Privacy Policy

Updated 4 October 2026. Covers the website, account panel and Mail.

We do not sell your personal data or use it for advertising. We do process information needed to run email, manage accounts and respond to security and abuse concerns.

What we collect

• When you apply: your invitation details, chosen username, contact email, reason, human-check answer and request discussion. We use these to review and communicate about your application.
• When you use your account: password and recovery-code hashes, aliases, account settings, session records and successful-access timestamps.
• When you use email: messages, attachments, headers, addresses, folders and delivery information. Webmail also stores contacts, signatures, preferences and temporary uploads.
• When you ask for help: your correspondence, relevant evidence and staff decisions.

Cookies and logs

Our sites and webmail use cookies to operate sessions and protect forms. Custom public pages do not use advertising or analytics trackers.

Application sessions record limited browser information and keyed IP hashes. Web and mail systems can also log raw IP addresses, request URLs, login events and delivery metadata. Hashed identifiers are not anonymous. We are not a zero-log service.

Who can access your information

Authorized volunteers review applications and handle support and abuse. Privileged server operators can technically access stored mail and its encryption keys. Mail is also processed by spam filters. Current encryption does not make messages unreadable to Commonside.

Hosting, network, DNS and proxy providers can process connection information. Cloudflare is used on some routes; a proxy terminating HTTPS can process traffic passing through it. Messages you send are shared with recipients and their mail providers, which have their own privacy practices. Information may also be disclosed where needed to address abuse, operate the service or meet legal obligations.

Keep private links and secrets private

Anyone with your Request ID can read its visible receipt discussion and submit a follow-up. Human-check answers can appear in that discussion. Do not put secrets there. Private reviewer notes are not included in the visible discussion.

Registration links are single-use and expire after five days. Tokens and recovery credentials are stored as hashes, but emailed invitation codes and registration links can also remain in email, restricted outgoing-message records and backups. A new recovery code is displayed for you to save and can temporarily be held in a panel session before display.

How your data is protected

Web and mail-client connections use TLS. Stored mailbox messages are encrypted: new and upgraded mailboxes use password-linked per-user keys, while older mailboxes still use server-held keys until their owners upgrade. This is not end-to-end encryption or a promise that all logs, metadata and backups are encrypted. See Security for the protections and their limits.

Deleting your account

Close account requests permanent deletion of your live account, messages, aliases, webmail contacts and preferences, sessions and associated signup data. Cleanup is queued and retried if a service is unavailable; confirmation does not mean every step has finished. It cannot be reopened.

Purge data instead removes messages and aliases while keeping the account. Deleting an application alone does not delete an existing account.

Inactive accounts

After 12 calendar months without successful account-panel or mailbox access, the entire account is eligible for deletion. Warnings go to your primary mailbox at least 30 and 7 days beforehand. Logging in before cleanup starts cancels the inactivity deletion, restarts the period and sends confirmation.

A connected authenticated IMAP session keeps your account active. Incoming mail, monitoring and SMTP-only authentication do not reset the period. Delayed warning submission delays cleanup, but submission is not proof that a notice was delivered or read. Unverified application contact addresses do not receive these warnings. Existing accounts received a fresh baseline on 3 October 2026 because older activity history was incomplete. Login cannot undo cleanup once it starts.

Application cleanup after registration

Three days after successful registration and mailbox setup, we remove the live request receipt, its discussion and application details, including the contact email, from our request databases. Your account and mailbox remain. Cleanup is retried if a service is unavailable. A minimal deletion record prevents the request from being restored by synchronization. Security/audit records, invitation-use accounting, backups and email copies can remain.

What can remain afterward

Security and abuse records, audit records, minimal deletion records, invitation-use accounting and historical backups can remain. Other logs, unregistered applications and support records do not share a single verified retention schedule. Hiding a receipt or expiring a session does not erase those records.

Local database backups have a scheduled 14-day age-based cleanup threshold; manual snapshots can remain longer. This is not an exact deadline for erasing every copy. Deletion does not guarantee forensic erasure from storage, transaction logs or provider snapshots, and cannot remove recipients' copies.

Questions and changes

Email support@commonside.org to ask about access, correction or deletion. We may need to verify your authority. Do not send passwords or recovery codes. The contact form is not available.

Check this page for updates; individual notification of every change is not guaranteed. Nothing here removes rights or obligations that apply under law.