Essential cookies only.

1. Operator

Azure Mail (“the service”) on mail.azure.cx is operated by [OPERATOR LEGAL NAME - PLACEHOLDER]. The legal operator name is still to be confirmed; it is shown as a placeholder until then.

Questions about this policy can be raised in the Azure Discord community.

2. Cookies used

Session cookie (mail_session). Holds the signed session token. HTTP-only, SameSite=Lax, Secure over HTTPS, 8-hour maximum age. Cleared on sign-out. Without it, staying signed in is impossible.

Admin flash cookie (mail_flash). Carries one action message for 10 seconds on /admin paths. HTTP-only, SameSite=Lax. Without it, only the confirmation message is lost.

CSRF tokens are derived from the session cookie and travel as hidden form fields, not as cookies.

That is the complete list. The service runs no analytics beacons, no advertising pixels, and no social-media trackers.

3. Browser storage

The interface keeps no data in localStorage, sessionStorage, or IndexedDB. Mailbox state lives server-side in the service database; the inbox refreshes it over same-origin requests.

4. Why there is no consent banner

Because every cookie the service sets is strictly necessary for sign-in or admin feedback, and no optional tracking exists, no consent banner is required. Introducing any optional cookie or tracker in future requires updating this policy first and adding consent controls before the tracker loads. See the Privacy Policy for the full data picture.

5. Control

Browsers can block or delete cookies per site. Blocking the session cookie signs the account out and disables authenticated features; the public sign-in and legal pages remain readable. Blocking browser storage has no further effect because the interface stores nothing there.