zoomfort Privacy Policy
Effective: 16 October 2026
zoomfort.com is run by Chronicle Digital Solutions Limited, a company registered in Hong Kong (CR 79263233), registered office Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong ("we"). This policy explains what personal data zoomfort handles, why, and for how long. It covers account holders, people who use our sign-up forms, website visitors, and people whose details appear in mail sent to zoomfort addresses.
What zoomfort does
zoomfort gives AI agents their own receive-only email addresses. Mail sent to your addresses can be read in the web inbox, through the API or through the MCP server. zoomfort never sends email.
What we collect
Your account. A username, your password (stored only as a hash), your plan and limits, your addresses and their settings, and, if you turn it on, two-step sign-in data (the secret is stored encrypted, recovery codes as hashes). For API keys we keep the name you give them, their permissions and when they were last used; the key itself is stored only as a hash. We do not ask for your name, email address or phone number.
Signed-in sessions. A hashed session token, a device label (browser and operating system) and when the session was created and last used. We do not store your IP address with a session.
Mail sent to your addresses. Everything in the message: sender, recipients, subject, text, headers and attachments. Mail often contains personal data about the sender and other people, not only you. From each message we also work out a verification code if there is one, a short summary, the result of sender checks, a folder and an estimated size in AI tokens. We also keep a record of each delivery: sender and recipient addresses, size, sender-check result, time and outcome.
Sign-up forms. The invitation form asks for an email address, the subdomain you want and how you plan to use zoomfort. The launch-notification form asks for an email address, how many domains you need and, optionally, a price. With each submission we store the time, your browser's user-agent string and a keyed hash of your IP address (not the address itself). Your answers are also copied into a notice in our own operator inbox.
Security records. When you sign in, we briefly keep your IP address and username to slow down password guessing. We record account actions (for example sign-ins, password changes, new API keys) with the time, and for sign-ins the device label.
How we use it
We use this data to run zoomfort: to sign you in, receive and show your mail, extract codes, check senders, sort mail into folders, set aside suspicious mail, enforce limits and protect the service from abuse. We use sign-up form answers only to handle your request for an invitation or a launch notice, and the email address only to reply to that request.
This processing is automatic and runs on our own systems. No outside classification or AI service currently receives your mail from us; that feature is switched off for every account. If we ever turn it on, we will update this policy first.
We do not sell personal data. We do not use your mail for advertising, and we do not use your data for direct marketing.
Who else handles it
- Cloudflare hosts zoomfort: the website, the database, mail storage and the receiving of mail sent to zoomfort.com itself.
- RackNerd rents us the server in the United States that runs our own mail relay. Most mail to your addresses passes through it. The relay passes mail straight on and does not store it; its logs record a delivery number, a recipient count and the result, not email addresses.
- Google Workspace provides our company email, including the mailbox behind privacy@zoomfort.com.
- The AI agents and tools you connect receive whatever they read with your API key. You choose them; their providers' own terms apply.
- Image hosts. If you choose to load the pictures in a message, our server fetches them from the sender's image host. The host sees a request from our server, not from you.
- Authorities, when the law requires us to disclose data.
We will update this policy before we add another kind of service that receives personal data.
Where it is stored
Our database is in Cloudflare's North American region. Mail files and the rest of the service run on Cloudflare's global network, our relay is in the United States, and Google Workspace stores mail in its own data centres. Your data is therefore processed outside Hong Kong, where privacy law may differ.
How long we keep it
| Data | How long |
|---|---|
| Mail content (text, attachments, original message) | Deleted automatically once it is 7 days old (an hourly job does this) |
| Mail you mark as important | Until you unmark or delete it |
| The inbox line for a message after its content is deleted (sender, recipient, subject, date, size and similar details) | 90 more days |
| Delivery records, account activity records | 90 days |
| Sign-up form submissions | 90 days |
| Internal counting records: an account number, an address number and a time for each delivery, used to enforce daily limits | 90 days |
| Signed-in sessions | 30 days at most; 14 days if unused |
| Sign-in protection records (IP address, username) | About an hour |
| Account details | Until 3 days after you ask us to delete the account (see below) |
| Database backups kept by Cloudflare | Up to 30 days |
Mail that arrives while an account is frozen is hidden from the account and deleted after the same 7 days. When you delete a message or an address in the web inbox, its content is deleted from our storage soon after. A deleted address is never given to anyone else.
Deleting your account
You can delete your account yourself in Settings. To confirm, we ask for your password, and your two-step code if you use one. The account is deleted 3 days later. During those 3 days the account stops working: you are signed out everywhere, API keys and MCP access stop, and new mail is not accepted. To cancel, sign in with your usual password within the 3 days and choose to keep the account; everything then works again.
After 3 days we delete the password, two-step data, recovery codes, API keys and sessions, and all mail, including important mail; deleting stored mail continues in the background. We keep the username and its addresses permanently, with only basic account settings such as the plan, so they can never be given to someone else. Delivery and activity records are not deleted early; they expire on their normal 90-day schedule, which deleting the account does not restart. Backups expire as shown above.
If you can no longer sign in, write to privacy@zoomfort.com. Because accounts have no email address on file, we can act only if you can show that the account is yours.
Security
Passwords, session tokens, API keys and recovery codes are stored only as hashes; the two-step secret is stored encrypted. Cloudflare encrypts stored data. API keys can only read; nothing in zoomfort can send mail. Our tools do not show us the content of other people's mail, and we do not look at your mail unless you ask us to or the law requires it. Administrative access to our hosting and relay accounts is limited to what we need to run the service. No system is perfectly secure.
Cookies
zoomfort sets a sign-in cookie, zf_session, when you sign in. After you submit a sign-up form it sets zf_invite_flash or zf_notify_flash for 10 minutes, holding your answers in encrypted form so the page can show them back to you. We use no analytics, no tracking cookies and no third-party scripts, and browsing the public site sets no cookies.
Your rights
You can ask us for a copy of the personal data we hold about you and ask us to correct it. People whose details appear in mail we hold can ask too. Write to privacy@zoomfort.com. We may ask you to confirm who you are and, if you act for someone else, that you are allowed to. Never send us your password, codes or API keys. We answer within 40 days, as Hong Kong's Personal Data (Privacy) Ordinance requires, and we do not charge for these requests. You can also read and download your own mail at any time in the web inbox or through the API.
Children
zoomfort is not meant for children.
Changes
We will post any change on this page and update the effective date at the top.
Contact
Privacy contact, Chronicle Digital Solutions Limited, Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong. Email: privacy@zoomfort.com.