# Privacy self-serve

Most of the GDPR rights you have against inboxy you can exercise yourself, without writing to us.

## What you can do yourself

| Right | Where | Time |
|---|---|---|
| **Access** (Art. 15) — see what we hold | [Export](/account/export) | Instant |
| **Portability** (Art. 20) — download as JSON | [Export](/account/export) | Instant |
| **Rectification** (Art. 16) — fix wrong info | [Settings](/account/settings) | Instant |
| **Erasure** (Art. 17) — delete the account | [Delete](/account/delete) | Within 30 days |
| **Restriction** (Art. 18) — suspend processing | Email `dpo@inboxy.net` | 7 days |
| **Object** (Art. 21) — to specific processing | Email `dpo@inboxy.net` | 7 days |

## What deletion actually does

Triggering **Account → Delete** from the UI:

1. Marks your `users` row `status = 'deleted'` immediately. You are signed out and can no longer access the account.
2. Retires all your `@inboxy.net` addresses — incoming mail to them starts bouncing within minutes.
3. Revokes all your API keys — any agent or extension holding one returns 401 on its next request.
4. Queues a hard-delete job that purges your messages, attachments, and R2 blobs within 30 days.

Audit-log entries are retained for the statutory period set by the Bailiwick of Guernsey ODPA (currently 6 years for the security-relevant subset) and then purged.

## Address local-parts are not recycled

When your aliases are retired they are *not* freed for re-allocation. Nobody who signs up after you can claim `your-old-alias@inboxy.net`. This is by design — it means mail sent to an address you used while you were a customer cannot reach a stranger.

## Lawful basis we rely on

- **Contract** (Art. 6(1)(b)) — operating the service you signed up for.
- **Legitimate interests** (Art. 6(1)(f)) — abuse prevention, fraud detection, security.
- **Legal obligation** (Art. 6(1)(c)) — retention of audit logs, response to lawful orders.

We do not rely on consent for the core service. There is no "consent withdrawal" needed to stop core processing — deleting the account stops everything except statutory retention.

## Complaints

If you think we are processing your data unlawfully, you have the right to complain to the supervisory authority — the [Office of the Data Protection Authority of the Bailiwick of Guernsey (ODPA)](https://www.odpa.gg/).

We would rather hear it from you first — `dpo@inboxy.net` — but you don't need our permission to escalate.