1. What this website uses
Our website code sets no cookies and creates no visitor identifiers. It does not read or write localStorage, sessionStorage or IndexedDB, use advertising pixels, analytics SDKs, fingerprinting or third-party embeds. Fonts, icons and screenshots are served from this website.
| Technology | Current use and duration |
|---|---|
| Essential cookies | None set by our website code. No optional Cloudflare analytics or browser tracking is enabled. |
| Preferences | Theme, pricing calculator and sample-inbox choices stay in page memory. They reset when you reload or leave; they are not saved in browser storage. |
| Analytics, advertising and profiling | None. No vendors, identifiers or retention periods apply. |
| Consent records | None stored. There is no optional tracking to consent to. |
| Asset delivery | Normal network requests deliver the page and assets through Railway and Cloudflare. Our server sends Cache-Control: no-store and no Set-Cookie header. This does not prevent browser-managed history or files you choose to save. |
Serving a page still processes your IP address and request headers. Our application server has no per-request access log, but Railway and Cloudflare may retain connection, operational and security records. These network records are not browser tracking cookies. See the Privacy Policy for connection data and support.
2. Your choices
There is nothing to accept to use this site. No consent popup is needed for its current cookie-free, tracker-free design. The notice in the footer remains available on every page, including when JavaScript is disabled.
Sale, sharing for cross-context behavioural advertising and targeted advertising are off for every visitor. This includes browsers sending Global Privacy Control or another applicable universal opt-out signal. Do Not Track does not change this behaviour because we do not track browsing across third-party services.
You can block cookies through your browser without losing the current website features. You can also ask about personal information we hold through our privacy request routes. No account is required.
3. Before new features launch
The separate account/browser preview is hosted at app.reclaimed.email. Its necessary sign-in storage is inventoried below; marketing-page cookie-free claims do not cover it. Payment collection, marketing signup, analytics and advertising remain inactive. This notice is not consent to future tracking.
Before using new cookies or similar technologies, we will update their names, purposes, suppliers and duration. Technologies requiring consent must stay blocked until a specific affirmative choice. Optional purposes remain separate, with no preselected consent, an equally accessible rejection option and an easy way to withdraw.
Necessary sign-in storage is described separately below, not treated as permission for marketing. Applicable browser opt-out signals must be respected even for tracking without cookies. A notice or button alone does not implement these protections.
4. Native app and separate browser service
The native app has local mail, settings and protected credentials, not website cookies. See device storage, accounts and optional recovery and deletion. The pricing calculator can place public plan/capacity choices in a portal link; that does not contain credentials, create an account or confirm a plan by itself.
Remember me is off by default. Without it, browser sign-in uses a session cookie with an eight-hour absolute server limit; native sign-in keeps its token in memory only. With it, the browser cookie or protected native session can persist for up to 30 days, without sliding renewal. Browser restore settings may preserve session cookies, so use Sign out on shared devices. No account password is stored by this choice.
Separate account/browser storage
This inventory describes app.reclaimed.email, not cookies set by the marketing page. Its /privacy page is accessible without signing in or requesting an account session.
| Name | Purpose and duration |
|---|---|
__Host-reclaimed.session | First-party, HttpOnly, Secure sign-in cookie. Up to 30 days, no sliding renewal; sign-out/revocation can end authorization earlier. |
__Host-reclaimed.csrf | First-party, HttpOnly, Secure anti-forgery cookie. Browser-session lifetime; prevents forged account/mail requests. |
.AspNetCore.Correlation.* | Temporary first-party provider sign-in correlation cookies, with a ten-minute authorization window. Used only when initiating Google/Microsoft sign-in; removed on callback or expiry. |
reclaimed.oauth.<device-id> | sessionStorage operation ID to resume a mailbox-setup callback. Not a password/token. Cleared on completed/forgotten setup or when the tab session ends; callback URLs can temporarily carry the operation ID. |
Development/test cookie names are reclaimed.session and reclaimed.csrf. Browser theme and ordinary view state stay in page memory; saved mail/rules and onboarding drafts live in the service database, not this preference memory. There are no advertising/analytics cookies in the browser implementation. Blocking necessary storage may break sign-in or callback recovery; no optional-tracking consent is inferred from using an account.
Provider sign-in pages and external links have their own privacy practices. Allowed email images can reveal viewing/request information. This marketing site's cookie-free status does not cover provider pages, the browser app, operating system or destinations you choose.