Privacy Policy

We sell email hosting. We do not read your mail, scan it for advertising, build a profile of you, sell anything about you, or train anything on any of it. The site pages you are reading now use Google Analytics so we can tell whether anyone is finding us, advertising pixels so we can tell whether the ads we pay for work, and Microsoft Clarity, which records how a page was used so we can see where people get stuck. The product itself does not. Once you sign in there is no analytics, no recording, no tracking and only essential cookies for sign-in and mailbox verification.

Who we are

FranklyMail is a product of Naylalabs Yazilim Ticaret Limited Sirketi, based in Türkiye. There is no separate FranklyMail company. The contract is with Naylalabs Yazilim Ticaret Limited Sirketi.

Registered address: Harran Üniversitesi Şanlıurfa Teknokent, Ulubağ Mahallesi, Recep Tayyip Erdoğan Bulvarı No 287A, İç Kapı No: 315, Haliliye, Şanlıurfa, Türkiye.

Tax number: 6301115387.

For anything on this page, including a request to see or delete your data, write to hello@franklymail.com. A person reads it.

We are the data controller for account administration and billing information. When you use our mailboxes for your organisation's personal data, you determine why that data is processed and we process mailbox contents on your behalf to provide the service. This includes subscriber information you choose to keep in messages or attachments; it does not give us permission to use your subscriber list for our own marketing.

What we store

Your account, so the service can exist:

• Your email address, and a hash of your password, never the password itself.
• Account status and plan.
• One row per sign-in session, each with the IP address and browser user-agent it was created from, so the session list in your settings can show you what is signed in and let you revoke it.
• If you turn on two-factor authentication: an encrypted TOTP secret and hashed backup codes. App passwords are stored as hashes only.
• If analytics was running in your browser when you signed up: the advertising click identifier you arrived with, if any, and the two identifiers Google Analytics gave your browser for that visit. They are kept with the account for one purpose, which is that when a payment succeeds we can report the sale to the network that earned it, and that report happens on our servers after your browser has stopped being involved. They are other people's identifiers for a browser, not for you, and we never look anything up with them. The cookies section below is exact about this.

Your mail setup, because that is the product:

• The domains you add, and the result of each DNS check we run against them: the MX, SPF, DKIM and DMARC values we expect, what we observed, and when.
• Your mailboxes and aliases: addresses, display names, quotas, forwarding targets.
• The mail itself: messages, attachments, folders, stored on our mail servers for as long as you keep it there.
• Mail server logs: connections, deliveries and rejections. These contain IP addresses and envelope addresses, and they are what makes it possible to answer "why did that message not arrive" and to stop abuse.
• Storage and message counters, so your usage meter and your bill are real numbers.

Counters are all the panel normally sees of a mailbox: how much and how many, never what is in them. There is one exception, and it exists because you asked for it: when you export a mailbox, the panel reads that mailbox's messages, because it cannot build the file you are downloading out of anything else. Those bytes go straight through to your browser as the archive is assembled. None of it is written to disk on our side, no copy is kept when the download ends, and the request is written to your audit log like every other action on your account. Agentic Inbox access, when you enable it, is described below.

Agentic Inbox is optional. Connecting an assistant such as Claude or ChatGPT lets that assistant read and search the single mailbox you verify through webmail, and prepare reply drafts. The messages and drafts it requests are shared with that assistant and handled under your agreement and privacy settings with its provider. FranklyMail does not choose a model or use these messages to train one. You can disconnect the assistant in Agentic Inbox; that stops further access, but cannot remove copies already held by the assistant. A management account session cannot authorize a coworker’s inbox or view its Agentic Inbox drafts. Administrators can enable or disable access, send setup invitations and revoke connections. Existing mailbox password reset and export permissions are unchanged. Existing resource-only keys do not gain access to email content.

Agentic Inbox drafts are encrypted in our account database and kept for up to 30 days. A pending draft expires after 24 hours. Sending requires approval from a session verified for that mailbox, for the exact recipients and message in FranklyMail. The assistant cannot send or approve a draft by itself. Approved mail then follows normal mail storage and delivery. Access credentials are stored as hashes; audit records identify the action, mailbox and draft, without copying message text. Backup copies follow the separate retention period below.

