Privacy Policy

Your Privacy Matters

Bottled is committed to protecting your privacy. This policy explains what data we collect and how we use it to provide our email forwarding and sending service.

Data We Collect

To provide our service, we collect and store:

• Google Account Data: Your name, email address, and profile picture via Google OAuth for authentication
• Domain Information: Domains you register and their DNS verification status
• Email Addresses: Custom email addresses you create and their forwarding destinations
• Email Metadata: Basic information about emails you send and receive (sender, recipient, subject, timestamp) for logging purposes
• Payment Information: Subscription status and plan tier are stored in our database. Payment details are processed by Stripe; we never store credit card numbers
• API Keys: Stored as SHA-256 hashes in our database. Raw API keys are shown only once at the time of generation
• Usage Metrics: Monthly sent and received email counts, and API call counts, tracked per your plan tier for limit enforcement
• Referral Tracking: If you arrive via a referral link, a cookie is stored for 30 days to attribute your sign-up to the referrer. No personal data is collected before you sign in

Email Content

We do not store the content of emails you send or receive:

• Incoming emails are forwarded via Cloudflare Email Routing directly to your destination address
• Outgoing emails are sent via our email infrastructure and are not stored on our servers
• Email content passes through but is not retained or analyzed

Email Content Modification

Outgoing emails sent on the Starter plan include a small branded footer appended to the message body. This footer is automatically removed on paid plans (Essentials and Pro).

Contacts & CRM

If you use the built-in CRM, we store the contact information you provide (name, email, company, phone, tags, and custom fields). Engagement scores are calculated from your email activity logs and updated periodically. Contacts are scoped to your account and are never shared with other users or third parties. Deleting a contact permanently removes all associated data, including notes and list memberships.

Campaign Tracking

Email campaigns sent on the Pro plan may include tracking pixels and wrapped links to measure open and click activity. When a recipient opens an email or clicks a link, we record the event type, timestamp, user agent, and approximate location (IP address). This data is used solely to report campaign performance to the sender. Recipients can opt out via the unsubscribe link included in every campaign email.

Push Notifications

You may opt in to browser push notifications. When you subscribe, we store your device's push endpoint and VAPID keys. We use this data only to deliver notifications you have requested (e.g. new inbound email, domain verified). You can unsubscribe at any time from your browser or account settings, which permanently removes the stored endpoint.

Data Retention

Email history (metadata only, not content) is retained based on your plan tier:

• Starter (Free): 3 days
• Essentials: 30 days
• Pro: 90 days

After the retention period, email log entries are permanently deleted and cannot be recovered. Account data is retained while your account is active. If you delete your account, we will remove your personal data within 30 days, except where required by law to retain it.

Payment Processing

Payments for paid plans are processed by Stripe, Inc. We receive subscription status updates but never access or store your full payment details. For more information on how Stripe handles your data, please review Stripe's Privacy Policy.

Third-Party Services

Bottled uses the following third-party services:

• Google OAuth: For user authentication
• Cloudflare Email Routing: For receiving and forwarding emails
• Email delivery provider: For sending emails
• Stripe: For payment processing
• Neon PostgreSQL: For storing account and configuration data
• Vercel: For hosting and privacy-friendly web analytics (page views, no cookies, no personal data)
• Sparkbrain: For in-app chat support

Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS
• Database connections use encrypted connections
• Authentication tokens and API keys are securely hashed
• Access to production systems is strictly controlled

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data

Contact

For privacy-related questions, please contact us at privacy@bottled.email.