Privacy Policy

Wayfinder Email ("Wayfinder", "we", "us") provides hosted email on domains you own. The service is operated by 9th Island Digital Lab. You can reach us at any time at support@wayfinderemail.com.

This policy applies to the Wayfinder Email website at https://wayfinderemail.com, the customer portal, the webmail interface, and the mail servers that deliver your messages.

Account information. When you create a Wayfinder account we collect your name, email address, and a password hash (or, if you sign in with Google or a passkey, the credential identifier instead of a password). We also store the organization name you choose.

Domain and mailbox information. The domains you add, their DNS verification status, the mailboxes and aliases you create, quota usage, and administrative settings for those mailboxes.

Mail data. Messages sent to and from your mailboxes, including headers, message bodies, and attachments, are stored on our mail infrastructure so that we can deliver them to you. We also keep short-lived delivery logs (sender, recipient, timestamp, delivery result) for troubleshooting and abuse prevention.

Billing information. Subscription plan, status, and billing history. Card details are handled directly by our payment processor; Wayfinder never sees or stores full card numbers.

Technical information. IP address, browser type, device type, and timestamps for security events such as sign-ins, password changes, and failed authentication attempts.

If you choose "Continue with Google", Google shares a limited profile with us after you grant consent. We request only these scopes:

• openid — a stable identifier that lets us recognize your account on return visits.
• .../auth/userinfo.email — your email address, used as your Wayfinder account identity and for service notifications.
• .../auth/userinfo.profile — your name and profile picture, used to personalize the portal interface.

We do not request access to your Gmail messages, Google Drive, Contacts, Calendar, or any other Google service. Google sign-in is used solely to authenticate you into your Wayfinder account.

Limited Use disclosure. Wayfinder Email's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer Google user data to third parties except as necessary to provide or improve the service, comply with applicable law, or as part of a merger or acquisition; we do not use Google user data for advertising; we do not allow humans to read Google user data except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized; and we do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

You can revoke Wayfinder's access at any time from your Google Account permissions page. Revoking access disables Google sign-in for your account but does not delete your Wayfinder account or your mail.

We use the information described above only to:

• Authenticate you and keep your account secure.
• Provision, deliver, store, and display your email.
• Verify domain ownership and configure DNS-dependent mail records.
• Process subscription payments and send billing notices.
• Provide support you request and respond to your messages.
• Detect, investigate, and prevent spam, abuse, and fraud.
• Comply with legal obligations.

We do not scan the content of your mail for advertising, profiling, or model training.

We do not sell personal information. We share data only with service providers who process it on our behalf under contract, limited to what they need to perform their function:

• Application hosting and database infrastructure.
• Mail server infrastructure that stores and transports your messages.
• Payment processing for subscriptions.
• Transactional email delivery for account notices.

We may also disclose information when required by valid legal process, or to protect the rights, safety, and property of Wayfinder, our customers, or the public. If Wayfinder is involved in a merger or acquisition, we will notify you before your information becomes subject to a different privacy policy.

Mail is retained in your mailbox until you delete it, and deleted mail is purged from our systems within 30 days. Account, domain, and billing records are retained for the life of your account and for up to 90 days after cancellation, except where a longer period is required for tax or legal compliance. Security logs are retained for up to 90 days.

You can request deletion of your account and all associated mail at any time by emailing support@wayfinderemail.com. We will confirm and complete the deletion within 30 days.

All connections to Wayfinder use TLS encryption, and mail is transmitted over encrypted SMTP and IMAP wherever the remote server supports it. Mailboxes are isolated per organization, and access is enforced by row-level security in our database. We support passkeys (FIDO2) in addition to passwords, and administrator sessions are short-lived and re-verified. Passwords are stored only as salted hashes.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise any of these rights, contact support@wayfinderemail.com. We do not discriminate against anyone for exercising a privacy right.

Wayfinder uses cookies and local storage only for essential functions: keeping you signed in, remembering your selected language, and protecting against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

Wayfinder Email is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

Our infrastructure may process data in countries other than yours. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for those transfers.

We will post any change to this policy on this page and update the "last updated" date. If a change materially affects how we handle your information, we will notify account owners by email before it takes effect.

Questions about this policy or your data: support@wayfinderemail.com.