Read-only, and the key is encrypted.

Inbox Watch does not send mail through your domains, does not warm mailboxes, and does not pause campaigns. The only write is into our own database.

API keys

Instantly and Smartlead keys are encrypted with AES-256-GCM before they are stored. The payload is the initialization vector, the auth tag, and the ciphertext. The 32-byte key lives in ENCRYPTION_KEY on the server, not in the database. The app keeps the last four characters so you can recognize a key, and nothing else in clear text.

Smartlead's email-account response includes SMTP passwords. The adapter keeps the account id and the from-address. The password is not stored, logged, or returned to the browser.

What we call

• Instantly API v2: list accounts, and daily analytics for those accounts. The key is sent as a bearer token.
• Smartlead API v1: list email accounts, and mailbox name-wise health for a date window. The key is the query parameter their API requires.
• DNS and RDAP for the public checker and the hourly job. Public checks are not stored.

What we store

Your account email, a hashed session, the encrypted key, mailbox addresses, sent / bounce / reply totals, DNS check reports for domains you watch, alerts, and the Monday note. We do not pull lead lists, message bodies, or conversation content.

Sessions

Sign-in is a magic link that expires in 20 minutes and works once. The session cookie is httpOnly. It is marked secure when the app URL is https.

Billing runs through Stripe Checkout and the customer portal. Card numbers are not stored here. See the privacy policy for what leaves the server.