Skip to content
MASONS MAILAT YOUR SERVICE

THE SMALL PRINT. CLEARLY PUT.

Privacy

Your mail. Our discretion. Here is what running your mailbox involves, what information we use, and the choices you have.

Updated 13 September 2026

On this page

Masons Mail is operated by Craig Mason in Sweden. Craig Mason is the controller responsible for the personal information covered by this notice. For privacy questions or requests, email craig@masonsmail.com.

This notice covers the Masons Mail website, personal mailbox and account service. Our Imprint identifies the operator. Separate Natter app, meeting and business services are outside its scope.

Account information includes your mailbox address, account identifier, password hash, account status, plan and storage usage. We use it to create your mailbox, recognise your sign-in and manage the service. An address and password are necessary to create and access an account.

A recovery email is optional. If supplied, we store it and its verification status and send verification and password-reset messages. You can use your mailbox before following the verification link. Password resets to that address become available after verification.

Display name, full name and country or region are optional profile details. You can edit or clear them in your account. Leaving them blank does not prevent ordinary mailbox use.

Mail and calendar features process message contents, attachments, event details and delivery information, such as addresses and timestamps. This includes information from you and from people who write to you or invite you to events.

Security and operational information includes IP addresses, request times, account activity and security events. We use it to protect accounts, prevent abuse and investigate faults. At signup, or a later successful sign-in if no estimate is saved, we also estimate your city and country from the connection IP using a local reference database. We save the approximate region and its date for account geography statistics; we do not send the IP to the database provider or collect GPS for this purpose. An estimate may be wrong, particularly on mobile networks or VPNs. It is not your confirmed home address. Support enquiries contain the information you choose to send us. Please do not send us your password.

When you use an available billing feature, we process the customer, subscription, payment-status and invoice references needed for it. Payment details entered on Stripe's pages are handled by Stripe.

We do not sell your mailbox data, build advertising profiles from it or insert advertising into your inbox. Recovery, security and other account notices are service communications. Advertising sent by someone else to your email address is outside our control.

We process information needed to provide the mailbox and account features you request to perform our agreement with you. Optional recovery and profile details are used when you choose those features.

Security, abuse prevention and fault investigation serve our legitimate interests in keeping the service reliable and protecting its users. You can object to processing based on legitimate interests by contacting us. We also process information when necessary to meet an applicable legal obligation, including responding to a valid legal order.

Idelego supplies hosting and mail infrastructure used to run Masons Mail. The mail infrastructure processes your messages and calendar data; the account infrastructure processes the records needed to manage your account.

Mailgun delivers account notification emails. It receives the destination address, notification content and delivery information for those messages. See Mailgun's privacy information.

Cloudflare Turnstile helps protect signup against bots. It processes technical signals, including IP address and browser connection information. Cloudflare processes these signals to provide protection and also uses them in its own role improving bot detection. See Cloudflare's Turnstile notice.

Stripe provides payment and billing-management features when you use them. It receives the information needed for the relevant customer or payment transaction. See Stripe's privacy policy.

Sending mail or sharing an invitation passes the content and necessary delivery information to the recipients and their providers. We may also disclose information when required by applicable law or a valid legal order.

The operator is based in Sweden. This is not a promise that all processing takes place in Sweden or the EU/EEA: external providers operate internationally, and messages travel to the recipients you choose.

The full details of hosting and backup locations, provider regions and international-transfer arrangements are still being confirmed. This notice does not yet provide a complete account of those arrangements. Contact craig@masonsmail.com with questions about where your information is processed.

Our website connections use HTTPS, and the account system stores password hashes. These protections do not make ordinary email end-to-end encrypted. Mail systems and their authorised operators can have technical access to stored messages; the providers used by your recipients also receive the mail you send them.

Automated security checks can prevent a signup or restrict activity. If you believe a check has stopped you incorrectly, contact us for help. Please keep your password and devices secure.

The account site uses a necessary sign-in cookie called mm_session. The server session expires after 30 minutes of inactivity or 12 hours in total, whichever comes first. Signing out revokes it. Session expiry does not mean every associated operational record is erased at the same moment.

We use the preferred languages sent by your browser to choose a supported website language, otherwise English. You can choose another language using the language menu. That choice is carried in the page address as you move between our pages; it is not saved in a language cookie or browser storage. Choosing “Use browser language” removes it from the page address. We do not look up your IP address or location to choose a language.

The company website and account application do not include advertising or audience-analytics trackers. Protected signup loads Cloudflare's Turnstile code. Separate webmail, meeting and payment applications may use their own cookies and browser storage. For information about Cloudflare and Stripe, see their provider notices above.

Account and mailbox information is held while your account is open to provide the service. You can request deletion from account security. The confirmation shows when deletion is due and how to cancel the request during the cancellation period.

After that period, the deletion process removes the mailbox, clears direct account profile information and cancels active storage subscriptions. A failed deletion operation can take longer while it is retried.

Some account-linked mailbox records, usage history, security and financial records remain after that process. Closing an account does not immediately erase every provider copy or backup. Messages you have sent may remain with their recipients.

Retention periods for the remaining operational records, support correspondence and backups are still being confirmed. A complete schedule is not yet available in this notice. You can contact us to ask what information remains about your account and to request erasure where applicable.

Account settings let you change your profile and recovery email, download your account records and request deletion. The account download does not include all message contents and attachments. Keep copies of mail you need through your mail app before closing the mailbox.

Under applicable data-protection law, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. These rights have conditions and exceptions. Where processing relies on consent, you can withdraw that consent.

Send requests to craig@masonsmail.com. We may need reasonable evidence of your identity. GDPR normally requires a response within one month; if a permitted extension is needed, we must explain it within that first month.

You can complain to Sweden's data-protection authority, Integritetsskyddsmyndigheten (IMY), or another competent supervisory authority, including where you live or work in the EU/EEA.

We date changes to this notice and will communicate material changes as required by law. For questions about your information, contact craig@masonsmail.com. Our Terms explain the arrangements for using the mailbox.