
Contact: [email protected].

This policy explains how Inbox.Cheap handles account information, Google sign-in data, and the messages received by your Inbox.Cheap addresses. It applies to inboxcheap.com, our API at api.inbox.cheap, and our shared inbox pages on inbox.cheap.

1. Information we collect

Account information: your sign-in email address, internal account ID, creation date, password hash where a password is used, verification-code records, account preferences, plan, and subscription status. Google-created accounts initially receive a randomly generated, unknown local password; you can use password recovery to set a password.

Service information: the receiving addresses you create, their lifecycle records, message counts, API-key hashes and identifying prefixes, and read-only sharing tokens. We store incoming email headers, sender and recipient information, subjects, timestamps, and original message content, which can include attachments and personal information provided by senders.

Technical information: IP addresses, request and security logs, session cookies, and information needed to prevent abuse. Some rate-limiting records use hashed IP addresses. We receive transaction and subscription references and status from Paddle when billing is used; our application does not collect full payment-card details.

2. Sign in with Google: access, use, and storage

Google sign-in is optional. If you choose Continue with Google, we request only openid and email. We receive your Google account’s stable identifier (sub), email address, and email-verification status. Where Google supplies a Google Workspace domain claim, we use it to assess whether an existing account can be safely linked. We also process token issuer, audience, expiry, and other security claims to validate the sign-in response.

We use this information to authenticate you, create a Free account if you are new, associate your Google identity with your Inbox.Cheap account, prevent duplicate accounts, and maintain secure access. Google sign-in can use non-Gmail email addresses. Ordinary email-and-password registration is currently limited to verified Gmail addresses.

We persist the Google stable identifier and its association with your internal account ID, and store the email address as your account email. Other identity and security claims are processed during authentication rather than saved as profile fields. Access and ID tokens are used transiently on our server to finish and validate sign-in; we do not persist them in the application database. We do not request offline access or store Google refresh tokens.

We do not request access to your Gmail inbox, Gmail messages, contacts, Google Drive files, calendar, or permission to send email through your Google account. Messages delivered to your Inbox.Cheap receiving addresses are a separate service and are not imported from your Google inbox. We do not request your Google profile name or picture for a user-profile feature.

Personal email forwarding

You may optionally connect an external personal mailbox by verifying its address and setting up forwarding in your email provider. We store the verified source address, dedicated receiving address, verification timestamps, and forwarded email copies under the same email-content retention and access controls as other received mail. Pending ownership-verification codes are hashed, expire after 10 minutes, and have a limited number of attempts. We do not request your source mailbox password, app password, IMAP credentials, or additional Google OAuth permissions. Only messages actually forwarded to the receiving address are processed; this is not historical-mail import or two-way mailbox synchronization.

Forwarded copies are available to your authorized API keys and configured notification destinations. You can issue a dedicated key restricted to one connected inbox; ordinary account keys retain their configured access. Personal forwarding inboxes cannot create public sharing links. Keep the forwarding address private and consider forwarding only selected messages. Disconnecting retires the destination and revokes its dedicated keys; remove forwarding in your provider too. Disconnecting does not delete already received copies or recall notifications that were delivered. Delete copies separately or contact support for a data-deletion request.

3. Why we use information

We use information to provide account access, receive and display mail, operate API access and user-directed sharing, enforce plan limits, manage billing, deliver verification and recovery messages, provide requested support, investigate abuse, and meet legal obligations. Depending on applicable law, the grounds for processing include performing our service agreement, legitimate operational and security interests, legal obligations, and consent where required.

4. Disclosure, providers, and Google data limits

We do not sell personal information or Google user data. We do not use Google user data for advertising, advertising profiles, or training generalized artificial intelligence or machine-learning models. Google sign-in information is used for the account and security purposes described above, not to read or analyze your Google mailbox.

Inbox.Cheap’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data for unrelated purposes. Access is limited to what is necessary to operate the user-facing service, provide support with your authorization, investigate security or abuse, or comply with applicable law.

We use providers as needed for their functions:

Relevant data may be disclosed to these providers for the functions above, to recipients you choose through shared links, or when legally required or necessary to address security incidents and protect legal rights. Our staff do not routinely read Google sign-in information for unrelated purposes. Provider processing is also described in their notices: Google, Cloudflare, Resend, and Paddle.

