Privacy Policy

This policy covers email.sb: the website at https://email.sb and the mail servers that receive and send mail for its addresses. Show Corporation operates the service and is responsible for the data described here.

1. Information We Collect

Your account. When you sign in, SB Forum provides your forum account identifier, your username, your avatar and the verified email address of your forum account. We use that address to send you account notices (such as a reminder after a long time without signing in) and to find your account when you write to us for help. We do not use it for marketing. We do not receive your forum password. We also record your language, when you signed up and last signed in, your balance, your storage and alias limits, and whether your account is banned and why.

Your addresses. The addresses you hold and have held, when you held them, and how you acquired them, including transfers you started or accepted.

Your mail. For every message we accept for you: its headers, its text and HTML body, its attachments, the envelope sender and recipient, when it arrived, its size, and the score, action and rule names from our spam filter. We add a Received header recording the IP address and host name of the server that delivered it.

Mail log. For every attempt to deliver mail to email.sb, accepted or not: the time, the sending server’s IP address, reverse DNS name and HELO name, the envelope sender and recipient, the size, the result and the spam score. The log never contains the subject or content of a message.

Mail you send. If you send mail, we keep a copy in your Sent folder and drafts while you write, with their attachments. For every message we keep an outgoing log: the sending address, each recipient, when it was sent, each delivery attempt with the receiving server, the result and the IP address it left from, and the spam score our filter gave it. Addresses reported as non-existent by receiving servers are added to a suppression list. Draft text and the content of sent mail are stored like your other mail; the outgoing log never contains bodies.

Balance. A ledger of every change to your balance: vouchers redeemed (identified by the last four characters of the code), purchases, transfer fees, and adjustments made by an administrator with the reason given. Ledger entries are never edited or removed.

Spam reports. When you mark a message as spam or not spam, we record your verdict, a fingerprint of the message and the sender’s domain.

Telegram. If you connect Telegram, your Telegram chat ID and notification settings.

Forwarding. If you set up forwarding, the target mailbox and when it was confirmed, and a record of each confirmation message (when, and to which mailbox) to limit abuse.

Activity log. Sign-ins and actions taken in your account or by administrators, such as creating or deleting an address, starting a transfer, purchasing storage or banning an account, with the time and the IP address they came from.

2. How Mail Is Processed

Messages are checked by our spam filter (rspamd), which runs on our servers. Incoming mail may be accepted without a check if the filter is unavailable and the service is configured to allow this. It checks sender authentication (SPF, DKIM, DMARC), known sources of spam and malware, and the message itself. When enough members mark the same message or sender domain as spam or not spam, that message may be used to train the filter.

Headers and bodies are stored in our database. Attachments and very large bodies are stored in private object storage, and identical attachments are stored once. HTML mail is cleaned before it is shown: scripts, forms and other active content are removed.

Remote images are fetched through our image proxy, which conceals your IP address from the image host. The host may still detect that an image was requested. Remote images are blocked in the spam folder.

Before sending, outgoing mail is checked by our spam filter and signed with DKIM. Our servers then deliver it directly to the recipients’ mail servers.

If you use PGP, your private key is created or imported in your browser and stored on our servers encrypted with your passphrase. Encrypted mail is decrypted in your browser, so we never see your passphrase, your unlocked key or the decrypted text. Your public key is published for your address (Web Key Directory) and added to mail you send (Autocrypt header). PGP encrypts message contents before delivery. Drafts are stored on our servers without PGP encryption, and the server assembles the message before your browser encrypts it. Subject lines are not encrypted. We cannot recover your passphrase or decrypt messages for you if you lose access to your key. When an address is transferred or released, its key is revoked; the former holder keeps it to read mail already encrypted to it.

Administrators can view messages that you submit in abuse or phishing reports, including their subjects, contents and attachments. Each view is logged. The admin interface does not provide access to other message contents.

3. How We Use Your Information

We use this information to run email.sb: to receive, filter, store and show your mail; to manage addresses, transfers and purchases; to send the notifications you choose; to limit abuse; to investigate delivery problems; and to respond to legal requests.

We do not sell or rent your data or use it for advertising or profiling.

4. Cookies and Browser Storage

The website sets a session cookie that keeps you signed in and a cookie that remembers your language. Your choice of light or dark theme is kept in your browser’s local storage. We count visits with Plausible (stat.xtom.com), which sets no cookies and records only the page visited, the referring site, the browser, the operating system and the country; before a visit is sent, the IDs of messages, drafts and contacts and the query string (such as a search) are removed from the page address. We do not use advertising scripts.

5. Notifications

If you connect Telegram, we send you new-mail notices (the recipient, the sender and, if you allow it, the subject; never the body), transfer results, balance changes and cleanup reminders. You can turn these off or disconnect Telegram in Settings. We do not send marketing messages.

6. Data Sharing

• SB Forum, which signs you in and sells vouchers. It can see whether a voucher has been redeemed, but not by whom.
• Telegram, for the notices you choose to receive.
• Hosting and storage providers that run our servers and hold attachments, only on our instructions.
• The mailbox you forward to, which receives that address’s mail and, before forwarding starts, the confirmation message.
• The member you transfer an address to, who receives that address’s future mail but none of the mail received before the transfer.
• Recipients of mail you send and their mail servers, which receive the message, your address and display name, and the IP address of our server it came from.
• Law enforcement and courts, only in response to valid legal process.

As with any mail service, senders and their mail servers learn whether their message was accepted or refused.

7. Retention

• Mail: until you delete it. Attachments are removed from storage within a few hours of the last copy being deleted.
• Inactive accounts: if you do not sign in for 365 days, all of your mail is deleted and your addresses are released.
• Mail log and outgoing log: 30 days.
• Suppression list: 30 days after the bounce.
• Sent mail and drafts: like received mail, until you delete them or the limits above apply.
• Account data, address history, the balance ledger and the activity log: while your account exists, and afterwards for as long as accounting, disputes, abuse handling and legal obligations require.

8. Your Rights

You can read and delete your mail, delete your addresses and change your settings in your account. You can also ask us for a copy of your personal data, or ask us to correct or delete it. Depending on where you live, you may have further rights under local law.

Send requests to [email protected] from an address you hold on email.sb or from the email address of your forum account, or include your forum username, so that we can confirm the request comes from you.

9. Children

email.sb is not directed to children under 16, and we do not knowingly collect their information. If we learn that an account belongs to a child under 16, or to one who could not lawfully accept our terms, we will delete it, except for what we must keep for abuse handling or legal reasons.

10. Changes to This Policy

We may change this policy. Changes are published on this page with a new date.

11. Contact

• Show Corporation
• 838 Walker Road, Suite 21-2, Dover, Delaware 19904, United States
• Phone: +1 (302) 520-2333
• Email: [email protected]

This policy is published in English, Simplified Chinese and Traditional Chinese. If the language versions differ, the English version prevails.