Privacy Policy

UseOneInbox is the unified email client available at useoneinbox.com (the “Service”), operated by Payon Finance Inc. (“we”, “us”). This policy applies to anyone who creates an account or otherwise uses the Service. For any question about this policy or your data, contact us at just@useoneinbox.com.

We collect only what the Service needs to function:

• Account information: your email address, a hashed (not plaintext) password, and an optional display name.
• Mailbox connection details: the mail server address you connect, your mailbox username, and either an app password or an OAuth token — encrypted (AES-256-GCM) before it is written to disk.
• Synced mail content: messages, attachments, and folder metadata fetched from the mailboxes you connect, so the Service can display and search them.
• Billing information: if you purchase an add-on pack, payment is handled entirely by Suby.fi (our payment processor, which supports card, wallet, and crypto payments), with Stripe kept as a backup processor — we never see or store your card number or crypto wallet's private keys. We keep only your processor customer ID and the number of packs on your account.
• Push notification data: if you enable notifications, your browser's push subscription endpoint and encryption keys, so we can deliver new-mail alerts.
• Login history: each time you sign in, we record your IP address (encrypted at rest), approximate location derived from it (city/country), device type, browser, and OS. This is kept for account-security visibility and rate-limiting/abuse prevention, retained for 90 days, and never sold or used for advertising.

• To connect to your mailboxes and sync, display, search, and let you send mail through them.
• To operate your account: authentication, billing, and support.
• To send you service email — password resets and, if you opt in, new-mail push notifications.
• To keep the Service secure, including rate-limiting and detecting abuse.

We do not use your mail content or account data for advertising, and we do not sell your data to anyone.

A small number of providers process data on our behalf, each only for the specific purpose below:

• Suby.fi — payment processing for add-on packs (card, wallet, and crypto). Its own privacy policy governs the payment details you give it directly. Stripe is kept wired as a backup processor and governed by the same principle if it's ever used.
• Resend — delivers transactional email (password resets) on our behalf.
• Microsoft — if you connect an Outlook/Hotmail mailbox via OAuth, Microsoft issues us a token scoped to read and send mail on that mailbox; we never see your Microsoft password.
• Your browser's push service (operated by Google, Mozilla, or Apple depending on your browser) — relays push notifications to your device if you enable them.

We do not run analytics trackers or advertising pixels on the Service.

• Mailbox passwords, OAuth tokens, and login-history IP addresses are encrypted with AES-256-GCM before they touch disk.
• Account passwords are hashed with bcrypt — we cannot see or recover your actual password.
• Access to the admin panel is restricted to a single authorized account, enforced server-side.

We keep your account and mailbox data for as long as your account is active. Removing a connected mailbox from the Service deletes its synced messages and attachments from our database — nothing on your actual mail server is touched. To delete your entire account and all associated data, email just@useoneinbox.com.

We use a single session cookie to keep you signed in. It is functional, not tracking-related — we do not use third-party advertising or analytics cookies.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. Contact just@useoneinbox.com for any of these requests.

The Service is not directed at children under 16, and we do not knowingly collect their data.

If we make material changes to this policy, we'll update the date at the top of this page. Continued use of the Service after a change means you accept the updated policy.