inboxy.net — Terms of Service

Last updated: 2026-05-25. Effective: at launch.

These are the terms on which we offer inboxy.net. They are written to be read by a person. Read with legal/privacy_policy.md, which explains what we do with your data.

If you do not agree with these terms, do not create an account. If you have already created an account and no longer agree, close it — see §10.

1. Who is providing the service

inboxy.net is provided by {Company legal name} ("inboxy", "we", "us"), a company incorporated in the Bailiwick of Guernsey and registered at {Company registered address}.

You are referred to as "you" or "the user".

2. What inboxy is

inboxy is an email aliasing and AI inbox service. We give you @inboxy.net addresses to hand out to the internet instead of your real email, parse the mail that arrives there, classify it with AI, forward time-sensitive items (login codes, verification links) to your real address the moment they're recognised, and roll the rest into a single daily summary at a time you choose. You may connect AI agents to your inbox via our REST API and MCP server.

Three product guarantees are part of these terms and cannot be unilaterally relaxed by us:

  1. inboxy never connects to your other mailboxes. We do not OAuth your Gmail, Outlook, or any other inbox.
  2. Your @inboxy.net addresses are receive-only. We do not provide any way for you, your AI agent, or anyone else acting through inboxy to send mail from @inboxy.net. There is no compose UI, no reply tool, no MCP send tool, no API send endpoint.
  3. AI agents you connect get read-and-manage access to your inboxy mailbox only. They cannot reach any of your other mailboxes, and they cannot send mail under your name.

If we ever weaken any of the three, it will be opt-in, announced 30 days in advance, and you will be free to close your account before the change takes effect.

3. Eligibility

You must be at least 16 years old (or the digital-services age of consent in your jurisdiction, whichever is higher) to create an account.

You must sign up with a personal email address that you control and that is not an @inboxy.net (or any inboxy-owned subdomain) address. We will reject @inboxy.net at the signup form.

inboxy is offered to consumers and small organisations. We are not a regulated email provider for healthcare, finance, or government use. Do not use inboxy as the primary address of record for HIPAA-, GDPR-Special-Category, or other regulated data. We will close accounts we discover doing so.

4. Your account and your responsibilities

  • Passkey at signup is mandatory. You will register a WebAuthn passkey before you reach your inbox. There is no password.
  • TOTP and recovery codes are issued at signup for account recovery. Keep them safe. We cannot recover your account without them.
  • Keep your personal email address current. Forwarded mail and account notices go there.
  • You are responsible for any action taken under credentials issued to you (passkeys, API keys, browser-extension tokens).
  • Report any suspected unauthorised access to security@inboxy.net immediately.

5. Acceptable use

You agree not to use inboxy to:

  • Receive mail intended for spam, fraud, phishing, or any illegal purpose.
  • Receive mail at addresses you have given out while impersonating a brand, organisation, or person you have no authority to represent.
  • Sign up to services in someone else's name without their permission.
  • Receive material that is unlawful in your jurisdiction or in the EU (where our infrastructure is located) — including but not limited to CSAM, terrorist content, and stalkerware.
  • Attempt to use inboxy as a relay to send mail. There is no send capability; attempting to discover or exploit one is a breach of these terms.
  • Reverse-engineer, scrape, or probe the service in ways that go beyond normal use of the documented API.
  • Probe other users' accounts, addresses, or mail. The architecture is built to make this impossible; any attempt is a breach.
  • Build a competing aliasing service on top of our infrastructure.

We may suspend or close your account for breach. For serious breaches we will close it immediately and notify you afterwards.

6. Address allocation

At signup we allocate you a default number of @inboxy.net addresses (currently five on the free plan; subject to change with notice). You may create, label, and retire addresses at any time within your plan's limits.

You do not own the local-part of any @inboxy.net address. We grant you the right to receive mail at it for as long as your account is active and the address is not retired. Retired local-parts are permanently reserved and not re-issued to anyone else.

Some local-parts are reserved by us (administrative names, brand-protection names, mailbox-role names per RFC 2142). You cannot claim these even on paid plans.

7. APIs, MCP server, and AI agents

Your API keys and MCP tokens are yours to manage. You are responsible for any action taken using them, including actions taken by AI agents you authorise.

The API and MCP server expose read and manage-your-own-inbox capabilities only. You may not infer, request, or build around any capability that would send mail or affect another user's account.

You may connect any AI agent (Claude, Codex, Copilot, or any other client of our MCP server). You are responsible for what that agent does with your data. We do not warrant the behaviour of third-party AI providers.

We may rate-limit API and MCP usage to protect the service for everyone. Reasonable individual use is never rate-limited in practice.

8. Browser extension

The optional browser extension is offered under these same terms. Its scope is narrow: list and create your aliases, and record which site you handed an alias to. It cannot read your messages, change your account settings, or send mail. You can revoke its access at /account/keys at any time.

The extension's source code is open and available for review.

9. Fees

inboxy currently offers a free plan. Paid plans, when introduced, will be announced clearly and offered on opt-in basis; we will not silently move free-plan features behind paywalls within 12 months of launch.

When billing is in place, recurring charges will be processed by a separate billing sub-processor (most likely Stripe). Their addition will be reflected in the privacy policy and notified to you 30 days in advance.

10. Closing your account

You may close your account at any time at /account/delete. Deletion is immediate and irreversible:

  • Forwarding and digest delivery stop immediately.
  • Within 24 hours we hard-delete your account record, credentials, addresses, messages, attachments, embeddings, and per-site attributions.
  • A single closure record remains in the audit log for 365 days with your user identifier nulled, for abuse-detection purposes (justified under GDPR Art. 17(3)(e)).
  • See legal/privacy_policy.md §7 for the full deletion detail.

