Privacy
The short version is the whole version.
POBox51 exists to collect a room's contact details, send everyone one contact file, and then delete what it collected. It is run by Pivot Drive Inc., a company in Canada. This page says exactly what that means: what is kept, for how long, who else sees it, and what to do about it. The numbers below are read from the running configuration, so they are the numbers the service actually uses.
What a room keeps
When someone emails a room's address, we keep three things about them: the name on the message, the email address it came from, and a phone number if they put one in the message or attached a contact card. Nothing else from the message survives — not the text, not the subject, not attachments, not the photo inside a contact card.
The message itself is kept only long enough to read those three fields out of it. It arrives in storage we hold with Amazon, and the message you sent us is deleted as soon as we have read it — normally within seconds. A rule on that storage deletes anything still there after 1 day, in case a deletion ever fails. The working copy we read the fields from is gone as soon as they are out: at most 60 minutes, and normally seconds.
If you host a room, we keep the name and email address of your account, so we can sign you in and send you the contact file, and the room's own record: its address, when it ran, and how many people joined.
While a room is open it also remembers two rough facts about where its host is: the country, so a phone number written without a country code is read correctly, and the time zone, so the emails can say when the room closes in the room's own time. Both are deleted with everything else.
We ask for nothing else. There is no location beyond that country and time zone, no address book, no device identifier, no advertising profile, and no tracking pixel or click tracking in any email we send.
How long it lives
We delete everything we collected within 15 minutes of sending your contact file. What is deleted is every person's name, address and number — not a mark saying "deleted", the rows themselves. What remains afterwards is the room's shell: its address, its times, and how many people joined. Nobody is in it.
Two exceptions, both bounded:
- If we could not deliver the contact file to the host, the room's details are kept for 72 hours from the moment it closed, so the send can be retried, and are then deleted whether or not it succeeded.
- A room's address cannot be reused by someone else for 30 days after it is deleted, so a message sent late to an address you gave out cannot land in a stranger's room.
Records that contain no personal data are kept for a while and then deleted: what happened to each message a room received and to each email we sent, for 30 days, and what an administrator did, for 90 days.
The mail service that carries messages may keep copies to protect against spam and malware. That service is Amazon, which carries the mail in both directions and does not say how long it keeps them. Mail you send to our support address is forwarded to us by Cloudflare. We cannot delete copies that others hold, and we will not claim otherwise: when we say we have deleted everything, we mean everything we hold.
Backups
We do not back up the database yet. If it were lost, hosts would need to create their accounts again, a room collecting at that moment would lose the people who had already joined — they would have to email again — and the locks that stop a finished room's address being reused would be lost with it. A room that has already finished would lose nothing: its contact files have gone out, and its details are deleted within 15 minutes of that anyway.
When we start backing up, each backup will be kept for at most 7 days. If we ever had to restore from one, deletion would be re-run against what was restored, so nothing that had been deleted comes back to life.
Who else sees it
We use a small number of companies to run the service. They process data on our instructions and nothing more; none of them is allowed to use it for their own purposes.
| Who | What they do | What they receive |
|---|---|---|
| Railway | Runs the application and hosts the database | Requests to the site, including the IP address they came from, and everything a room holds for as long as it holds it |
| Amazon Web Services | Carries the mail both ways: Amazon SES receives every message sent to a room and delivers every email we send, and Amazon S3 holds each incoming message until we have read it | The messages themselves, including names, addresses, numbers and the contact file — and Amazon may keep copies to protect against spam and malware |
| Cloudflare | Runs the domain name that points to the service, and forwards mail sent to our support address | Lookups of our domain name, and any email you send to support@mail.pobox51.com |
| Sentry | Reports errors so we can fix them | Errors with names, addresses and numbers stripped out before they are sent |
| Signs you in, if you choose that way | Your email address and name, from your own Google account |
The mail is handled in Amazon's Canadian region. The other companies may process data outside Canada, including in the United States. We do not sell data, and we do not share it with anyone not on this list.
What the room's page shows
While a room is open, anyone who scans its QR code or opens its page sees five things: the room's name, the host's first name, how many people have joined, when the room closes, and the address to email. That is what a host is choosing to put on a screen in front of a room, and the set-up screen says so before the room opens.
We count how many times a room's page is opened. It is one number for the room. Nothing about who opened it is kept: no cookie, no address, no device.
No guest's name, address or number is ever on that page. Once the room closes, the page shows only that it has closed — the same page an address that never existed gets, so it cannot be used to find out whether a room is real.
If you host a room
Your account exists so we can sign you in and send you the file. You can change the name we show on the contact cards you hand out, and you can delete the account at any time from your account page. Deleting it removes your sign-in, your sessions, and every room you hosted, within a minute. The addresses of the rooms you ran stay locked for their cooldown so nobody else can pick them up, with nothing left in them that points to you.
If you emailed a room
There is nothing to delete and no account to close: after the contact file is sent, nothing about you remains here. Before then, email us and we will remove you from the room straight away. Every message we send you says what we kept, for how long, and when it was deleted.
If something goes wrong
If personal data we hold is ever exposed, we will tell the people affected within 72 hours of confirming it, and the Office of the Privacy Commissioner of Canada as well whenever it creates a real risk of significant harm. We keep a record of every breach, whether or not it had to be reported.
Changes and questions
If this policy changes we will say what changed and when, on this page. If you want to know what we hold, or want it gone, write to support@mail.pobox51.com — a person reads it and replies within a day or two.