5. Shared inboxes, Webhooks, and email content

If you configure a receiving Webhook, we send new-message metadata (message and inbox identifiers, receiving address, sender, subject, and timestamps) to the HTTPS endpoint you choose. The subject itself may contain personal information or verification codes. Bodies and attachments are not included in these notifications. If you select Telegram, WeCom, Feishu / Lark, DingTalk, or WhatsApp Business, we send the notification metadata to that service using your configured bot or Business API. Those services process it under their own policies. Choose only destinations and recipients you are authorized to use. Subjects may contain sensitive information, including verification codes. Platform bot URLs, tokens, recipient configuration, and signing secrets are encrypted in our database. Custom endpoint URLs, queued notifications, delivery status and attempt counts are stored to operate and troubleshoot delivery. Completed, canceled, and failed delivery records are removed after 30 days. Disable an endpoint in the console to stop queued deliveries; a request already in flight may finish.

Verification-code extraction runs on our server against the decoded subject and text. It uses heuristic rules and does not send email content to an external AI service. Extracted candidates are returned to your authenticated session or an API key with the relevant permission; they are not stored as a separate code database. Onboarding stores first-received-message and first-successful-API timestamps, plus whether you dismissed the guide.

A shared inbox link is an access credential. Anyone holding it can read the latest 10 messages without signing in. You decide whether to create and distribute it, and can reset the link to revoke the old link. Retiring a mailbox disables shared access. Account sign-in details and Google authentication tokens are not included in shared inbox responses.

Email HTML is displayed in an isolated viewer with scripting restricted. Remote images and linked resources can contact third-party servers and may reveal connection information or that content was loaded. Follow links and disclose shared access only when appropriate.

6. Retention and deletion

We keep account email, Google identity association, and account records while they are needed to provide your account. Received messages remain until you delete them or they are removed as part of an account-deletion request or necessary service administration. Retiring a mailbox stops future mail; it does not itself delete earlier messages.

You can delete individual messages in the inbox. To request account deletion, deletion of Google sign-in data, or removal of a Google identity association, follow the contact instructions below. We verify the request before removing account information and associated received-email data that is no longer required. We retain the minimum address tombstones necessary to ensure that a retired email address is never reassigned.

Security and abuse records, transaction and legally required records, and separately maintained backups may need to be retained for their necessary operational or legal period. Retention depends on the record and purpose; we do not promise immediate erasure from every backup. Records retained under an exception are restricted to that purpose. We explain relevant limits when handling a deletion request.

7. Your choices, revocation, and requests

You can review account information, update your password, and change your sign-in email in Settings. You can manage API keys, delete messages, retire addresses, and reset sharing links in your console.

Revoke Google access: open your Google Account connections, select Inbox.Cheap, and remove its connection. This revokes Google authorization; it does not automatically delete your Inbox.Cheap account, previously stored identity association, or received mail. A later Google sign-in may require authorization again. Before relying on a different sign-in method, set a password through account recovery if necessary.

Request deletion or disconnection: email [email protected] from your account email with the subject “Delete my account,” “Delete Google sign-in data,” or “Disconnect Google.” Identify the account and what you want removed. Do not send your password, verification codes, API keys, or Google tokens. If you cannot access that email, contact us for an alternative verification process. We respond within time limits required by applicable law.

Disconnecting a sign-in method can affect account access. Deleting an account or revoking Google access is separate from canceling a paid subscription: manage automatic renewal through Billing & subscription, Paddle’s portal, or support.

Depending on your jurisdiction, you may request access, correction, deletion, portability, restriction of processing, or object to certain processing; you may withdraw consent where consent is the basis. You may also complain to a competent data-protection authority. These requests are subject to applicable law, identity verification, and necessary retention exceptions.

8. Security, cookies, and international processing

We use HTTPS, password and API-key hashing, session and access controls, and restricted authentication workflows. This is not an end-to-end encrypted mailbox service, and no internet service can guarantee absolute security. Do not use temporary mail as the only recovery method for critical accounts.

Necessary session cookies keep you signed in and protect account actions. External checkout and identity providers may use their own cookies under their policies. Browser cookie controls are available, but blocking necessary cookies can prevent sign-in.

Our operator is based in China. Hosting and service providers may process relevant information in other countries, including countries outside your residence. Where applicable, we use required transfer mechanisms and safeguards. Contact us for information about the processing relevant to your account.

9. Changes to this notice

We update this policy when our practices change and show the effective date above. Material changes will be notified as required. If we propose a new use of Google user data, we will disclose it and obtain any required consent before that new use begins.

10. Contact

For privacy questions, data requests, or complaints, contact Huahao Technology Co., Ltd. at [email protected], or use the business address shown above.