Feature suggestions are private. If you share an idea through our updates page, we store your suggestion and your required email address so our team can review it and follow up. This does not subscribe you to marketing. Suggestions are visible only to our team and are not automatically published on the roadmap. We remove these records from the active database after one year; backup copies follow the retention period below. To limit spam, we temporarily store a keyed hash of your IP address rather than the address itself in the form’s rate-limit records. You can contact us to request earlier deletion.

Your billing record, which is mostly a mirror of someone else's:

• Subscription status, renewal date, and invoice records for display in the panel.
• No card details, ever. Payment is taken by Creem, our merchant of record. See who else touches your data. Card numbers never reach our servers.

And an audit log: every state-changing action on your account, with a timestamp and who did it. It exists so that a security question has an answer.

Mail delivery history stores envelope sender and recipient addresses, timestamps, delivery outcomes and error codes for up to 30 days in the active service. It helps account owners troubleshoot delivery. This history does not store subjects, message bodies, attachments or read status. Backup copies follow the separate retention period below.

Cookies and local storage

Agentic Inbox uses two additional essential, secure, HTTP-only cookies on the panel host: __Host-fm_inbox_flow binds a webmail verification to the browser that started it and expires after ten minutes; __Host-fm_inbox_session keeps the verified mailbox signed in for up to twelve hours. They contain random tokens, not a mailbox password. The webmail tab temporarily keeps the verification request identifier in session storage until you continue or cancel.

The essential sign-in cookie, __Host-fm_session. It holds a session token, is HTTP-only and Secure, is sent same-site, and lasts 90 days from your last visit with a hard stop at one year. It is strictly necessary: without it you cannot stay signed in. Advertising measurement on the public site is described below.

Your browser also keeps a fm-theme value in local storage so the panel opens in the light or dark theme you chose. It never leaves your browser.

If you arrived here from an ad on X, that link carried a click identifier, and your browser keeps it as fm-twclid in local storage for 30 days. It is X's identifier for the click, not for you: it says nothing about who you are and we never look anything up with it. Unlike the theme value it does leave your browser, exactly once. If you create an account we send it with that request and store it, so that when you later pay we can tell X that their ad produced a sale. If you never sign up it expires where it sits and is never sent anywhere. Clearing site data for this domain removes it.

In the panel and in webmail: no advertising cookies, no third-party cookies, no analytics, no session recording, no fingerprinting. Nothing about a signed-in customer is measured or sent anywhere.

The marketing pages are the exception, and it is worth being exact about where the line is. Everything outside the product (the home page, the comparison and guide pages, this policy, and the signup and setup screens) loads third-party tags, each of which sets its own cookies and tells its owner that a browser visited a page. Three of them are described here and the fourth, which records rather than counts, has its own paragraph below. Google Analytics is there to answer one question: how many people arrive, and where they stop. X's advertising pixel is there to answer a narrower one: whether the people who arrive from an ad we paid for are the people who sign up. OpenAI’s advertising pixel measures page visits, completed registrations and checkout starts from our ChatGPT ads. It can store the ad click identifier in a first-party __oppref cookie. We send no email address, customer domain, account identifier or payment details in these browser events; OpenAI receives the site origin and event type. Browser requests also expose network information such as the IP address.

Three limits on them, all enforced in the code rather than promised here. The address is trimmed before it is sent. Google receives the path and never the query string, so the domain identifier that appears in a setup URL does not leave with it. The events carry no personal data: they record that an account was created, an address was verified or a checkout was opened, never whose. And X is told even less than Google: it receives the fact that a step happened and none of the numbers or labels that go with it.

Microsoft Clarity is the fourth, and it is different in kind, so it gets its own paragraph. It does not count visits, it records them: mouse movement, scrolling, clicks and taps, and the structure of the page they happened on, played back to us as a session recording and added up into heatmaps. We use it to answer one question, which is where people give up before buying.

