Privacy notice

Last updated 27 October 2026 11 min read

This says what Mailhubz holds about you, why we hold it, who else ever sees it, and how to have it removed. It is meant to be read, so it is written plainly and it is no longer than it needs to be.

The short version

No advertising, no analytics and no trackers. Nothing about you is sold or shared for marketing.
Everything is on one server in Germany. Mail is stored encrypted and backed up every night.
One cookie, only to keep you signed in, and it lasts until you sign out or the password changes.
A short history of recent sign-ins, with IP addresses, is kept so that one that was not you can be spotted.
You can have the mailbox and everything about you removed at any time.

On this page12 sections

1.What this notice covers
2.What we hold
3.Why we are allowed to hold it
4.Where it is kept
5.Who else sees it
6.Cookies and browser storage
7.The Android app
8.Your rights
9.Children
10.Keeping it safe
11.Changes to this notice
12.Getting in touch

A question about this page?

support@mailhubz.com

1.What this notice covers

It covers the Mailhubz website at mailhubz.com, the webmail you sign in to there, and the Mailhubz app for Android. They are one service and they hold the same information about you.

Mailhubz is email hosting. You get a real mailbox with its own password and its own storage, and your mail is delivered to it and kept there. It is not forwarding to an account somewhere else.

There is no analytics on this service, no advertising, no tracking pixel and no third-party script on any page. The app contains no advertising and no third-party software development kit. Nothing about you is sold, and nothing is shared with anyone for marketing.

2.What we hold

This is everything, including the small things. Most of it exists only because you have a mailbox; a few items exist only if you chose to set them up.

What	Why we have it	How long it is kept
Your email address	It is your account. Everything else hangs off it.	Until the mailbox is closed
Your display name	It is the name that appears on mail you send. You choose it and can change it.	Until you change it or the mailbox is closed
Your password	To let you in and nobody else. The mail server keeps it only as a one-way hash, which cannot be read back. While you are signed in on the web, an encrypted copy travels inside your session cookie (see Cookies), because the mail server needs it on every request.	Until you change it or the mailbox is closed
Your mail	It is the service. Messages you receive, send and keep are stored on the mail server.	Until you delete it
Your recovery address (if you set one)	Somewhere outside the mailbox to send a password reset link. It is only used once you have confirmed it with a code. The address you gave when signing up is kept as an unconfirmed recovery address until you confirm it or remove it in Settings.	Until you remove it or the mailbox is closed
Two-step verification (if you turn it on)	The secret your authenticator app shares with us (stored encrypted), one-way hashes of your backup codes, and the last code that worked, so it cannot be used twice. The website also keeps its own app password for your mailbox, stored encrypted, so it can open your mail once you have passed the code step.	Until you turn it off or the mailbox is closed
App passwords (if you make any)	Separate passwords for mail apps, kept by the mail server as hashes. You name them and can remove them in Settings.	Until you remove them. A password reset removes all of them
Your address book	Addresses you write to are added automatically so they can be suggested next time, along with any you add yourself. At most 1,000.	Until you remove them or the mailbox is closed
Your settings	Your signature, whether pictures in messages are held back, the senders whose pictures you trust, and any note you write on a mailbox to tell several apart.	Until you change them or the mailbox is closed
Your sign-up record (if you signed up yourself)	When the mailbox was created, which versions of these terms and this notice you agreed to, and that you confirmed you are 18 or over.	Until the mailbox is closed
Recent sign-ins and security activity	For each of the last 20 sign-ins: when, the IP address, what the browser says it is, and whether a code was used. Also the last 50 security events, such as a password change, two-step verification being turned on or off, an app password being made, or everyone being signed out. They are there so that you, or we on your behalf, can spot something that was not you.	Only the newest are kept; older ones are overwritten. Removed with the mailbox
Password reset links	Only a one-way hash of the link is stored, never the link itself, so the stored copy cannot be used to reset anything.	Until it is used, or after 45 minutes
Failed sign-in attempts	The IP address and the address being tried are counted, so that password guessing can be slowed down. Repeated failures are passed to the mail server’s firewall, which blocks that IP address for a while.	Fifteen minutes in memory; the firewall’s own block lasts a little longer
A record of administrator actions	Changes made to mailboxes from the administrators’ console (a role, whether it is switched on, deleting or restoring it), and a mailbox being created through sign-up, are logged with the address concerned and who made the change.	The newest 2,000 entries across the whole service
Server access logs, including your IP address	To keep the service running, and to see what happened when it is abused or attacked.	A rotating buffer; old entries are overwritten and nothing is archived
Mail delivery logs	To show where a message went, and why one did not arrive.	A rotating buffer, as above

