Privacy Policy
Last updated October 7, 2026
What we collect
- Account details you give us: email, name, company, contact and billing information and team details.
- Your mail: the content and metadata of messages sent and received through your Rebound addresses and mailboxes.
- Connected accounts: the address and an encrypted sign-in credential for any outside email account you connect. We read that mailbox live and do not store its messages.
- Security and usage records: sign-ins, session times and actions on your account, kept in a tamper-evident audit log.
How we use it
To run the service: deliver and store mail, authenticate you, enforce limits, detect and stop abuse, keep the service secure, meet legal obligations and send you service and security messages. We send product updates only if you opted in. We do not use the content of your mail for advertising and we do not sell your data.
How we protect it
Email bodies, attachments and connected-account credentials are encrypted at rest with keys Rebound holds (this is not end-to-end encryption: our servers decrypt mail to show it to you). Delivery details such as sender, recipient and subject, and team chat, calendar entries and support messages, are protected by access controls but not separately encrypted. Passwords are stored as salted hashes. Optional two-factor authentication is available. Access to production systems is restricted and logged.
Who we share it with
- Infrastructure providers (for example Amazon SES for delivery and our hosting and database providers), only to run the service.
- Providers you connect, such as Google, Microsoft or Yahoo, when you connect their accounts.
- Authorities and other parties when we receive valid legal process, when needed to enforce our terms or protect people from harm, or as otherwise required by law. We review requests for validity, disclose only what is needed, and notify you where the law allows.
Retention and deletion
While your account is active we keep your data. If you delete your account, your addresses are released immediately and you can restore it yourself for 90 days; we keep the data for up to 180 days in total and then permanently delete it. Data subject to a legal hold or a legal obligation is kept for as long as that hold or obligation requires. Security and audit records are kept as needed to protect the service and meet legal duties. Deactivating your account removes nothing.
Your rights
You can download a copy of your data yourself from Settings (once an hour), delete your account from Settings, and edit your details in the app. You may also ask us to access, correct, export or delete your data, and to object to or restrict some uses, by contacting us. Depending on where you live you may also have the right to complain to your data protection authority. We will respond within the time the law requires.
Children
Rebound is not for anyone under 18 and we do not knowingly collect their information.
International transfers and changes
Our providers may process data in other countries, protected by appropriate safeguards. We will post changes to this policy here and tell you about material ones.
Questions: contact support or email support@reboundrelay.com