Private mail, plainly described.

1. Operator

Azure Mail (“the service”) on mail.azure.cx is operated by [OPERATOR LEGAL NAME - PLACEHOLDER]. The legal operator name is still to be confirmed; it is shown as a placeholder until then.

The fastest contact route is the Azure Discord community. Requests sent there should include the mailbox address so the request can be matched to the correct account.

2. Data collected

Mailbox accounts: address, creation and update timestamps, enabled state, forwarding address, administrator notes, a PBKDF2-SHA256 password hash with a per-account salt, and the generated password stored retrievably so the administrator can view it in the console.

Mail: sender, recipient, subject, text and HTML bodies (each capped at 100,000 characters), provider message id, routing headers, raw source (capped at 250,000 characters), forwarded-to address, and received, read, and archived timestamps.

Sessions: the signed mail_session cookie payload (role, mailbox id and address, issued-at, expiry, and nonce). No server-side session table exists; the cookie is the session. See the Cookie Policy.

Security records: sign-in attempt counters keyed by client address and principal, plus admin API rate-limit counters. Counters clear on successful sign-in, and stale windows reset on the next attempt.

Admin API traffic: keys travel in request headers and are compared against a server-side secret; request bodies are capped at 1 MiB.

3. Where submitted data goes

Account, message, and security data is stored in the service database (Cloudflare D1) and processed by the service backend (Cloudflare Workers) behind mail.azure.cx.

Sign-in credentials are sent to this mail backend only.

Inbound mail arrives through Cloudflare Email Routing. When a forwarding address is configured, a copy is forwarded to that external address and the forward is recorded on the stored row.

Outbound mail sent through the admin API leaves through the Cloudflare Email Service to the stated recipients (at most 50 per request); the sender address must use an allowed domain.

Data is never sold, never shared with advertisers, and never used for marketing. No marketing emails exist and no marketing consent is requested.

4. Retention

Sessions expire 8 hours after issuance, with a 24-hour absolute cap. Signing out clears the cookie immediately.

The admin flash cookie (mail_flash) carries one action message for 10 seconds on /admin paths.

Sign-in attempt records clear on success and reset once the 15-minute window passes.

Mail rows persist until deleted — by the mailbox holder, by the administrator, or together with the mailbox when an account is deleted. Archiving hides a message; it does not erase it.

Accounts persist until the administrator disables or deletes them. Deletion removes the account and all of its mail permanently.

No automated backup or purge schedule exists beyond the behavior above.

5. Account rights

Mailbox holders can read, archive, and delete mail at any time in the inbox, and can see the account state shown in the console.

Correction and erasure run through the administrator: a request in the Discord community naming the mailbox address reaches the party able to correct, disable, or delete an account.

6. Security

Passwords use PBKDF2-SHA256 with 100,000 iterations and a per-account salt. Sessions are HMAC-signed tokens in HTTP-only, SameSite=Lax cookies that are Secure over HTTPS. Mutating requests require CSRF tokens, sign-in is rate-limited (8 attempts per 15 minutes, then locked), and HTML previews render in a sandbox with remote content blocked.

7. Changes to this policy

Material changes update the date below the title. Continued use of the service after the posted update date constitutes acceptance of the revised policy.