Your email address
Why we have it
It is your account. Everything else hangs off it.
How long it is kept
Until the mailbox is closed
Your display name
Why we have it
It is the name that appears on mail you send. You choose it and can change it.
How long it is kept
Until you change it or the mailbox is closed
Your password
Why we have it
To let you in and nobody else. The mail server keeps it only as a one-way hash, which cannot be read back. While you are signed in on the web, an encrypted copy travels inside your session cookie (see Cookies), because the mail server needs it on every request.
How long it is kept
Until you change it or the mailbox is closed
Your mail
Why we have it
It is the service. Messages you receive, send and keep are stored on the mail server.
How long it is kept
Until you delete it
Your recovery address (if you set one)
Why we have it
Somewhere outside the mailbox to send a password reset link. It is only used once you have confirmed it with a code. The address you gave when signing up is kept as an unconfirmed recovery address until you confirm it or remove it in Settings.
How long it is kept
Until you remove it or the mailbox is closed
Two-step verification (if you turn it on)
Why we have it
The secret your authenticator app shares with us (stored encrypted), one-way hashes of your backup codes, and the last code that worked, so it cannot be used twice. The website also keeps its own app password for your mailbox, stored encrypted, so it can open your mail once you have passed the code step.
How long it is kept
Until you turn it off or the mailbox is closed
App passwords (if you make any)
Why we have it
Separate passwords for mail apps, kept by the mail server as hashes. You name them and can remove them in Settings.
How long it is kept
Until you remove them. A password reset removes all of them
Your address book
Why we have it
Addresses you write to are added automatically so they can be suggested next time, along with any you add yourself. At most 1,000.
How long it is kept
Until you remove them or the mailbox is closed
Your settings
Why we have it
Your signature, whether pictures in messages are held back, the senders whose pictures you trust, and any note you write on a mailbox to tell several apart.
How long it is kept
Until you change them or the mailbox is closed
Your sign-up record (if you signed up yourself)
Why we have it
When the mailbox was created, which versions of these terms and this notice you agreed to, and that you confirmed you are 18 or over.
How long it is kept
Until the mailbox is closed
Recent sign-ins and security activity
Why we have it
For each of the last 20 sign-ins: when, the IP address, what the browser says it is, and whether a code was used. Also the last 50 security events, such as a password change, two-step verification being turned on or off, an app password being made, or everyone being signed out. They are there so that you, or we on your behalf, can spot something that was not you.
How long it is kept
Only the newest are kept; older ones are overwritten. Removed with the mailbox
Password reset links
Why we have it
Only a one-way hash of the link is stored, never the link itself, so the stored copy cannot be used to reset anything.
How long it is kept
Until it is used, or after 45 minutes
Failed sign-in attempts
Why we have it
The IP address and the address being tried are counted, so that password guessing can be slowed down. Repeated failures are passed to the mail server’s firewall, which blocks that IP address for a while.
How long it is kept
Fifteen minutes in memory; the firewall’s own block lasts a little longer
A record of administrator actions
Why we have it
Changes made to mailboxes from the administrators’ console (a role, whether it is switched on, deleting or restoring it), and a mailbox being created through sign-up, are logged with the address concerned and who made the change.
How long it is kept
The newest 2,000 entries across the whole service
Server access logs, including your IP address
Why we have it
To keep the service running, and to see what happened when it is abused or attacked.
How long it is kept
A rotating buffer; old entries are overwritten and nothing is archived
Mail delivery logs
Why we have it
To show where a message went, and why one did not arrive.
How long it is kept
A rotating buffer, as above

We do not ask for your date of birth, your postal address, your telephone number or any payment card, and none of those are stored.

When a mailbox is deleted it is held, switched off, for 30 days so that a mistake can be put right. After that the mailbox, its mail and everything in the table above that belongs to it are removed.

3.Why we are allowed to hold it

Your address, your name, your password, your mail, your settings and your address book are held so that we can provide the mailbox you asked for. In data protection terms that is performance of a contract with you.

Logs, sign-in history, security activity, the counting of failed sign-ins and spam filtering rest on legitimate interests: keeping the service and your mailbox safe, stopping abuse, and being able to answer a question about a message that did not arrive. We keep them short and we do not use them to build a picture of you.

The sign-up record exists so that we can show what was agreed to and that the age rule was confirmed.

4.Where it is kept

Everything sits on a single server in Germany, hosted by Hetzner Online GmbH. Hetzner provide the machine and the building around it; they act on our instructions and they do not use anything on it for their own purposes.

Mail is stored encrypted and backed up every night to storage kept apart from the machine that serves it.

Spam filtering runs on that same server. Your mail is not sent anywhere else to be scanned.

5.Who else sees it

Three, and only three:

Hetzner Online GmbH, in Germany, who host the server.
Brevo, who carry mail you send. Our host blocks the port that mail servers normally use to reach each other, so outgoing messages leave through Brevo as a relay and pass through them on the way. Mail you receive does not.
Whoever you write to. That is what sending an email means: the message goes to their provider and is then theirs, not ours.

