Privacy

1code Mail · Effective 20 October 2026

In short

Your mail is yours. We store it to deliver it to you, and we don't read it, sell it, advertise with it or use it to train AI.
There are no passwords: you sign in with 1code ID on your phone.
1code Mail has no advertising, analytics or tracking scripts. Its security policy blocks scripts from other companies.
We keep only what the service needs, listed below, and you can ask for a copy or deletion at any time.

1. Who we are

1code Mail is provided by 1code x LTD, a company registered in England and Wales (company number 12828341), registered office 2 Centurion Way, Credenhill, Hereford, England, HR4 7FF ("1code", "we", "us"). Contact us about privacy at privacy@1code.email or by post at the address above.

For your own 1code Mail account, we are the controller of your personal data. Addresses on a company's subdomain (you@acme.1code.email) belong to that company: it is the controller of those mailboxes, its owner can see and close them, and we process them on its behalf. Questions about a work mailbox should go to the company first.

This notice covers 1code Mail at inbox.1code.email, addresses at @1code.email, and the connections you can make to it (mail apps and AI assistants). You sign in with 1code ID, which is also ours and has its own privacy notice.

2. What we store, and why

What	Why	Basis (UK/EU)
Your account: the identifier 1code ID gives us (a random code, not your phone number), your name, your mailbox addresses	To run your account	Contract
Your mail: messages you receive and send, attachments, drafts, scheduled and snoozed mail, labels, filters, signatures, templates	This is the service	Contract
Address suggestions: the people you've written to or heard from, taken from your own mail	To suggest addresses as you type	Contract
Your settings, including your time zone, language and region	So times, dates, reminders and searches are in your own time, not ours	Contract
Security results for incoming mail (SPF, DKIM, DMARC), spam reports and the senders you block	To keep spam and fake senders out of your inbox	Contract and legitimate interests
A sending record for each message sent: when, from which address, how many recipients inside and outside 1code Mail, and whether it went. Recipient addresses aren't kept in this record	To protect delivery for everyone and stop abuse	Legitimate interests
Vacation replies: which senders got your automatic reply	So each sender gets it at most once every 4 days	Contract
Companies: the company's name and subdomain (acme.1code.email), its owner and members (kept by 1code ID); people, roles, invitations (including the personal email address an invitation is sent to), aliases, groups, shared-mailbox access, and a log of admin actions	So a company can run its own mail	Contract (for the company)
Keys for mail apps and AI assistants, stored only as one-way fingerprints that can't be turned back into the key	To let the apps you approved sign in	Contract
Imports: read-only access to your Gmail or Microsoft account while an import runs, stored encrypted and deleted when it ends; a mail file you upload, deleted when the import ends	To bring your old mail across, only when you ask	Contract
DMARC reports that other mail providers send about mail using the 1code.email name (they include the addresses of sending servers)	To spot people faking our domain	Legitimate interests
Connection details (IP address, browser, time) seen by our hosting provider as it delivers and protects the service	Security and keeping the service running	Legitimate interests

Cookies and storage on your device

1code Mail sets only what it needs to work, and what you choose:

a sign-in cookie that keeps you signed in, for up to 30 days;
a short-lived cookie used while you sign in, for up to 10 minutes;
your light or dark theme and your language, kept in your browser's storage on that device.

None of these track you, and nothing is shared with advertisers, so there is no cookie banner.

Mail between 1code addresses

Company addresses receive mail from anyone and send only to other 1code Mail addresses. That mail is delivered inside 1code Mail and never crosses the internet, so no other company handles it on the way.

3. What we don't do

We don't show ads, sell or rent your data, or use your mail for advertising.
We don't use your mail to train AI models.
We don't run analytics or tracking scripts in 1code Mail.
People at 1code don't read your mail, except when you ask us to (for support), when we must investigate abuse or a security problem, or when the law requires it. Automated systems check mail for spam, fake senders and malware.

4. AI assistants and mail apps you connect

You can connect an AI assistant (such as Claude or ChatGPT) or a mail app. Nothing is connected unless you do it, and you choose what each one may do (read, write drafts, send). The assistant's provider receives what you let it read and handles it under its own terms. You can disconnect it at any time in Settings.

5. Who else processes your data

Cloudflare, Inc. hosts 1code Mail: its servers, database and file storage, and the receiving and sending of mail. It acts on our instructions under a data processing agreement.
Google or Microsoft, only if you connect your account to import mail, and only to read it.
The AI provider you connect, only if you connect one.
Recipients' mail providers: mail you send is delivered to them, as with any email.

We share data with authorities only when the law requires it, and we push back on requests that aren't lawful.

6. Where your data is stored

Your mail and account data are stored in Cloudflare's Western Europe region and served through Cloudflare's network around the world, so they can be processed in other countries. Transfers are protected by Cloudflare's data processing terms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. How long we keep it

Your mail and settings stay while your account is open. Mail you delete goes to Trash and stays there until your account closes. Automatic emptying of Trash is coming; until then, ask us and we'll delete it permanently.
When your account closes, we delete your mail and account data within 30 days, unless the law requires us to keep something longer. An address that has been closed is never given to someone else.
Sending records and DMARC reports: 13 months. Vacation-reply records: 30 days. Expired sign-ins and invitations: removed after they end.
A business account's admin log is kept while the organisation's account is open.

8. Your rights

Wherever you live, you can ask us to:

give you a copy of your personal data (including your mail, in a standard format);
correct it, or delete it;
stop or limit using it, where the law gives you that right;
withdraw a consent you gave, at any time.

Write to privacy@1code.email. We answer within one month, and it's free. We may need to confirm it's you, which we do through your 1code ID. If you use a work mailbox, we may pass your request to your organisation, which decides on its own mailboxes.

United Kingdom and European Union

We process your data under the UK GDPR and the EU GDPR on the bases shown in section 2. Where we rely on legitimate interests, you can object. You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live or work.

United States, including California

We don't sell personal information, and we don't share it for cross-context behavioural advertising. The categories we collect are those in section 2: identifiers, the content of your communications, and internet activity limited to using 1code Mail. You can ask to know, correct or delete your personal information, and we won't treat you differently for asking.

Canada

You can ask to see and correct your personal information. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Australia

We handle personal information in line with the Australian Privacy Principles. You can ask to see and correct it, and complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you're not satisfied with our answer.

South Africa (POPIA)

For people in South Africa, we process personal information under the Protection of Personal Information Act, 2013 (POPIA) as the responsible party (or, for work mailboxes, as an operator for your organisation).

Information Officer: reachable at privacy@1code.email.
Your rights: to know whether we hold personal information about you and to get a copy; to have it corrected or deleted; to object to processing; and not to receive direct marketing without consent.
Outside South Africa: your information is stored in Western Europe (section 6), under laws and binding agreements that give protection substantially similar to POPIA, as section 72 requires.
Children: anyone under 18 needs the consent of a parent or guardian to use 1code Mail.
Complaints: to the Information Regulator (South Africa), inforegulator.org.za.

Everywhere else

You have the rights in this section wherever you live, and any further rights your own law gives you.

9. Security

There are no passwords to steal: you sign in by approving on your phone with 1code ID. Connections are encrypted, keys are stored only as fingerprints, import access is encrypted at rest, and an organisation's admin can sign someone out everywhere at once. If you find a security problem, please tell us at privacy@1code.email.

10. Children

1code Mail isn't for children under 13. In the EU and UK, people under 16 need a parent's or guardian's consent where their local law requires it; in South Africa, people under 18 do.

11. Changes

If we change this notice in a way that matters, we'll tell you in 1code Mail or by email before the change takes effect. The date at the top shows the current version.