Privacy policy

KURDim ("kurd.im", "we", "us") provides paid, ad-free email mailboxes. This policy explains what we collect, why, and how it's handled. You are the customer here, not the product - we don't sell your data, and we don't mine your mail to sell ads.

1. Information we collect

Account & registration data. Your full name, the mailbox address you choose, and - optionally - a recovery email, phone number, and mailing address, if you provide them to help with account recovery or billing correspondence.

Payment data. Subscription billing is handled by Stripe. We never see or store your card number - Stripe collects it directly and gives us back only what's needed to manage your subscription (a payment method label, invoice history, subscription status).

Mailbox content. The email you send and receive through your mailbox is yours. It's hosted on our mail infrastructure to deliver the service you're paying for - we don't read, scan, or analyze it for advertising, and we don't sell it to anyone.

Technical & security data. Login timestamps, IP addresses, and similar request metadata, kept only to secure the service - detecting abuse, enforcing rate limits, and maintaining an audit trail of account-affecting actions.

Cookies. We use a single session cookie to keep you signed in. No third-party advertising or tracking cookies.

2. How we use your information

• To create and operate your mailbox and portal account.
• To process payments and send billing-related communication.
• To authenticate you and protect your account (password verification, two-factor authentication, recovery flows, abuse prevention).
• To respond when you contact support.
• To meet legal and tax obligations.

3. How we share your information

We don't sell your personal data. It's shared only with the service providers needed to run KURDim, and only to the extent each one needs:

• Stripe - payment processing and billing.
• MXRoute - the underlying mail server infrastructure your mailbox runs on.
• Law enforcement or regulators, only where we're legally required to.

4. Data retention

Account and mailbox data is kept for as long as your account is active. If a subscription lapses unpaid, the mailbox moves through a graduated timeline (sending disabled first, then login, before the mailbox and its contents are permanently deleted at 12 months of non-payment) - full detail is in our Terms of Service. After deletion, the address is held on a cooldown period before it can be registered again, so a new owner doesn't receive a previous owner's mail.

No soft delete. A deleted or purged mailbox isn't archived or flagged for later recovery - it's removed from our live systems outright. If that was your last mailbox with us, your personal profile information (name, recovery email, phone, mailing address) is cleared at the same time. What remains is an internal account reference and your Stripe billing history, which has its own independent retention basis for tax and accounting purposes. The one caveat is routine backups: our database is backed up on a rolling 30-day window for disaster recovery, so a just-deleted record can persist in that backup for up to 30 days before being overwritten, after which it's gone completely. Those backups are never used for anything other than disaster recovery. Mailbox content itself is hosted with our mail infrastructure provider, MXRoute, whose own backup retention is governed by their practices rather than ours.

Security and audit logs. Records of account-affecting actions (created, changed, deleted, billing events) are retained indefinitely, including the associated email address, for security, fraud-prevention, and dispute-resolution purposes.

5. Security

Passwords are stored as salted argon2 hashes, never in plain text. All traffic is encrypted in transit. Account recovery uses a one-time recovery key shown to you exactly once at signup - we don't retain a usable copy of it. Every webhook and payment event is cryptographically verified before we act on it.

6. Your rights

You can review or update your profile information anytime from your dashboard. To request a copy of your data, a correction, or deletion of your account, contact [email protected] from the mailbox address in question.

7. Children's privacy

KURDim is not directed at children, and we don't knowingly collect information from anyone under 16. If you believe a child has registered an account, contact us and we'll remove it.

8. Changes to this policy

If this policy changes materially, we'll update the date above and, where appropriate, notify active account owners.

9. Contact us

Questions about this policy or your data: [email protected].