InboxDome runs entirely on infrastructure listed below. We do not sell data and no third party receives inbox content except as required to operate the service.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), storage (D1, R2, Durable Objects, Queues), inbound email routing, DNS, CDN, bot protection (Turnstile), admin access control (Cloudflare Access) | Inbox addresses and message content, request metadata | Global edge network (US-based provider) |
| Supabase, Inc. | Account authentication and the account profile record (added July 19, 2026) | Account email address, password hash, signup IP (deleted after 7 days), signup country, consent timestamps | US-based provider |
| Resend (Plus Five Five, Inc.) and Amazon SES | Outbound transactional mail: verification, password reset, security notices and the delivery canary (added July 19, 2026) | Recipient email address and the message we send you | US-based providers |
| Postmark (ActiveCampaign, LLC) | Spam score (SpamAssassin), only when an API user runs the spamScore check on a message (added October 21, 2026) | The raw message being scored; nothing else is sent | US-based provider |
Only accounts touch Supabase and Resend. The anonymous temporary inbox does not create an account, so using it involves Cloudflare only.
Future additions (payment processing, uptime monitoring, developer marketplace) will be listed here before they process any customer data.
Questions: contact page.