W is a webmail service operated by Sitemapp, Inc. (“we”, “us”). This policy explains what we collect when you use app.wemail.xyz, why we collect it, how long we keep it, and how you can delete it.
We built W so people can send email with less noise and more privacy. That means we deliberately collect the minimum data needed to run the service, and we don’t sell it, advertise on it, or share it with data brokers.
1. What we collect
When you create an account and use W, we store:
- Your email address — used to send you a one-time verification code at signup and, later, to reset your password.
- Your password — stored only as a bcrypt hash. We cannot read your password even if we tried.
- Your @w.xyz handle and display name — what appears on outgoing mail.
- Your recovery email — optional. Only stored if you provide one at signup or in Settings.
- Your mail contents — the emails you send, receive, save as drafts, attach files to, or delete.
- Your chat contents — end-to-end encrypted messages between you and other W users.
- Your IP address — used briefly (in-memory, per request) for rate limiting and bot protection. Not persisted with your account.
- Basic usage timestamps — account creation date, last-seen time, mail read/sent counts (aggregate only).
We do not collect device fingerprints, cross-site trackers, advertising IDs, or your browsing history outside W.
2. Third parties we use
To operate the service we share the minimum data required with:
- MongoDB Atlas — encrypted-at-rest database that stores everything above. Data lives in the region tied to your cluster.
- AWS SES — delivers outgoing email and receives inbound email on your behalf. SES sees the same envelope data (from/to/subject/body) any email provider does.
- Mailgun — delivers our outbound email, including your verification and password-reset codes. Mailgun sees the sender/recipient addresses and the message contents.
- Cloudflare — DNS and DDoS protection. Cloudflare sees your IP and request headers, standard for any web service.
- Anthropic (Claude) — powers the in-app AI features (smart reply, summarize, subject suggest, thread digest) via API. Zero data retention: Anthropic does not store your prompts or use them to train models. Content is sent only for the specific mail you tap the AI on, and only when you tap. See section 3 below.
- Sentry — anonymized error tracking. We strip user emails, phone numbers, and message bodies before anything reaches Sentry.
- Cloudflare Turnstile — We use Cloudflare Turnstile to protect against spam and abuse. Turnstile may collect limited browser and interaction data to verify human users. See Cloudflare’s Privacy Policy at cloudflare.com/privacypolicy for details.
We do not use analytics vendors (Google Analytics, Mixpanel, Segment, etc.).
3. AI features & your privacy
W is an AI-native app, but privacy comes first. Here’s exactly what happens when you tap an AI feature:
- You are in control. AI features run only when you tap them. Smart-reply chips fetch when you open an inbound mail; Summarize, Subject suggest, and Thread digest run only on your explicit tap.
- Zero retention. We call Anthropic’s Claude API with Zero Data Retention enabled. Anthropic does not persist your prompts or completions beyond the milliseconds needed to generate a response.
- No training on your data. Anthropic’s API terms explicitly prohibit training on customer inputs. W also does not train, fine-tune, or evaluate any model on your mail or chats. Ever.
- Minimum content. We send only the specific mail body (or, for Thread digest, the thread transcript) that’s needed to answer your tap. We don’t send your other mail, contacts, or account metadata.
- End-to-end encrypted chats are excluded. W-to-W chat messages never touch AI — we couldn’t decrypt them even if we wanted to.
- You can turn AI off. Settings → AI privacy disables every AI feature for your account. When off, nothing leaves W for AI processing, and the AI surfaces disappear from the UI.
4. How long we keep it
- Account data (handle, password hash, recovery email) — kept until you delete your account.
- Inbox mail — kept until you delete it, or until Ghost mail auto-deletes it (24 hours after arrival, if you have Ghost mail on).
- Sent, drafts, and trash — kept until you delete them.
- Chat messages — end-to-end encrypted; retention follows your chat settings.
- SMS verification codes — deleted within minutes of use, or after they expire.
- Rate-limit and login IP records — held in memory only; wiped on server restart (typically hours).
- Database backups — encrypted snapshots retained by MongoDB Atlas for 7 days, then permanently deleted.
5. Your rights
You can, at any time, from Settings inside the app:
- Access — read everything we store about you.
- Correct — update your name, handle, or recovery email.
- Deactivate — pause receiving mail without losing your data. Reversible.
- Delete — see section 5.
If you’re in the EU/UK you have the same rights under GDPR — access, rectification, erasure, portability, restriction, objection. Submit requests from Settings → Send feedback and we’ll respond within 30 days.
6. Deleting your account
In Settings → Account → “Delete account”, you confirm with your password and type DELETE. When you confirm:
- Your user record, mail, drafts, and chat memberships are removed from the live database immediately.
- Encrypted database backups age out on the standard 7-day retention window, after which no copy of your data remains anywhere.
- Mailgun and Twilio hold minimal delivery logs (message-IDs, timestamps) for up to 30 days per their own retention policies, then delete them.
If you can’t sign in and need us to delete your account, use Forgot password on the sign-in page to regain access, then delete your account from Settings.
7. Security
All traffic uses HTTPS with HSTS. Passwords are hashed with bcrypt (never stored in plaintext or reversibly encrypted). Login is rate-limited and bot-checked. We deliberately don’t read your mail — no scanning for ads, no ML training on your content, no scraping. AI features are opt-out at Settings → AI privacy; see section 3 for how they work.
8. Kids under 13
W is not designed for children under 13. Don’t create an account if you’re under 13.
9. Changes
If we change this policy in a material way, we’ll email a heads-up to your recovery email (or your @w.xyz inbox if none) at least 14 days before the change takes effect. The “Last updated” date at the top always reflects the current version.
10. Contact
Questions or requests: use Settings → Send feedback inside the app.