Mail Housekeeper

Privacy, terms and refunds

Written in plain words. Last updated November 8, 2026. Every promise on this page is one the software already keeps.

Privacy policy

Who is responsible

Mail Housekeeper is an independent service run by its founder from Dallas, Texas, United States. We decide how and why your data is handled, which makes us the data controller under European law. For anything about your data, write to [email protected]. We answer within one business day.

What we collect

  • Your account: the email address you sign in with, the time of each sign-in, whether you ticked "Send me tips and offers", and the invite code you used, if any.
  • The waitlist: if you join it while sign-ups are closed, we keep your email address, when you joined, your country from the connection and the campaign tags that brought you, only to send the confirmation and one email when seats open. Every one of those emails has a link that removes you from the list in one click.
  • Your mailbox connection: the mailbox address, the provider, and the app password you give us. The app password is sealed with AES-256-GCM before it reaches the database and is unsealed only inside the worker at the moment it opens your mailbox.
  • Message headers: for each message in the folders we clean, the sender, the subject line, the date, the read flag, the unsubscribe headers and the authentication results. Before an unsubscribe we read the first 24 KB of one message from that sender to confirm the link; that sample is used on the spot and never stored.
  • What we never collect: message bodies and attachments are never read or kept, apart from that one unsubscribe sample. We do not read your contacts, your calendar or your sent mail beyond the addresses you have written to, which only tells the sorter who your people are.
  • Filing what you keep: Organize sorts kept mail into folders using the same headers already read for the cleanup. No new data is collected; we only note which folder each filed message went to, so the filing can be undone.
  • Your decisions and our work: the pile you chose for each sender, each run's counts and timing, and a ledger of every move by message id, so any move can be undone and explained.
  • Payments, once billing is on: Stripe handles cards and bank details. We never see your card number; we keep the payment id, the amount and whether it was paid or refunded.
  • Technical: your IP address, held in memory for fifteen minutes to limit sign-in link requests, and the short request logs our hosting provider keeps. Our cookies and our own visit counter are described under Cookies and visit counting below. The site also stores small conveniences in your browser, such as a dismissed card.

Cookies and visit counting

We run our own page-view counter on our own server, with no third-party analytics script. For each visit we keep the page, the referring site, the campaign tags in the link you clicked, your country from the connection and a device class, never your IP address or your browser's identifying string.

  • The session cookie keeps you signed in. It is set only when you sign in and lasts up to thirty days. The site cannot work without it.
  • The visitor cookie, named mh_vid, is our own first-party cookie, set by our server, and page scripts cannot read it. It holds a random id and lasts up to thirteen months, counted from your latest visit. It is used for two things only: to tell a returning visitor from a new one, and, when you sign in, to attach the source that brought you to your account, so we know which video, link or friend it was. The id never leaves our servers. A copy of the same random id sits in your browser's storage as a fallback.
  • In the European Union, the EEA, the United Kingdom and Switzerland a small bar asks first. Until you choose, visits are counted without a cookie: a fresh random number for each page load, nothing stored in your browser, nothing tied to you and nothing sent to an ad network. Allow sets the visitor cookie from then on. Your choice is remembered in your browser's storage, which is needed to remember it, and we ask again after thirteen months.
  • Everyone can change their mind with Your privacy choices at the bottom of every page. No thanks clears the visitor cookie, stops this browser from being identified, and drops the ad click id kept for your visit, so nothing about it reaches an ad network afterwards.
  • Global Privacy Control or Do Not Track turns the counter off entirely: no cookie, and nothing is sent.

Why, and on what legal basis

  • To run the service you asked for (contract): opening your mailbox, sorting, moving, unsubscribing, emailing you when a wave needs you or a cleanup is done.
  • To keep the service safe and improve the sorting rules (legitimate interest): limiting abuse, counting visits and knowing which video or link brought you (in the European Union, the EEA, the United Kingdom and Switzerland the visitor cookie is set only with your consent), finding where the recommendations get overruled, which unsubscribes fail, and which provider is slow. This work looks at senders and counts, never at your mail.
  • To send tips and offers (consent): only if you ticked the box. Every such email has an unsubscribe link that works, and you can untick the box on your Account page at any time.

What we never do

  • Nothing is deleted by the software. Everything cleared goes to a folder in your own mailbox named Housekeeper hold. Moving that folder to Trash happens only from a button you confirm, or from a timer you set yourself. On Yahoo and AOL a deep clean may also park mail you are keeping in a second folder, Housekeeper keep, which is always brought back and never emptied.
  • We do not open links inside your mail. Unsubscribes go through the mail header only, the way Gmail and Yahoo do it.
  • We do not sell your data, share it with advertisers or data brokers, train anything on your messages, or use it to email you about anything but your mailbox.
  • The admin tools show sender-level activity and pile choices only. Subject lines and contents are not shown to the team.
  • No decision is made about you by a machine alone. The sorter recommends a pile; you decide. Autopilot for later waves is off until you turn it on, and even then everything cleared stays in your holding folder.

Learning from choices

When you override a recommendation, we record the rule that produced it and the pile you chose for that mailbox. Across all users we keep counts per sender and per rule, such as how often a rule gets overruled, to improve the defaults. Those counts name senders, never people.

