01
What we collect#
The botinbox.dev website and dashboard use Vercel Web Analytics and Speed Insights (anonymous page views and Core Web Vitals, no cookies) and PostHog product analytics: page views, clicks, and product events such as joining the waitlist, signing up and signing in, creating an inbox or API key, connecting an MCP client, adding or verifying a domain, sending or receiving your first message, and starting, changing or cancelling a subscription. When you sign in, analytics is linked to your account: your account id, your account email address, your plan, account type and role.
02
What we never collect#
No email content: subjects, bodies, and attachments never reach an analytics provider. No recipient lists, addresses your agents send to or receive from, API keys, or webhook secrets; your own account email is the only address PostHog receives, as part of your account profile, never inside an event. Events carry ids, plans, counts and yes/no flags: for example message_sent carries only the plan, the delivery route, whether it was a reply, and the recipient count. On-screen text is masked in click tracking, and URL query strings (such as mail search terms) are stripped before anything is sent. The REST API, MCP server, and CLI load no analytics code; server-side events are recorded by BotInbox itself with the same rules.
03
Do Not Track and session replay#
If your browser sends Do Not Track, PostHog captures nothing in your browser. Session replay is off; if it is ever enabled, every input and text node is masked and network bodies are not recorded. Analytics traffic goes through a first-party /ingest proxy on botinbox.dev, so no third-party scripts or connections are added to the page.
04
Privacy policy#
The full privacy policy at /legal/privacy covers what BotInbox stores to run the service, how long it is kept, subprocessors, and your rights. Questions go to privacy@botinbox.dev.