What it is not given is what you type or read. Clarity masks input fields, numbers and email addresses in the browser, and masked content is never uploaded. What it records is the shape of the page and what you did on it.

Where it runs is a short list and the code enforces it. The public pages, and the signup screens up to and including the moment you are handed to the payment provider. It stops there. It does not run in the panel, in webmail, on the setup screens where your domain and your DNS records are shown, on the sign-in page, on the password reset page, or on the Boost screens the webmail sends you to. That last part is not only about the screen: unlike the other three tags, Clarity records the address bar as it stands, and those pages carry identifiers in it. Walking from a page it runs on into any of those ends the recording rather than carrying it along, which is the case an ordinary site gets wrong and the one we wrote a test for.

Clarity stores an identifier for your browser in two first-party cookies, _clck and _clsk, and Microsoft sets its own cookies on its domains, including MUID, which Microsoft also uses for advertising. In the EEA, the UK and Switzerland, Clarity applies its own consent mode by default and sets no cookies at all unless it receives a consent signal. We do not run a consent banner, so it never receives one: those visits are recorded without cookies, which means one visit is not linked to the next. You can opt out of Clarity everywhere it runs, on any site, at clarity.microsoft.com/opt-out, and browser-level tracking protection blocks it like any other third-party tag.

Two reports go out from our servers rather than from your browser, and they carry the same single fact: that a payment succeeded. The browser never learns it, because you are on the payment provider's site at that moment.

X is told the amount, the transaction reference, the ad click identifier above if you had one, and your address as an irreversible SHA-256 hash, which is how X matches a sale to an ad without being handed the address itself. This is the only place on this page where an address is involved in advertising, so it should be stated plainly. The address in readable form is never sent, and it is never sent at all by any tag running in your browser.

Google Analytics is told the amount and the transaction reference, together with the two identifiers its own tag had already given your browser, so that the sale is counted against the visit that produced it instead of appearing out of nowhere. It is given no address, hashed or otherwise, and nothing that names you.

The panel and webmail carry none of it. Once you are signed in and using the product, nothing is measured. The boundary is which part of the site loads the analytics at all, not a setting someone could flip.

Who else touches your data

Our service providers are named below with what they do. Agentic Inbox also shares the data you authorize with the assistant you choose, as described above. We do not sell or rent your data.

• Amazon Web Services (SES) carries the mail you send out to the world. It sees each outgoing message and its recipients, and tells us when one was delivered, bounced, or reported as spam. Our SES sending region is Europe (Frankfurt), eu-central-1. SES is the outbound delivery service, not the primary store for your mailbox.
• Backblaze B2 stores message bodies and attachments, a separate replica of those objects, and off-server backups of our mail metadata and database. We use its EU Central region in Amsterdam, Netherlands.
• OpenAI produces the answers of the Boost writing assistant, only when you ask it to: what you typed to it, your draft, and the conversation you are replying to or forwarding. We keep counts, not text; OpenAI's API terms exclude it from training. Separately, OpenAI measures our ChatGPT advertising through the public-site pixel described above.
• Cloudflare provides DNS, web traffic protection and proxying, and tunnels used by the service. It processes network and request data for traffic routed through it. The locations listed below for mailbox storage are not a promise that Cloudflare processes every request only in the EU.
• Creem: our merchant of record. Creem takes the payment, holds the card details, and issues your invoice. It receives your email address and what you bought.
• Hetzner: the servers our mail system and database run on in Falkenstein, Germany. These hold mailbox metadata, indexes, account records and operational data; message bodies and attachments are stored in Backblaze B2 as described above.
• X (Twitter) measures our advertising. Its pixel runs on the marketing pages only and tells X that a browser visited one, and when a payment succeeds our server reports the sale with your address hashed and, if you came from one of their ads, the identifier for that click. It never runs in the panel or in webmail, and it is never given the contents of anything.
• Microsoft runs Clarity, which records how the public pages and the signup screens are used, as described above. It never runs in the panel or in webmail, and the content of what you type is masked before it leaves your browser.
• Google measures the public site through Google Analytics, and is told by our servers when a payment succeeds so the sale can be counted against the visit. It is never given an address or the contents of anything, and it is not run in the panel or in webmail. Separately, Google Fonts serves the two typefaces this site uses, which means your browser requests them from Google and Google sees that request. Worth saying out loud rather than hiding in a footnote.