Who else sees it

Only the people and services it takes to run Mail Housekeeper:

  • Our founder, who runs support and the admin tools described above.
  • Railway (United States) hosts the servers and the database.
  • Resend (United States) sends our emails and receives the replies to them.
  • Cloudflare provides DNS and sits in front of the site to block attacks.
  • Stripe (United States) processes payments once billing is on.
  • TikTok, only when you arrive from a TikTok ad and have not said No thanks: we report that the ad led to a sign-up, a connected mailbox or a finished cleanup, using the click id from the ad link and a scrambled random id, never your email and never anything from your mailbox.
  • Your mail provider, which we reach with the app password you gave us, over an encrypted connection.

Each of these works under a data processing agreement and handles your data only on our instructions. We would disclose data to a public authority only if the law required it, and we would tell you unless we were forbidden to.

Where it lives and how long

  • Data is stored and processed in the United States. If you are in the European Union, the United Kingdom or Switzerland, your data leaves your region; the providers above commit to the standard contractual safeguards for that transfer in their agreements with us.
  • Your account and everything under it stay until you delete the account or ask us to. Sign-in links expire after twenty minutes. Unsent sign-in link limits clear after fifteen minutes.
  • Payment records are kept for as long as tax law requires, currently seven years in the United States.

Your rights

Wherever you live, you can see what we hold about you, correct it, get a copy, restrict or object to how we use it, withdraw consent, and have it deleted. In the European Union and the United Kingdom these are legal rights; we extend them to everyone. To use them, delete your account from the Account page, or write to [email protected]. We answer within one business day and act within thirty days at most. If you are in the EU or the UK and think we got something wrong, you may also complain to your local data protection authority.

Delete your account and it is gone

Account, mailbox connections, sealed passwords, headers, decisions and logs are removed within minutes. Your mailbox itself is untouched: the holding folder and everything in it stay in your mail where you can see them. You can also cut our access at any moment by deleting the app password at your provider.

Security

Connections to the site, to our servers and to your mail provider are encrypted in transit. App passwords are encrypted at rest with a key that lives only on the servers. The database has no public address. One person has administrative access. If a breach ever affected your data we would tell you and, where required, the authorities, within seventy-two hours of learning of it.

Children

Mail Housekeeper is for adults and people aged sixteen or over. We do not knowingly keep data about anyone younger; write to us and we remove it.

Changes

When this page changes we update the date at the top. If a change affects what we collect or how we use it, we email every account before it takes effect.

Terms

  • Who you are dealing with. Mail Housekeeper is an independent service run by its founder from Dallas, Texas, United States. Questions go to [email protected].
  • What the service does. Mail Housekeeper moves mail between folders inside your own mailbox, on your instructions, and sends unsubscribe requests through the mail header for senders you put in the Unsubscribe pile. You own the mailbox and the decisions.
  • Nothing is deleted by the software. Clearing means moving to the holding folder. Emptying that folder to Trash happens only when you confirm it or set a timer for it. Your mail provider then applies its own Trash rules, which we describe but do not control.
  • Unsubscribes are requests. We send them only to senders the checker verifies and only once. We cannot promise a sender honors the request; senders that ignore it are held on every later round instead.
  • Waves and limits. How long a cleanup takes depends on your provider's limits. We do not promise an empty inbox by a date.
  • Recent mail and undo. Mail newer than the mailbox's recent-mail setting (48 hours by default) is never moved or parked. Every run is logged by message id and can be undone; undone moves are verified against the server like the originals.
  • Your account. You must be sixteen or older. One account per person. Sign-in links are personal; do not forward them. Connect only mailboxes you own or have permission to clean.
  • Your app password. Keep it to yourself and revoke it if you stop using the service. If the sign-in stops working, the mailbox pauses and nothing runs until you fix it.
  • Prices. During the launch trial every step is free. After it, the free scan is one per mailbox address, the sort ($8) covers one mailbox through to done plus 30 days of nightly upkeep, and upkeep plans renew until you cancel; the current period runs out and nothing is charged after that. Prices include any tax we are required to collect.
  • Fair use. No automated access to our pages, no scraping, no reselling the service, no connecting mailboxes you have no right to.
  • Plain limits. We provide the service with care, during a launch period, as it is. We are not responsible for mail your provider removes from Trash after you chose to empty the holding folder, for a sender that keeps writing after an unsubscribe, or for a provider blocking access. If something we did goes wrong, every move is logged by message id and we help you put it back. Where the law lets us limit liability, our total liability to you is the amount you paid us in the twelve months before the claim. Nothing here limits rights that consumer law gives you and that cannot be waived.
  • Ending it. You can delete your account at any time. We may close an account that breaks these terms, after telling you why, and we refund any unused paid period.
  • Law. These terms are governed by the laws of the State of Texas, United States, except where the consumer law of your home country gives you stronger protection, which then applies. If we change these terms in a way that affects you, we email every account before it takes effect.

Refunds

Not happy with the sort? Write to us within 14 days of paying and we refund the $8, no questions. This also covers the 14-day right of withdrawal that applies to consumers in the European Union and the United Kingdom. Upkeep plans can be canceled any time; the current month or year runs out and is not refunded in part.

How to reach us: [email protected], or the Support page.