Who is responsible
The data controller is APPS34, société à responsabilité limitée (SARL), 48 Rue Claude Balbastre, 34070 Montpellier, France (RCS Montpellier 944 081 553). For anything in this policy, write to [email protected].
Early-access signups
When you ask for an API key, we collect the email address you enter and, if you give them, your sending domain and whether you need to send email, receive it or both ("both" if you don't choose). We also keep the dates of your first and latest signup and how many times you signed up. With the request we also record the page you signed up on, the website that referred you and campaign parameters (UTM tags) from the link you followed, and the country your request came from as reported by our network provider. We do not store your IP address with the signup.
We use this information to contact you when your account is ready, to prioritise who gets access first and to understand which pages and channels bring people to api.email. The legal basis is your request to be contacted and our legitimate interest in running an early-access programme. If you sign up again with the same address, we update the existing entry rather than creating a new one.
So that the referring website and campaign parameters can be sent with your signup, they are kept in your browser's session storage while you browse api.email. They are only sent to us if you sign up, and they are deleted when you close the tab. You can block site storage in your browser without affecting the signup itself.
Notifications to our team
When a new address signs up, we send a short notification with the signup details listed above to our team through Telegram, a messaging service, so we can respond quickly. These messages are stored on Telegram's servers, which may be located outside the European Union.
Visitor statistics
Page views are counted by a self-hosted Plausible Analytics instance (plausible.apps34.com) thatAPPS34 runs on its own infrastructure. It sets no cookies, does not track you across sites, keeps only aggregate counts and shares nothing with third-party analytics providers. api.email itself sets no cookies on its public pages; our network provider may set a strictly necessary security cookie to protect the site from bots.
Services we rely on
- Cloudflare, for network delivery and protection: it sees standard request data such as your IP address.
- Hetzner Online GmbH, which hosts our servers in Germany.
- Telegram, for the team notifications described above.
Fonts and scripts are served from our own domain, except the Plausible script, which loads fromplausible.apps34.com, also operated by APPS34. We do not load Google Fonts or third-party trackers.
Transfers outside the European Union
Cloudflare is a US company and Telegram operates servers outside the EU, so some of the data above can be processed outside the European Economic Area. Where that happens, we rely on the safeguards those providers offer, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
How long we keep data
Early-access signups are kept until you ask us to delete them, or for 24 months after the early-access programme ends, whichever comes first. Server logs are kept only as long as needed for security and operations. Database backups are kept for 14 days, so a deleted entry can remain in a backup until that backup is rotated out.
Your rights
You can ask for a copy of your data, its correction or deletion, and you can object to its use at any time by writing to [email protected]. We answer within one month. You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Changes
We will update this page when our practices change and show the new effective date at the top. For significant changes affecting signups, we will email the addresses on the early-access list.