Hosting, storage and mail delivery providers process service data on our behalf. Payment and public-site advertising providers have different roles and do not receive mailbox contents merely because you use a mailbox. Optional Boost and Agentic Inbox sharing follows the choices described above. An email recipient's own mail provider also receives the messages you send to that recipient.

We also disclose data when the law requires it. If we ever receive such a demand we will tell you, unless we are forbidden from doing so.

Storage locations and international access

Our current mailbox infrastructure uses Hetzner in Germany and Backblaze B2 in the Netherlands. Nightly database and mail metadata backups are copied to Backblaze B2, and message bodies have a separate replica there. This replica is with the same storage provider as the original message bodies.

These are storage locations, not a guarantee that all processing takes place within the EEA. Naylalabs operates from Türkiye, and authorised administration and support can involve access from Türkiye. Mail delivery, optional features and our providers' operations can also involve processing in other countries.

For questions about a data processing agreement, international transfer arrangements, or the providers involved in your use of the service, contact hello@franklymail.com. This privacy policy is not itself a data processing agreement or a set of Standard Contractual Clauses.

Your rights

You can ask us to show you what we hold, correct it, export it, or delete it, and you can object to how we use it. Email hello@franklymail.com from your account address and we will answer within 30 days. We do not charge for it and we will not put you through a retention conversation first.

Two of those are things you can already do without asking us. Your mail is reachable over IMAP, so your archive was always portable: any mail client can copy it out whole. And the session list in your settings lets you revoke access to any device.

If you are in the EU or UK and think we have handled your data badly, you can complain to your local data protection authority. We would rather you told us first, but it is your right either way.

How long we keep it

While your account is active: for as long as you keep it. Nothing expires quietly behind your back.

Boost open tracking: the recipients of a tracked message, when each copy was delivered or bounced, and each open with its time and the kind of mail program, for 90 days from sending. Never the message itself, never an address of the program that opened it.

• A failed renewal starts a 14-day window. Mail keeps flowing during it and nothing is deleted. Your billing screen shows the exact dates for your account.
• After that the account is suspended: mail stops, and the data stays. It remains for 60 more days, after which we may delete it. We will not delete a suspended account's mail without telling you first, and the schedule gives you at least 30 days' notice.
• If you cancel, the same clock applies from the end of the period you paid for. Ask us and we will delete it sooner.

Sessions expire on their own. Audit log entries and mail server logs are kept for security and delivery troubleshooting, and are not used for anything else.

Backups have their own clock, and it is shorter. Your mail and the account database are backed up every night and copied to storage in a different company's data centre in the EU. Those copies are deleted automatically after 30 days. So when you delete something, or close your account, a copy can survive in a backup for up to a month after it is gone from the live system. That is true of every hosting provider that takes backups at all, and we would rather write it down than let you assume otherwise.

Backups exist so that a broken server does not cost you your mail. They are not browsable, nothing routine is ever restored from them, and a request to delete your data removes it from the live system immediately and lets the backup copies age out on that 30-day clock.

Security

Passwords are hashed, TOTP secrets are encrypted, app passwords are stored only as hashes, and sessions are held server-side so that revoking one actually revokes it. Our database is not reachable from the internet, and the mail server's admin interface is not exposed to it either: the panel reaches both through a private tunnel.

What we will not tell you is that this makes us unbreakable. If we ever have a breach that affects you, we will email you about it, and we will say what happened rather than what our lawyers would prefer.

Children

The service is sold to adults and is not directed at children. We do not knowingly create accounts for anyone under 16.

Changes to this policy

When this page changes, the date at the top changes with it. If a change materially affects what we do with your data, we will email you rather than quietly re-dating the page.

Questions: hello@franklymail.com. See also our Terms of Service and Refund Policy.