Privacy Policy

Courier — a service of Nuvidian · Last updated 29 July 2026

Courier creates email addresses on demand, receives mail sent to them, and extracts verification codes and links from that mail so you can complete a sign-up without a personal inbox. Reading other people's email is the entire function of this product, so this page states plainly what we receive, what we do with it, how long we keep it, and who can see it.

What we receive

• The full content of email sent to an address you create — headers, sender and recipient addresses, subject, body, and attachments. We do not choose what arrives; whoever you give the address to decides that.
• Data extracted from that mail — verification codes, links, a message classification, and a thread identifier. This is the product's purpose.
• Account and usage records — the inboxes you create, API tokens issued, credit balance and transactions, and an audit log of requests made against your inboxes.
• Ordinary server logs — IP address, timestamp, and request path, kept for security and abuse handling.

What we do with it

• Deliver messages to the inbox they were addressed to, and return them to you through the API.
• Parse message content to extract codes and links — automated, and the reason the service exists.
• Meter usage against credits, and keep an audit trail of access to each inbox.
• Detect and stop abuse of the service, including spam and unauthorised access.

Who can see your mail

Access is scoped to tokens. Creating an inbox mints a token limited to that inbox; a token for one inbox cannot read another. Our own staff access is limited to the security and abuse cases described above. Mail is transmitted over the public internet before it reaches us, which is not a channel anyone can guarantee — do not route highly sensitive material through Courier.

Service providers

We rely on a small number of third parties, and only for what each is named for:

• Hetzner — server hosting (Germany/US).
• Resend and Amazon Web Services (SES) — sending outbound mail.
• LNBits — Lightning payment handling for credits.

Each receives only the data needed to perform that function.

How long we keep it

• Messages and extracted data — retained while the inbox exists. Delete an inbox and its messages are removed with it.
• Audit and transaction records — kept up to 24 months, because they are how we answer "who accessed this inbox and when".
• Server logs — up to 90 days.

Backups may hold copies for a short period after deletion before they age out.

Your choices

• Delete any inbox and its stored mail at any time, through the API or by asking us.
• Request a copy of the data we hold about you, or ask us to correct it.
• Ask us to delete your account entirely.
• Opt out of email from us by replying unsubscribe to any message we send, or by writing to the address below. Operational notices about your own account may continue while the account is open.

Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA, including the right to object to processing or to complain to a regulator. Write to us and we will honour them.

Security

Traffic to the site and API is encrypted in transit (HTTPS). Access is authenticated and inbox-scoped, and requests against inboxes are logged. No system is immune; if we discover a breach affecting your data we will notify affected users and any regulator we are required to inform.

Children

Courier is a tool for developers and businesses and is not directed at children under 13. We do not knowingly collect their information.

Changes

If we change this policy we will update the date at the top of this page. Material changes will be announced to account holders.

Contact

Questions, requests, or complaints about privacy:
privacy@getcourier.dev
Nuvidian,