Privacy Policy

Last updated: 2026-07-20

TutuEmail (“we”) respects your privacy. This policy explains how we collect, use, store and protect your information when you use the service. Using the service means you agree to this policy.

1. Information we collect

Account info

Your email, username and password (stored with argon2 — we never keep plaintext passwords) when you register or sign in via Tutu ID.

Mail data

The content, subject, recipients and attachments of mail you send and receive, used to provide send/receive and delivery.

Sending config

Your bound sending domains, DNS verification records and generated API keys (stored encrypted, only the prefix shown).

Technical info

Minimal logs such as sign-in time and frequency, needed for security and anti-abuse.

2. How we use it

Provide the service

Send/receive mail, in-app delivery, and sending for your website per your configuration.

Security & anti-abuse

No AI training

Your mail content is used only to provide the mail service to you — never to train AI, and never sold or shared with third parties (except as required by law).

3. Storage & protection

Encrypted at rest

Sending keys and upstream credentials are sealed (encrypted at rest); passwords are argon2-hashed.

Least visible

BCC is blanked in each recipient’s delivered copy, so recipients can’t see one another.

Instant invalidation

Deletion or ban takes effect immediately, checked every request; invalidated accounts can’t send or receive.

4. Data deletion

You can delete

You can delete mail and attachments, or delete your account, at any time.

Scheduled hard-delete

Deleted / soft-deleted data is hard-deleted by the self-heal after a retention period, including the physical attachment files — no orphan data left behind.

5. Local storage

Session

We keep a login token in your browser’s localStorage to maintain your session; remove it by signing out or clearing browser data.

6. Contact

Feedback

For privacy questions, email support@tutuemail.com.