Beyond that, nobody. We would hand something over if the law required it, and if we are ever asked we will tell you unless we are forbidden from doing so.

Nobody at Mailhubz reads your mail as a matter of course. An administrator can open a mailbox where that is needed to fix a fault or to deal with a report of abuse. Opening a message that way is deliberately marked so that it still shows as unread to you.

6.Cookies and browser storage

One cookie, called mailhubz_session. It is set when you sign in, it is encrypted with a key only our server has, and your browser's scripts cannot read it. It holds what is needed to keep you signed in: the mailboxes you are signed in to in that browser (up to 20) and, for each, the password the mail server needs, in encrypted form. During a two-step sign-in it also holds, for up to five minutes, which mailbox is waiting for its code.

It has no fixed lifetime. You stay signed in until you sign out; until the password is changed or reset anywhere; until someone uses “sign out everywhere” or “sign out other sessions” for the mailbox; until the mailbox is deleted; or until you clear your browser’s cookies. Browsers cap a cookie at about 400 days from the last time it was set, and it is set again once a day while you use it, so in practice that cap is only reached by a browser left unused for over a year.

It is strictly necessary: without it you could not stay signed in from one page to the next. That is why there is no cookie banner. There is nothing optional to agree to, because nothing optional is set.

Things your browser keeps for itself

A few preferences are kept in your browser’s own storage and never sent to us: your light or dark theme, how tightly lists are spaced, and, only if you tick “Remember my address on this device” when signing in, your email address, so the sign-in page can fill it in. Short-lived things, such as the timer shown after too many attempts, go in storage that is cleared when the tab is closed. Clearing your browser’s site data removes all of it.

7.The Android app

The app talks to mailhubz.com and to nothing else. It holds your mail on the device only while you are looking at it.

Your password on the device

So that it can sign you in to mailhubz.com again without asking you to type your password each time, the app keeps your address and password on the device in the Android Keystore, which is hardware-backed encrypted storage that other apps cannot read. They are used for that one thing. They are never sent anywhere else, and they are not readable by us.

Signing out of the app erases them. Uninstalling the app erases them.

Permissions

The app asks for internet access, because it is a mail client. It asks for nothing else: no contacts, no location, no photo library, no microphone.

Pictures in messages

A picture loaded from the internet can tell the sender the moment you opened a message and roughly where you were. Turn on “Block remote images” in Settings and those pictures are held back, in the app and in the browser both, until you ask for them on a message you have decided is worth it. The setting is off to begin with, because turning it on changes how ordinary mail looks; we would rather you chose it than found it.

What the app does not do

It carries no analytics, no crash reporting, no advertising identifier and no third-party software development kit. It sends us nothing about how you use it.

8.Your rights

Under the UK and EU data protection rules you can ask for a copy of what we hold about you, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, and object to us holding it.

Most of it you can do yourself. Your mail is in your mailbox: read it, export it with any normal mail program, delete it. Your name, your settings, your recovery address, two-step verification, app passwords and your address book are all on the settings page.

For anything else, including a copy of your sign-in history, write to support@mailhubz.com from the address in question and we will answer within thirty days.

Closing your mailbox

Ask at support@mailhubz.com and the mailbox and everything in it are removed from the server. Backups already taken age out of the rotation within thirty days, after which nothing is left. The page at mailhubz.com/delete-account sets out exactly what goes and when.

If you are not satisfied

You can complain to the Information Commissioner at ico.org.uk, or to the data protection authority where you live. We would rather you told us first, so that we can put it right.

9.Children

Mailhubz is meant for adults and for businesses. The terms of service set the minimum age at 18, and anyone signing up for a mailbox themselves confirms they are 18 or over. The service is not aimed at children, and neither the website nor the Android app is marketed to them. We do not knowingly hold a mailbox for anyone under 18, and if we find that we do, we will remove it.

10.Keeping it safe

Every connection to the website, the app and the mail server is encrypted. Mailbox passwords are kept by the mail server as one-way hashes; the copy that keeps you signed in on the web exists only inside your encrypted cookie, and the secrets two-step verification needs are stored encrypted.

Two-step verification is available on every mailbox and we would encourage you to turn it on. Changing your password ends every other signed-in session. Resetting it with a reset link does the same, and also removes every app password, so that anyone who had got in through a mail app is shut out too.

If something goes wrong in a way that puts your information at risk, we will tell you and the regulator, as we are required to.

11.Changes to this notice

If this changes, the date at the top changes with it. Where the change is one that matters, we will email you about it rather than leave you to notice.

12.Getting in touch

Anything about your information, or about this notice: support@mailhubz.com
Anything about mail delivery: postmaster@mailhubz.com
To report abuse coming from this system: abuse@mailhubz.com, with the full message headers