WinkMail Privacy Policy

1. Information we process

We process usernames, OAuth sign-in information, avatars, mailbox addresses, email content and metadata, webhook addresses, API keys and necessary security logs.

2. Why we use it

We use this information for authentication, mailbox features, webhook delivery, security, abuse prevention and service maintenance. We do not sell email content to advertisers.

3. Retention and deletion

Temporary mailboxes and messages are deleted after expiry, deletion or cleanup and are usually not recoverable. Account data is retained while the account exists or as legally required.

4. Sharing

Webhooks send corresponding email data to the third-party endpoint you configure, and sharing links show content to their holders. Assess third-party privacy practices before using them.

5. Your choices and security

You can manage mailboxes, sharing links, webhooks and API keys, and delete your account. Do not send sensitive personal data through temporary mailboxes.

6. Policy updates

We may update this policy by publishing it here. Continued use means acceptance of the updated policy.

7. Google data and contact

WinkMail is operated by luri in Singapore; privacy requests may be sent to luri@luri.cc.cd. Google sign-in is optional and only provides the basic profile data needed for authentication: account identifier, name, email address and avatar. We do not access Gmail, Drive, contacts, calendars or other Google data, and do not sell or use Google user data for advertising. Cloudflare provides hosting, database and security services; GitHub provides optional sign-in; Resend delivers outgoing mail when enabled. Webhooks and sharing links disclose the selected email content to destinations or link holders chosen by you. We use session cookies/JWTs, IP addresses and security logs for authentication and abuse prevention. You may request access, correction or deletion of account data by email.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Google user data is used only to provide and improve user-facing authentication and account-management features. We do not use or transfer it for targeted, personalized, retargeting, interest-based or user advertising; selling to advertisers, data brokers, information resellers or any third party; creditworthiness or lending decisions; or creating databases unrelated to WinkMail. We do not use Google user data or Google Workspace APIs to develop, improve or train generalized, non-personalized AI or machine-learning models. Google profile data is not included in emails, webhooks, sharing links or Resend deliveries. We protect it in transit with HTTPS/TLS and limit access through authentication, role-based authorization and security monitoring. We retain it only while needed to operate the account or meet legal and security obligations, and delete or anonymize it after account deletion or expiry of the applicable retention period.