TL;DR
emailforward.xyz is a free email alias forwarding service. We store only what's necessary to route mail: alias identifiers, verified recipient addresses, and (while the alias exists) the bodies of emails that pass through. No account, no ads, no tracking pixels in forwarded mail. The website uses Google Analytics for anonymous usage and conversion events.
Who this applies to
This policy covers every visitor to emailforward.xyz and every inbound message received for aliases on that domain. Creating an alias requires no account, so there are no authenticated user records for regular visitors.
What we collect
- Aliases you create. A random identifier on
@emailforward.xyz, plus timestamps. - Forwarding recipients. The email addresses or Telegram chat IDs you add, their verification state, and the tokens we issue to verify them.
- Inbound mail. For every message addressed to one of your aliases, we store headers and body until we've forwarded it — and only while the alias still exists, for history display. Before forwarding, each message is scored by an automated spam filter that checks its content, signatures, and the sender domains and links it contains against public blocklists, and its attachments are scanned for malware. The score is stored with the message. Nobody reads your mail as a matter of course: an operator opens a stored message only to investigate abuse, a delivery failure or a support request, and every such access is logged.
- Telegram chat state. When you pair a chat we record its Telegram chat ID and, for groups, the member who paired it.
- API tokens. When you create an API token we store a SHA-256 hash (never the raw token), the label you gave it, the email it's tied to, and usage timestamps. Revoke at any time from /manage-email.
- Custom domains. If you bring your own domain, we store the domain name, the verification token, and the email that owns it. We do not query your DNS beyond the one TXT lookup you ask us to perform on verify.
- Reply tokens. For every forwarded email we mint a short-lived routing token so you can reply through us without leaking your real address. The token maps to the alias and the original sender; it expires after 60 days.
- Cloudflare Turnstile. A challenge token is generated on alias creation. Cloudflare sees your IP while checking it.
- Abuse prevention. When you create an alias, add or verify a recipient, request a management link, or hit a rate limit, we record the IP address, approximate country and browser user agent of the request. We use this only to spot and stop abuse, and delete IP addresses and user agents after 30 days.
- Server logs. Standard web and mail server access logs — kept for 7 days and rotated.
- Website analytics. Google Analytics 4 records page views and product events (alias created, setup completed, recipient verified, and similar). We do not send email addresses, message bodies, or alias local-parts to Google.
What we don't collect
No account, no password, no personal profile. No advertising pixels. No marketing email — we don't have an email list because we don't have your email.
Third parties
- Our outbound mail provider sends verification, management and forwarded emails on our behalf and briefly sees the content in transit. It's a reputable commercial provider with a published privacy policy.
- Telegram — when you pair a chat, forwarded content is delivered to Telegram's servers via Bot API.
- Cloudflare — DNS, tunnel and Turnstile challenge.
- Google Analytics — measures visits and product events on the website. Advertising signals and ads personalization are off. Google's privacy policy applies to data it processes.
Retention
Alias records and forwarded-message bodies persist until you delete the alias, at which point the row is removed. Recipient verification tokens expire in 24 hours. Management links expire in 24 hours.
Your rights
You can delete any alias at any time from /manage-email, and recipients can unsubscribe via the link in every forwarded email. For a full data export or out-of-band deletion, email privacy@emailforward.xyz.
Location & law
The service operates under GDPR. Processors listed above see only what they need to run the product. We respond to lawful orders through established EU channels.
Changes
If this policy changes materially, we'll bump the "last updated" date at the top and post a note on the homepage for a week.