Cookie &
tracking policy.
What we store in your browser, why it exists, and the tracking technologies we deliberately do not use.
Effective Date: October 14, 2026 Last Revised: October 14, 2026 Jurisdiction: Digital Personal Data Protection Act, 2023 (India) and the GDPR
This policy explains how maildx ("we", "us", "our") uses cookies and similar technologies on our website and application.
1. The short version
maildx uses one cookie. It exists to keep you signed in. We do not use advertising cookies, analytics cookies, social media pixels, fingerprinting scripts, or any third-party tracking technology.
We deliberately do not operate a cookie consent banner, because there is nothing optional to consent to. A single strictly-necessary authentication cookie is exempt from prior consent under the GDPR (Article 5(3) ePrivacy) and is not "tracking" under the DPDP Act.
2. The cookie we set
| Name | Type | Purpose | Contents | Lifetime | Flags |
|---|---|---|---|---|---|
maildx_session | Strictly necessary | Authenticates your API requests and keeps you signed in | A signed session token containing your user ID, company ID, email, and role. No advertising or behavioural data. | Set at sign-in; expires after 7 days; cleared on sign-out | HttpOnly, SameSite=Lax, Secure in production |
What each flag means for you:
- **
HttpOnly** — JavaScript on the page cannot read the cookie, which removes it as a target for cross-site scripting attacks. - **
SameSite=Lax** — the cookie is not attached to cross-site POST requests, which blocks cross-site request forgery. - **
Secure** — in production the cookie is only ever transmitted over HTTPS.
The session cookie is not used to build a profile, is not shared with advertisers, and is not sold.
3. Technologies we do not use
To be unambiguous, maildx does not currently use:
- Analytics or product-usage platforms (for example Google Analytics, Mixpanel, PostHog)
- Advertising or retargeting pixels (for example Meta Pixel, Google Ads)
- Session recording or heatmapping tools
- Cross-site tracking, device fingerprinting, or identity graphs
- Social media plugins that report your visit to third parties
- Third-party chat widgets or A/B testing scripts
This is deliberate, and it is enforced as a project rule: no analytics, tracker, or third-party script may be added without a recorded architectural decision and a privacy review.
4. Local storage
We use your browser's localStorage for interface preferences only — currently, remembering whether you collapsed the workspace sidebar. This data stays on your device, is never transmitted to our servers, and contains no personal data. Clearing your browser storage simply resets the preference to its default.
5. Server-side logs
Our API records technical request data (IP address, user agent, timestamps, and endpoint) for security and audit purposes. This is server-side logging, not client-side tracking, and it is described in our Privacy Notice.
6. Where cookies are not involved
Emails processed by maildx are delivered through our email provider and are not tracked with cookies or open-tracking pixels. maildx does not insert tracking pixels into outbound support replies.
7. Managing cookies
You can control or delete cookies through your browser settings. Because maildx_session is the mechanism that keeps you authenticated, blocking or deleting it will sign you out and you will not be able to reach the workspace until you sign in again.
Browser guidance: Chrome, Firefox, Safari, Edge.
8. If this changes
If we ever introduce an analytics or advertising technology, we will update this policy, publish the change before it takes effect, and introduce a genuine consent mechanism with an opt-out that is as easy as opting in. Customers on a paid plan will additionally be notified through the workspace.
9. Contact
Questions about this policy, or about any cookie you observe that is not listed above:
- Email:
privacy@maildx.dev - Grievance Officer: see the Contact & Grievance page
If you find a cookie we have not disclosed, please tell us — we would rather fix it than argue about it.