Privacy policy

Last updated 21 October 2026

letterport is operated by 10xproductivity. This policy covers the letterport service and this website. Questions go to privacy@letterport.dev.

What we keep

• Your account: the identity you sign in with (through Auth0), including your email address.
• API keys: only a one-way hash of each key and its first characters. We can't show a key again.
• Mail in your inboxes: every message sent to or from them, with its headers, text, HTML and attachments. Keeping it is the service: your agents read it through the API.
• Operational records: request logs (time, route, response, IP address) and delivery records. They never contain message bodies or API keys.

How we use it

To receive, store and deliver your mail, run the API, keep the service secure, prevent abuse, and answer you when you contact us. Abuse prevention is mostly automated (limits, bounce and complaint rates). When we investigate an abuse report, we may look at the messages involved. We don't sell your data, use your mail for advertising, or train AI models on it.

Who processes it

• Amazon Web Services (United States, us-east-1): hosting, the database, file storage and email.
• Auth0 (by Okta): signing in.

How long we keep it

Mail stays until you delete it or close your account. A deleted inbox stops receiving mail immediately; ask us and we delete the messages it held. Mail sent to an address that has no inbox is not kept. Request logs are kept for 30 days.

Security

Connections use TLS. Stored mail and the database are encrypted at rest. API keys are stored only as hashes. Access to production systems is limited to the people who run the service.

Your choices

You can ask for a copy of your data, or for its deletion, at privacy@letterport.dev.

This website

This site sets no cookies, runs no analytics, and loads nothing from other websites.

Changes

We will update this page when this policy changes, and email account holders about significant changes.