CarlyEmail is an email API. Handling your mail is the product, so this describes what that means concretely rather than in the abstract.

What we store

Email content. Messages you send and receive: envelope, headers, subject, body in both text and HTML, and attachments. Raw inbound MIME is written to object storage; parsed messages and their metadata are stored in our database. We store this because an email API that could not show you your email would not be one.

Account data. The owner email address you sign up with, your organization, its pods and inboxes, and your plan.

Credentials. API keys are stored only as a SHA-256 hash — we cannot recover or display a key after it is created. One-time verification codes are stored salted and hashed with scrypt. If you connect over MCP we store the identifier your authorization server gives us, so a reconnection resolves to the same account.

Delivery events. Sends, deliveries, bounces, complaints and rejections, recorded per organization. Suppression entries derived from bounces and complaints. This is what keeps one tenant's reputation problem from becoming everyone's.

Operational logs. Request metadata — method, path, status, timing, request id. We deliberately do not log request or response bodies, so message content does not end up in logs. Authentication logs record the kind of credential presented, never its value; token rejections record the JWT header, never the payload or signature.

What we do not do

• We do not sell your data, and we do not share it for advertising.
• We do not use the contents of your mail to train models.
• We do not read your mail except where you ask us to act on it through the API, or where we must investigate a specific abuse report or support request you have raised.

How long we keep it

Deleting an inbox deletes its messages. Closing an account deletes organization data; write to support and we will confirm when it is done.

Sub-processors

We run on infrastructure we do not own, in a dedicated AWS account (us-east-1):

We do not use third-party analytics or advertising trackers on the API.

Security

• Everything is served over HTTPS. The API is not reachable over plain HTTP.
• API keys are hashed; verification codes are salted and passed through a slow key-derivation function so that holding the stored value is not holding the code.
• Inbound webhooks are signed and every notification we accept is signature- and origin-checked before it is processed.
• Access tokens for the MCP endpoint are audience-bound, so a token issued for another service cannot be spent here.
• Inbound mail carries its SPF, DKIM and DMARC verdicts. Mail that fails authentication is labelled and withheld from default listings rather than presented as genuine.

See security for more.

Your data, your control

You can export or delete anything through the API — messages, threads, inboxes, keys. There is no data we hold that the API will not show you.

For access, correction or deletion requests, or any question about this policy, write to support@carlyemail.com.

Changes

We will update the date at the top when this changes. Material changes will be announced to the owner email on file before they take effect.