Privacy

Botmail stores your email address in readable form so it can send mail. It also stores your chosen topics, free or supporter tier, signup source, confirmation and consent dates, subscription status, private token hashes, an internal unsubscribe token and unsubscribe information. Subscription mail starts after mailbox confirmation. We use these records to provide your chosen service, record consent and prevent unwanted mail.

Tier and vouchers record your free or supporter status and one-time redemption. A voucher is stored as a keyed hash with a short hint, label and redemption history. Botmail does not receive your payment details from X.

Hashed IP and ASN values help enforce rate limits and identify abuse clusters. IP addresses and network numbers are converted to HMAC-SHA-256 values with a server secret before storage. These identifiers can still be linked to records within Botmail and are not anonymous. Raw connection details are used transiently by the server and production challenge service.

The audit log records actions such as confirmation, consent changes, authenticated bot use, moderation and abuse decisions. It can include a subscriber reference, email domain, tier and hashed network identifiers. Owner exports omit full email addresses. Audit entries are removed by scheduled cleanup after 365 days.

Link click tracking uses signed /l/ links to record a subscriber reference, delivery or post reference, time and scanner-exclusion reason before redirecting. No tracking pixel is used. HEAD requests, known scanner agents and clicks less than two seconds after delivery are excluded from activity metrics. Activity requires a non-scanner click plus a second signal within the reporting window.

Raw click records enter scheduled cleanup after 180 days. Daily aggregate totals and per-delivery click counters remain for historical reports. They contain no destination email address but delivery records remain associated with a subscriber. Subscriber IP and ASN hashes are cleared after 30 days from confirmation. Older audit, bid and abuse-cluster records have separate retention.

Rate counters and authentication failures enter cleanup after 2 days. Provider-event replay receipts, when received through configured hooks, enter cleanup after 1 day. Cleanup changes at most 500 old records per table per run, so a backlog can take more than one run.

Never-confirmed signup records enter cleanup after their confirmation link expires plus 2 days. Mail-budget and voucher-attempt records enter cleanup after 2 days; confirmation-budget records remain for at least 2 days to enforce resend limits. Cleanup runs in bounded batches. A confirmed or unsubscribed address is not covered by pending-signup cleanup.

Promo bids store your X handle, amount in USD, slot, timestamps, status, owner notes and hashed network identifiers used for abuse checks. The owner uses the handle to contact a selected bidder on X. Handle ownership is not verified automatically. Handles and individual bid records are private to the owner; the current highest amount is public only if that option is enabled.

Feedback and community submissions store the text, category or type, public links, publication permission, optional contact address, credit choice, moderation history and hashed network identifiers. Community submissions also store an X handle and optional banner URL. Their management tokens are stored as hashes. Private contact details are never deliberately included in published content or added to the newsletter. We do not email submission receipts to unverified addresses. Publication notices require an existing confirmed, active, unsuppressed subscription. Obvious secrets are stripped, but redaction cannot detect everything. Do not submit secrets, private files or other people’s personal information.

Public feedback contains only reviewed fields such as its title, edited summary, category and permitted credit. Curated posts may include your public handle, links, description and media after review and permission. Use your private management link to withdraw permission or delete a submission. Private text, contact and network fields of completed submissions enter scheduled cleanup after 180 days, or 30 days for spam. Pending submissions have no automatic expiry. Published content and limited moderation history remain until removed. Legacy private reports and migration backups are not public.

Removal requests store the item reference, reason, optional contact, hashed IP, status and resolution date for owner review. These records currently have no automatic deletion deadline. Access is limited to the owner.

Cloudflare Turnstile processes challenge information and the requester IP in production. Cloudflare hosts the production application, D1 database and R2 media storage and receives connection metadata. Turnstile processes browser and challenge signals to prevent abuse; Botmail sends the requester IP to its verification endpoint. A production MX check sends the email domain to Cloudflare DNS-over-HTTPS.

The X API supplies public posts from the official @bot account when access is configured. Source posts and editorial records are cached to support review and avoid duplicates.

Hotlinked banner images are loaded directly by your browser or mail client from third-party image hosts. Those hosts receive connection information. Botmail stores the image URL as supplied. Uploaded banners are stored in Cloudflare R2 and served through Botmail. Deleting a post removes its upload when no other post uses it. The owner can also remove an uploaded image and detach it from every post. Delivered messages and copies already cached or saved outside Botmail cannot be recalled.

Resend is the processor used to deliver production email. It receives the destination, sender, subject, message content and unsubscribe headers. Pending delivery retries temporarily store the complete message encrypted on the server. The encrypted payload is cleared when delivery succeeds, fails permanently or is cancelled. Local runs send nothing to an email provider and use a dry-run outbox on the owner's computer.

Subscription, suppression and delivery history, voucher redemption records, bids, abuse decisions, published content and private migration backups currently have no automatic full deletion deadline. The owner reviews deletion requests manually. Ask for access, correction or deletion at boss@botmail.si and identify the address or item concerned. We may ask you to verify control of the address or your connection to the item. A minimal suppression record may need to remain to prevent further unwanted mail. We will explain any records that must be retained. Requests also cover stored media and relevant processor-held data; existing copies outside our control cannot be recalled.

Every subscription email includes an unsubscribe link. The stop page lets you unsubscribe completely, or redeem a supporter voucher to keep your chosen topics without promos. Opening the page alone changes nothing. Confirming unsubscribe stops future subscription mail. A free subscription has no promo-only opt-out. Unsubscribe and deletion are separate actions.

Resend and Cloudflare may process data outside your country under their service terms and privacy safeguards. Their current privacy information is available at https://resend.com/legal/dpa and https://www.cloudflare.com/privacypolicy/. Botmail does not receive payment card details from X. Sponsors do not receive the subscriber email list through this site.

The intro uses localStorage to remember that it was seen. No account is created on X by this website.