Privacy

Service data

Helios Post uses Lucion Identity for sign-in, Cloudflare to deliver the application and server functions, Supabase for mailbox and account records, and Resend for email transport. Mailbox content and address data are processed to provide sending, receiving, and account features.

API-key metadata

For each API key, Helios Post stores a verifier rather than the secret, along with its name, scopes, creation and expiry details, revocation state, last-used time, and the most recent IP address from an authenticated API request. The address is obtained from Cloudflare's client-IP header, validated, replaced when the key is used again, and shown only to the signed-in account owner in API-key settings. Helios Post does not add this IP value to application logs.

Account activity

Helios Post records successful sign-ins and account changes involving API keys, sender identity, and mail addresses or routing. The activity log stores event type, time, account and actor references, and limited change metadata. It does not include message content, credentials, or request IP addresses. Signed-in account members with access to a mailbox can view its recent activity. A complete retention schedule remains part of the full privacy policy requirement.

Current limits

This page summarizes current product data handling and is not a complete privacy or compliance statement. Inbound spam/phishing filtering and attachment malware scanning are unavailable. A full privacy policy covering retention periods, service providers, user rights, and contact details remains a pre-launch requirement.