Privacy policy
This describes what mail.maxocw.se collects, why, and for how long. It covers this webmail application and admin panel specifically — not general expectations about email itself (e.g. the contents of messages you send and receive, which this policy does not change how you already understand email to work).
What's collected
- Account identity (your address, display name) — stored in the mail server's own account database, which this application only reads.
- Sessions — IP address, browser user-agent string, and timestamps, kept so you can see and revoke your own active sessions (device history) and so suspicious logins can be detected.
- Security/audit events — login attempts, 2FA changes, password resets, admin actions, each with an IP address, user-agent, and event type. This log is immutable once written (rows younger than 30 days can never be deleted, even by an administrator) — it exists specifically so it can be trusted after the fact.
- Two-factor credentials — a TOTP secret (encrypted at rest), recovery codes (stored only as one-way hashes, never in plaintext after issuance), and/or passkey public keys (never a private key or biometric data, which never leave your device).
- Registration requests (if you request an account rather than being created directly by an administrator) — the address and password you provide (the password is hashed immediately and never stored in plaintext), your IP address, user-agent, and a best-effort approximate location (country and network provider) looked up from your IP at request time.
We do not collect analytics, tracking pixels, advertising identifiers, or any geolocation beyond the coarse, IP-derived approximation above (never GPS or device location).
Why
Everything above is collected for account security (detecting and stopping abuse, letting you and administrators review and revoke access) or for the application to function (knowing which sessions are yours, completing account setup). None of it is used for advertising, and none of it is sold or shared with third parties for their own purposes.
How long it's kept
Retention periods are administrator-configurable; the defaults are audit/security events for 180 days (never less than 30, by design), expired or revoked sessions for 90 days after they stop being valid, decided registration requests for 90 days after the decision, and superseded signing keys (DKIM) for 90 days after rotation. A registration request that's still awaiting a decision is kept until an administrator acts on it, regardless of age. A scheduled process enforces these periods automatically — nothing is kept indefinitely by default.
Cookies
Three cookies, all strictly necessary for the site to function — there is no consent banner because none is legally required for cookies that are strictly necessary and nothing else is set:
mejl_session— keeps you signed in.mejl_pending— used only mid-way through a two-factor login, before it completes.mejl_csrf— a security token that protects against cross-site request forgery; contains no personal information.
If a non-essential cookie is ever introduced, this policy and the consent requirement above will change accordingly.
Third parties
- ipinfo.io — when a registration request is submitted, or when a location-based access rule is configured, your IP address is sent to ipinfo.io to approximate a country/network. No other data is sent, and this only happens for the specific actions above, not on every request.
- Password reset links may be relayed through a PwPush instance (a service built specifically for sharing a one-time secret link) rather than emailed as plain text, if configured.
Your data, your requests
A full self-service data export/erasure workflow isn't built yet. Until it is, contact your administrator directly to request a copy of your data or to have your account and associated data removed.
Changes
This page is static content maintained alongside the application; it changes when what the application actually does changes.