Once deleted, your retired local-parts are not re-issued. We cannot restore a deleted account.

11. Suspension and termination by us

We may suspend or close your account if:

  • We reasonably believe you are in breach of §5 (acceptable use).
  • Mail to your addresses triggers persistent abuse, complaint, or bounce signals that put our deliverability reputation at risk.
  • You are inactive for more than 24 months (with at least two warning emails to your personal address before closure).
  • We are required to do so by law, court order, or competent regulator.
  • We discontinue the service (see §12).

We will notify you by email to your personal address, except where law prohibits it or where immediate action is needed to protect the service or other users.

12. Changes to the service

inboxy is a young service. We will add, change, and occasionally remove features. We will not:

  • Silently remove a feature you actively use without notice.
  • Weaken any of the three guarantees in §2 without 30 days' notice and an opt-in.
  • Begin charging for a previously-free feature without 30 days' notice.

We may discontinue the service entirely. If we do, we will give at least 90 days' notice by email to your personal address, ensure your data is exportable throughout that period, and delete all account data within 30 days of closure.

13. Service availability

inboxy is offered on a best-effort basis at the free tier with no service-level agreement. We design for high availability on Cloudflare's global platform and target ≥ 99.9% mail-processing availability month over month, but we do not commit to it contractually at the free tier.

When paid plans launch, paid-tier SLAs (if any) will be stated in a separate SLA document linked from these terms.

14. Intellectual property

We own the inboxy.net service: the brand, the code, the design, and the infrastructure we run. You own your data and your messages. Nothing in these terms transfers any of your IP to us.

You grant us the minimum licence necessary to host, process, classify, summarise, embed, and forward your mail in order to deliver the service to you. That licence ends when you delete the account.

You may use the inboxy.net brand to talk about the service in reviews, articles, social posts, and your own integration documentation. You may not use it to imply endorsement of your own product or service without our written permission.

15. Third-party content

Mail you receive at your @inboxy.net addresses is sent by third parties we have no relationship with. We are not responsible for its content, accuracy, or legality. Our AI classifications and summaries are best-effort and may be wrong; do not rely on them for safety-critical decisions.

Links you click via our redirect host (l.inboxy.net) point to third-party sites. We are not responsible for those sites. We strip the referrer header on outbound clicks, so the destination site does not learn that you arrived from inboxy.

16. Disclaimers

To the maximum extent permitted by law, inboxy is provided "as is" and "as available". We disclaim all warranties not expressly given in these terms, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

In particular, and for clarity:

  • We do not guarantee that every time-sensitive email will be forwarded within a specific time window. AI classification is statistical, not deterministic.
  • We do not guarantee that mail to your addresses will always be delivered to inboxy; this depends on senders, the wider email ecosystem, and the reputation of our sending and receiving infrastructure.
  • We do not guarantee that the daily digest will arrive in your primary inbox rather than a "promotions" or spam folder at your mail provider.

17. Limitation of liability

To the maximum extent permitted by law, our aggregate liability to you for any claim arising out of or relating to inboxy is limited to:

  • For the free plan: €100.
  • For paid plans (when introduced): the greater of €100 and the total fees you paid us in the 12 months before the event giving rise to the claim.

We are not liable for indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, revenue, data, goodwill, or business opportunity, even if we have been advised of the possibility of such damages.

Nothing in these terms limits liability that cannot be limited under applicable law (including, where relevant, liability for death or personal injury caused by negligence, fraud, or wilful misconduct).

18. Indemnity

You agree to indemnify us against third-party claims arising from your breach of §5 (acceptable use) or §7 (your responsibility for actions taken via your keys), to the extent permitted by law. This does not apply to claims arising from our own breach or negligence.

19. Changes to these terms

We may change these terms. For material changes (anything that meaningfully affects your rights or our obligations) we will:

  • Notify you by email to your personal address at least 30 days before the change takes effect.
  • Publish the updated terms at /terms with a new effective date.
  • Keep prior versions at /terms/history.

Continuing to use inboxy after the effective date means you accept the new terms. If you do not accept them, close your account before the date.

20. Governing law and dispute resolution

These terms are governed by the laws of the Bailiwick of Guernsey, without regard to its conflict-of-laws rules.

You and we agree to first attempt to resolve any dispute informally by emailing support@inboxy.net and giving us 30 days to respond.

If the dispute is not resolved, it will be brought in the Royal Court of Guernsey, except where the laws of your country of residence give you a non-waivable right to bring proceedings locally (consumer protection law in the EU and UK in particular preserves this right), in which case those rights are preserved.

For data-protection matters specifically: the Bailiwick of Guernsey has an EU adequacy decision, and our supervisory authority is the Office of the Data Protection Authority (ODPA) in Guernsey. EU and UK data subjects retain the right to complain to their local supervisory authority — see legal/privacy_policy.md §6.

21. Miscellaneous

  • Entire agreement. These terms, together with the privacy policy, are the entire agreement between you and us about inboxy.
  • Severability. If any provision is held unenforceable, the rest stays in force.
  • No waiver. Our failure to enforce a provision is not a waiver of it.
  • Assignment. You may not assign these terms. We may assign them in connection with a merger, acquisition, or sale of substantially all of our assets, with notice to you.
  • Force majeure. Neither party is liable for failures caused by events outside their reasonable control.

22. Contact