Draft for attorney review

Privacy Policy

DRAFT — for attorney review. Not legal advice. Do not publish until counsel for the operator of SpamEnder has revised it.

Last updated: October 25, 2026.

This draft describes how SpamEnder handles personal information for the marketing site https://mailpal.co, the portal https://app.mailpal.co, and the connector https://mcp.mailpal.co. The legal entity is "the operator" until counsel names it.

Information we collect

• The mobile number you verify (it is your account), your account email if you add one, and your name if you give one.
• Your mobile carrier's name and type, looked up once from your number so we can show the right forwarding code.
• Trial dates, plan status, this month's usage as a percentage, and your auto-add choice with the time you agreed to it.
• Invite information: your invite code, who invited you (if anyone), and whether each friend you invited has counted toward a reward. We do not collect your contacts and we never send invites for you.
• The screening number we buy for you, carrier-test results, and whether forwarded calls arrive with a usable caller ID.
• Call metadata: time, direction, the number presented as the caller, verdict (spam, passed, or message), a short reason, and a short summary.
• A transcript and any fields the assistant collected, for long enough to email the report.
• Billing status from Stripe: customer id, subscription id, and whether the subscription is active, past due, or canceled. We do not receive or store your full card number.
• Sign-in codes and connector tokens, stored only as hashes.
• If you email support, whatever you send to support@mailpal.co.

Information we try not to keep

The assistant is instructed not to ask for payment card numbers, Social Security numbers, or one-time passcodes. If a caller dictates a code, the service is built to drop that audio from the transcript, not to log the digits, and not to put the digits in the report email. Detected verification calls are bridged straight through by default, or announced as a code call when that customer chose a spoken notice. Either way the code digits are not stored. If a direct verification bridge is not answered, the notice is spoken instead, still without the code. Do not rely on this as a promise that every spoken digit is caught. Redaction looks for obvious digit strings and code phrases. Counsel and the operator should keep reviewing it.

How we use information

We use it to screen calls, place callbacks only to your verified cell, email reports, run the portal and the connector, bill the subscription, stop screening when the subscription is not in good standing, release a number after the grace period, detect loops and call floods, and email the operator if an account nears its minute cap. The cap alert goes to support@mailpal.co unless the operator changes OWNER_ALERT_EMAIL. It does not include the transcript.

Reports and email

Reports come from reports@mailpal.co through Twilio SendGrid. The return-path domain is mail.mailpal.co, and rewritten links use links.mailpal.co. The report can include the caller number, the time in your timezone, the verdict, why it was flagged, collected fields, a summary, and the redacted transcript. Spam calls are reported too. A signed SendGrid event marks a bounced, blocked, dropped, or spam-reported address invalid, and the portal and the connector say so. We then stop sending to that address, which is how we honor SendGrid's suppression lists.

Retention

• After the report email is accepted for sending, the stored transcript and collected fields are deleted.
• If sending fails, that content can remain until the retry window ends. The default window is 24 hours. Then it is deleted and the email is marked failed.
• The short summary can remain for the summary retention period. The default is 90 days. The portal and the connector show metadata and that summary, not a long-term transcript.
• Call metadata (time, numbers, verdict, email status) can remain after the summary is cleared so you can see that a call happened.
• A released line's phone number is released at Twilio. Account records can remain until you ask us to delete the account, except where we must keep a billing record.

Counsel should confirm these periods against the operator's actual backups and logs.

Who else processes it

• Twilio, for numbers, call control, recordings on the outage fallback, and the verification text.
• xAI, for the voice model that hears the caller and decides which tool to call. Audio is streamed for screening. The bridged conversation with you, whether you pressed 1 on a screened call or the caller was connected directly, is not transcribed by SpamEnder.
• Stripe, for Checkout, the customer portal, and subscription webhooks.
• Google Cloud, for Cloud Run, Cloud SQL for PostgreSQL, Secret Manager, Cloud Logging, and the scheduled jobs. The reference deployment keeps the database on a private IP.
• Twilio SendGrid, for report mail, sign-in codes, and bounce or spam-report notices. DNS for mailpal.co, the return path mail.mailpal.co, and link branding links.mailpal.co is part of making that mail deliverable.
• Your carrier, which already has the forwarding relationship.
• A Grok Bot or other client you authorize at mcp.mailpal.co. Its tools can read and change only your account.

We do not sell personal information. This draft does not grant a marketing list. Counsel should add any state privacy rights (access, delete, correct, appeal) and the request address.

Cookies and sign-in

The portal sets an httpOnly session cookie after you enter a sign-in code sent to your phone or email. If you open an invite link, a cookie remembers the invite code for up to 30 days so the right friend gets credit. The connector uses an OAuth authorization code and a bearer token. We do not use the cookie for third-party advertising.

Security

Subaccount tokens are encrypted when TOKEN_ENCRYPTION_KEY is set. Production refuses to start without it. Webhooks are checked with Twilio signatures, Stripe signatures, and the SendGrid signed event webhook. Scheduled jobs accept a Google identity token for the portal origin. Logs are written as JSON with phone numbers and email addresses removed. No method is perfect.

Children

SpamEnder is not directed at children, and the account holder must be able to contract. Do not use it to screen a child's phone unless counsel says that arrangement is lawful.

International

The operator should say where data is stored. The reference deployment is a US AWS region. Audio is processed by the voice provider under its terms.

Changes

Counsel should describe how policy changes will be announced. Until this draft is replaced, the copy served at https://app.mailpal.co/legal/privacy is the working text.

Contact

Privacy and support: support@mailpal.co. Marketplace listing contact: hello@mailpal.co.