Reviewed each release
Privacy
What Mailhaven stores
Account details (name, business name, email address and a bcrypt hash of your password), the connection settings for your sending domain, and the mail delivered to the addresses you create. Mail is stored so that you can read it: headers, bodies, attachments and the raw provider payload of each delivery.
Provider credentials
Resend API keys and webhook signing secrets are encrypted at rest with AES-256-GCM using a per-record salt and initialisation vector. They are decrypted only in the request that needs them — verifying your connection, sending a message or validating an inbound signature — and are never returned to the browser or written to logs.
Who can see your mail
Only you. Every query in the product is scoped to a single account id. The operator console shows connection status, delivery outcomes, job state and usage counters; it has no view onto message bodies or attachments.
Retention of raw payloads
The raw provider payload for each inbound delivery is archived so a failed content fetch can be retried without losing the message. The retention window is an operator setting and defaults to thirty days.
Deleting your data
Deleting a message moves it to Trash, where you can restore it or remove it permanently. Closing an account removes its addresses, messages, attachments, delivery records and stored credentials.