Privacy policy

01. About this policy

Dispatch is a webmail application that connects you to your existing email accounts. This policy explains how this Dispatch service processes information when you visit the site, sign in, connect a mailbox, or contact us.

Your email provider operates separately from Dispatch and has its own privacy policy. If you use a Dispatch installation managed by another organization, that organization controls its hosting, access, and data handling; contact its administrator for details.

02. Information we process

• Account information: your name, email address, password hash, authenticator setup, and hashed recovery codes.
• Workspace information: your user role, saved contacts and favorites, mailbox sharing permissions, selected shared accounts, and sidebar preferences.
• Mailbox connection information: account names, email addresses, mail server settings, usernames, encrypted mailbox credentials, and signatures.
• Email content: senders, recipients, subjects, message bodies, attachments, folders, message flags, drafts, quick responses, and outgoing mail status.
• Security and operational information: sign-in events, IP addresses, browser information, session records, connection errors, and service health metrics.
• Correspondence: your email address and the information you choose to include when contacting us.

03. How information is used

We use this information to authenticate users, synchronize connected mailboxes, display and organize messages, save drafts, send email at your request, and respond to support inquiries. Security events and operational information help us prevent unauthorized access and investigate service problems.

With your permission, Google Analytics helps us understand visits to the public pages. It is not loaded in the mail workspace or administrator pages. Mail content is used to provide the mailbox features you request, not for analytics or advertising.

04. Connections and sharing

When you share mailboxes, the users you select can access those mailboxes according to the permissions you grant. Shared access may include reading messages and attachments, sending messages, organizing mail, or moving messages to Trash. You can change or revoke the share from Mailbox sharing.

Dispatch connects to the email servers you configure to receive and send messages. Sending email shares its content and attachments with the recipients you select and the mail providers involved in delivery. The server hosting this installation stores the data needed to provide the service.

Remote images in received messages are blocked by default. If you choose to load them, your browser contacts the image host, which may receive your IP address and learn that the message was viewed. Opening external links also takes you to services with their own privacy practices.

Attachments are scanned by the antivirus service configured for this installation. Support correspondence is processed through our email provider. Information may also need to be disclosed where applicable law requires it.

05. Cookies and security

Your browser also stores shared mailbox ordering and the storage panel preference locally for your account. Mail view URLs include the current mailbox, filter, search text, page, and selected message identifier; these can appear in browser history and in links you copy.

Dispatch uses essential cookies to keep you signed in and protect requests against forgery. Initial administrator setup also uses a short-lived setup cookie. These cookies support authentication and security; they are not used for advertising. Blocking them can prevent sign-in and mailbox actions from working.

Google Analytics (measurement ID G-27S55TMZXW) runs on public pages only if you accept analytics. It can receive the page address, browser and device information, and network information such as your IP address. Google may use analytics cookies to recognize visits. Choosing Essential only leaves the Google tag unloaded; advertising consent remains disabled. Your choice is stored in this browser and can be changed through Cookie settings in the footer. See Google's privacy policy for Google's handling of this data.

User and administrator sign-in requires a password and authenticator verification or a recovery code. Mailbox credentials and authenticator secrets are encrypted in storage; account passwords and recovery codes are hashed. Message content and attachments are stored on the installation's server and are not end-to-end encrypted by Dispatch. No system can guarantee absolute security.

06. Storage and deletion

Messages, drafts, attachments, account records, and security records are stored on the server running Dispatch. Removing a mailbox connection stops its use and replaces its stored credential, but does not by itself erase all previously synchronized mail or delete anything from the email provider.

Messages and drafts moved to Dispatch's Trash are scheduled for local deletion after 90 days, or can be removed earlier with Empty Trash. Provider copies and server backups are managed separately. Other stored records do not have a universal automatic deletion period in the application.

Contact us to request deletion or to ask about the retention and backup arrangements for this service. We will explain what can be removed, any records that must be retained, and any relevant limitations before acting on the request.

07. Your choices and requests

You can remove connected mailboxes, sign out of the current device or all devices, and choose whether to load remote images. You can contact us to request access to, correction of, or deletion of your information, or to raise a privacy concern. Depending on the law that applies to you, additional rights may be available.

We may need to verify your identity before providing account information or acting on a request. Please do not send passwords, authenticator codes, or recovery codes by email.

08. Contact and updates

We may update this policy as the service changes. The date at the top identifies the latest version.

See also our Terms of service.