Privacy Policy
What data Outbox keeps, why, who it is shared with, for how long, and how to export or delete it.
Last updated:
Summary
Outbox keeps the minimum needed for you to publish and manage pages: your account, what you publish, and some technical security data. We do not sell or share your data for advertising, we use no tracking cookies, and there are no ads.
- Download all your data from Settings → Account.
- Delete your account from Settings → Account. Your subscription is cancelled and everything is permanently erased after 30 days.
- Privacy questions: hello@out-box.dev.
Who is responsible
The data controller is Jonathan Vicente Gaitan Leiva, CUIT 20-38458903-1, located at General Lavalle 4365, Billinghurst, Provincia de Buenos Aires, Argentina ("Outbox", "we"). Contact: hello@out-box.dev.
Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account | Email, username, display name, password (hash only), Google or GitHub identifier if you sign in with them, MFA settings | Create and protect your account, sign you in |
| Content | HTML pages, uploaded files, folders, versions, templates, comments, reactions, share links, responses submitted to your pages' forms and first-open records of who viewed a page (Business plans) | Provide the service: store and serve what you publish |
| Integrations | API keys (stored as a hash, never the key), webhooks and schedules you configure | Let your agents and tools publish for you |
| Usage | Daily view counts per page (aggregated, viewers are not identified), publish and storage quotas | Show you stats and enforce plan limits |
| Security | IP address and browser on each request, audit log of your account's actions (with truncated IP) | Prevent abuse, rate-limit logins, investigate incidents |
| Billing | Plan, subscription status, renewal dates. Payment data is processed by Lemon Squeezy; we never see your card | Charge for the plan, show your subscription status |
| Support | Whatever you send us by email or in a report | Answer you and fix the problem |
Third-party data inside your content. If you publish pages containing other people's personal data, you are the controller of that processing and Outbox acts as a processor on your instructions. Business customers can sign our Data Processing Agreement.
Legal bases
- Contract: account, content, integrations, billing and support.
- Legitimate interests: security, fraud and abuse prevention, improving the service with aggregated metrics.
- Legal obligation: accounting records (kept by Lemon Squeezy as the seller) and responding to authorities.
- Consent: non-essential emails (for example, comment notifications), which you can turn off at any time.
Who we share data with
Only with the providers we need to operate (subprocessors), under contracts that require them to protect the data. The full, current list is at Subprocessors: Cloudflare (infrastructure), Lemon Squeezy (payments), Resend (email), Google and GitHub (only if you sign in with them).
We may also disclose data when required by law or a valid court order, or to protect the safety of users and the service. We do not sell personal information or share it for cross-context behavioral advertising.
International transfers
Our providers operate mainly in the United States and on Cloudflare's global network, so your data may be processed outside your country. We rely on the safeguards those providers offer (EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework).
How long we keep data
- Account and content: while your account exists. If you delete it, it is deactivated immediately and permanently erased after 30 days.
- Sessions: until you sign out or they expire. Deleting your account revokes all of them at once.
- Audit log (truncated IP): 12 months, then deleted automatically.
- Rate-limit data (full IP): minutes to hours, then deleted automatically.
- Billing: Lemon Squeezy keeps receipts for as long as tax law requires.
- Backups: we keep no copies of our own. The database index has point-in-time recovery for up to 30 days (Cloudflare Time Travel), so deleted data may remain there for up to 30 more days.
Your rights
Depending on where you live (GDPR in Europe, Law 25,326 in Argentina, LGPD in Brazil, LFPDPPP in Mexico, CCPA/CPRA in California and others), you have the right to access, correct, delete and port your data, to object to processing, and to withdraw consent.
- Access and portability: download your data as JSON.
- Correction: edit your name and email in Settings.
- Deletion: delete your account.
- Email: turn notifications off in Settings or with the link at the bottom of each email.
- Anything else: write to hello@out-box.dev. We answer within 30 days.
If you are not satisfied, you can complain to your data protection authority.
California residents (CCPA/CPRA)
In the last 12 months we collected the categories listed under Data we process (identifiers, commercial information, internet activity and content you create), from the sources and for the purposes described there. We do not sell or share personal information as defined by the CCPA, and we do not use sensitive personal information to infer characteristics.
You have the right to know, delete and correct, and not to be discriminated against for exercising these rights. Use them from Settings or by writing to hello@out-box.dev; an authorized agent may submit a request with your signed permission. We honor the Global Privacy Control signal, although since we neither sell nor share data it changes nothing in practice.
Children
Outbox is not directed to children under 13 and we do not knowingly collect their data. If your country requires an older age to consent (up to 16 in some EU countries), you must be that age. If you know of an account belonging to a child, tell us and we will delete it.
Security
Encryption in transit (HTTPS with HSTS), salted password hashes, API keys stored as hashes, optional MFA, published HTML isolated in a sandboxed iframe, rate limits and an audit log. No system is perfect: if we detect a breach affecting your data we will notify you without undue delay, and the authorities where the law requires. More at Security.
How to delete your account
On the web: go to out-box.dev/settings/account, click Delete account and confirm by typing your username. In the iOS, Android and desktop apps: Settings → Delete account.
- Immediately: your subscription is cancelled, all sessions are closed, your API keys are revoked and your pages stop being accessible.
- After 30 days: your account, pages, files, versions, stats, form responses, open records, schedules and webhooks are permanently erased.
- Kept: the audit log with truncated IPs (security) and payment receipts Lemon Squeezy keeps by law.
- If it was a mistake: write to hello@out-box.dev within 30 days and we will restore it.
If you cannot sign in, request deletion from your account's email address to hello@out-box.dev.
Changes to this policy
If we make material changes we will tell you by email or in the product at least 30 days in advance. The last-updated date is shown above.