The short version
- Our website sets no cookies. It remembers only your light or dark theme, in your own browser.
- The Inboxy web app uses one secure session cookie and a security token to keep you signed in safely, plus local storage for your preferences and offline use.
- Our mobile and desktop apps keep sign-in tokens in your device’s secure storage.
- No analytics, advertising, tracking or third-party cookies — anywhere.
- Tracking pixels in the emails you receive are blocked by our image proxy.
1. What cookies and local storage are
Cookies are small text files a website asks your browser to store and send back with later requests. They are commonly used to keep you signed in, remember choices, and — on many sites, though not ours — to track browsing for analytics or advertising.
Local storage, IndexedDB and Cache Storage are browser features that let a website keep data on your device. Unlike cookies, they are not sent to the server automatically with every request. A service worker is a small script that lets a web app work offline and be installed like a native app.
Native apps use comparable device storage, such as the iOS Keychain and the Android Keystore, which are designed to hold secrets securely.
Privacy laws such as the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations (PECR) and similar rules elsewhere apply to all of these technologies, not only to cookies. This policy therefore covers all of them.
2. Our approach
We store something on your device only when it is strictly necessary to provide a feature you have asked for — such as keeping you signed in, protecting your account, or remembering a setting you chose.
We do not use analytics cookies, advertising cookies, social-media pixels, fingerprinting, cross-site tracking, or any third-party cookies or scripts — not on our website and not in any of our apps. Our website loads no external scripts or fonts (our typeface is self-hosted) and runs under a strict Content Security Policy.
How we handle the personal data involved is described in our Privacy Policy.
3. Everything we store
The table lists every cookie and storage item Inboxy uses. All of them are first-party (set by Inboxy itself) and strictly necessary.
| Where | Name / type | Purpose | Duration |
|---|---|---|---|
| Website | inboxy-site-theme in local storage | Remembers whether you chose the light or dark appearance. Stays in your browser and is never sent to us. | Until you clear it or change the setting |
| Web app | Session cookie with the __Host- prefix [cookie name] To confirm | Keeps you signed in. Contains only a random 256-bit token; our servers store only a hash of it. Flagged HttpOnly (not readable by scripts), Secure (sent only over HTTPS) and SameSite=Strict (never sent with requests from other sites); the __Host- prefix locks it to our domain. | [Up to 60 days, extended while you use it; deleted when you sign out] To confirm |
| Web app | CSRF token [cookie or in-page token] To confirm | Protects you against cross-site request forgery by proving that each change to your account comes from Inboxy itself. | Same as your session |
| Web app | App preferences in local storage | Remembers interface choices on that device, such as theme, layout, density and the last view you opened. Contains no passwords or tokens. | Until you sign out, clear site data or change the setting |
| Web app | Offline cache in IndexedDB and Cache Storage | Keeps recently viewed messages and app data so Inboxy loads quickly and works when your connection drops. Cleared when you sign out. | Until you sign out or clear site data |
| Web app | Service worker | Makes the installable app (at /app/) work offline and receive web push notifications if you allow them. | Until you uninstall the app or clear site data |
| iPhone and Android apps | Refresh token in the iOS Keychain or Android Keystore | Keeps you signed in securely. Short-lived access tokens are held only in memory; the single-use refresh token rotates on every use, and reuse of an old token signs the device out. | Up to 60 days, extended while you use the app; deleted on sign-out |
| Mobile, desktop and web apps | Push token | Lets us deliver notifications you have allowed, through Firebase Cloud Messaging or Apple Push Notification service. Stored encrypted on our side; see Privacy Policy. | Until you turn notifications off, sign out, or the token becomes invalid |
| Desktop apps | Sign-in tokens in the operating system’s secure credential store [macOS Keychain / Windows Credential Manager] To confirm | Keeps you signed in on that computer. | Until you sign out |
None of these items is used to identify you across other websites or apps, to build a profile of you, or to measure advertising.
4. Images in email
Many marketing emails contain invisible “tracking pixels” — tiny images that tell the sender when, where and on what device you opened a message, and that can set third-party cookies.
Inboxy loads remote images in email through our own image proxy. The proxy blocks known tracking pixels, strips cookies and referrer information, and hides your IP address from the sender. By default remote images load only when you ask for them. Email content is also sanitised and displayed in a sandboxed frame, so scripts in an email cannot run or set cookies.
5. Why there is no cookie banner
Laws such as the EU ePrivacy Directive (Article 5(3)), the UK PECR (regulation 6) and similar rules in other countries require consent before storing information on your device — except where the storage is strictly necessary to provide a service you have explicitly requested. Everything in section 3 falls within that exemption: it is needed to sign you in securely, protect your account, remember a choice you made, or let the app work offline.
Because we use no optional cookies or storage, there is nothing to ask you to accept or reject, so we do not show a consent banner. If we ever introduce non-essential storage, we will ask for your consent first and update this policy.
6. How to control storage
- Browser settings. All major browsers let you view, block and delete cookies and site data. If you block the session cookie or storage for our domain, the web app will not be able to keep you signed in or work offline; the website will still work.
- Clear site data. In your browser’s settings, clear the data for inboxy.nexlla.com to remove the theme preference, app preferences, offline cache and service worker.
- Sign out. Signing out ends your session, invalidates the session cookie or refresh token on our servers, and clears the web app’s offline cache. You can also sign out other devices from Settings → Security.
- Uninstall. Uninstalling the mobile, desktop or installed web app removes its local storage; for the installed web app, also clear site data in your browser.
- Notifications. Turn off notifications in Inboxy’s Settings or in your device or browser settings to stop push delivery and remove your push token.
7. Do Not Track and Global Privacy Control
Some browsers send a “Do Not Track” (DNT) or “Global Privacy Control” (GPC) signal to say you do not want to be tracked or to have your data sold or shared. Inboxy honours these preferences by default for everyone: we do not track you across sites, and we do not sell or share personal data for advertising. Where the law treats GPC as a valid opt-out request (for example in California and Colorado), we treat it as one — although there is nothing further to opt out of.
8. Changes to this policy
We will update this policy whenever we change what we store. If a change introduces any storage that is not strictly necessary, we will ask for your consent before using it and, for material changes, notify you in the app or by email at least 30 days in advance. The date at the top shows when this policy was last updated.
9. Contact us
Questions about cookies or storage? Write to [email protected], or by post to [Nexlla Creative Agency — registered legal name], Attn: Privacy, [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates. For your rights over personal data, see Your rights in our Privacy Policy.
Questions about this document? Write to [email protected].